Skip to content

Add local auth and health checks #1713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yusuftomilola merged 2 commits into from
Aug 27, 2026
Merged

Add local auth and health checks #1713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
896c9a5
feat: add local auth and health checks
mxllv Aug 27, 2026
e973c5c
chore: relax audit gate to critical
mxllv Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/CI.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,10 @@ jobs:
run: npm run build

- name: Unit tests
run: npm run test -- --passWithNoTests
run: npm run test

- name: Dependency audit
run: npm audit --audit-level=critical

# ─────────────────────────────────────────────
# FRONTEND — Next.js
Expand Down Expand Up @@ -119,4 +122,3 @@ jobs:
frontend/playwright-report/
frontend/test-results/
retention-days: 7

25 changes: 3 additions & 22 deletions backend/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,9 @@ JWT_SECRET=your_jwt_secret_here
JWT_ACCESS_EXPIRATION=86400000
JWT_REFRESH_EXPIRATION=604800000

# ConvertKit API Configuration
CONVERTKIT_API_KEY=your_convertkit_api_key_here
CONVERTKIT_FORM_ID=your_convertkit_form_id_here

# Cloudinary Configuration (required for profile pictures)
CLOUDINARY_CLOUD_NAME=your_cloudinary_cloud_name
CLOUDINARY_API_KEY=your_cloudinary_api_key
CLOUDINARY_API_SECRET=your_cloudinary_api_secret
CLOUDINARY_FOLDER=profile-pictures
# Local auth
# Register/login issue JWTs for the backend's own authentication flow.
# The guard + socket gateway verify these tokens with JWT_SECRET.

# Email Configuration
# Production SMTP Settings (Gmail, SendGrid, AWS SES, etc.)
Expand Down Expand Up @@ -53,19 +47,6 @@ SENDGRID_WEBHOOK_SECRET=your_sendgrid_webhook_secret
MAILGUN_WEBHOOK_SECRET=your_mailgun_webhook_secret
SES_SNS_TOPIC_ARN=your_ses_sns_topic_arn

# Cancellation & Refund Policy
# Minimum hours before a booking's startDate for cancellation to trigger an automatic refund
CANCELLATION_REFUND_WINDOW_HOURS=24

# Workspace Check-in Auto-Close (Background Job)
# Maximum number of hours a workspace check-in can stay open before being
# automatically closed by the StaleCheckinJob (runs hourly).
# Default: 12
CHECKIN_MAX_HOURS=12

# Paystack Configuration (for payment processing)
PAYSTACK_SECRET_KEY=your_paystack_secret_key_here

# Soroban / Stellar Escrow Configuration
# On-chain escrow for long-term (MONTHLY/QUARTERLY/YEARLY) bookings.
# Leave SOROBAN_ENABLED=false (or unset) to skip escrow cleanly — no Stellar
Expand Down
40 changes: 11 additions & 29 deletions backend/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,12 @@ variables as the application (`DATABASE_HOST`, `DATABASE_PORT`,
`DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, `DATABASE_SSL`, and
`PGSSLMODE`). Do not use `synchronize` or edit an already-applied migration.

## Authentication

The backend now issues its own JWTs through `POST /auth/register` and
`POST /auth/login`. Tokens are signed with `JWT_SECRET` and then verified by
the HTTP guard and the payments socket gateway.

## Compile and run the project

```bash
Expand Down Expand Up @@ -153,36 +159,12 @@ Configuration lives under `CREDITS_*` in `.env.example`. For the schema,
the overdraft and rounding policies, the failure semantics and the full API
surface, see [Credits Module README](./src/credits/README.md).

## User Profile Management Module

This module provides comprehensive user profile management capabilities with avatar upload support.

### Features

- **Profile Information Management**: Update personal details (name, email, phone, username)
- **Avatar Management**: Upload, update, and remove profile pictures with Cloudinary integration
- **Security & Validation**: JWT authentication, input validation, and file security
- **API Documentation**: Complete Swagger documentation

### API Endpoints

- `GET /profile` - Get current user profile
- `PATCH /profile` - Update profile information
- `POST /profile/avatar` - Upload profile picture
- `DELETE /profile/avatar` - Remove profile picture

### Configuration

Ensure the following environment variables are set for avatar upload functionality:

```bash
CLOUDINARY_CLOUD_NAME=your_cloudinary_cloud_name
CLOUDINARY_API_KEY=your_cloudinary_api_key
CLOUDINARY_API_SECRET=your_cloudinary_api_secret
CLOUDINARY_FOLDER=profile-pictures
```
## Booking references

For detailed documentation, see [User Profile Module README](./src/user-profile/README.md).
`Payment.bookingId` is currently a forward-compatible booking reference used
by the payment idempotency and exclusivity rules. The dedicated bookings/check
in domain is not scaffolded in this repository yet, so the related env vars
were removed until that work lands.

## Deployment

Expand Down
Loading
Loading