Commit Graph

10 Commits

Author SHA1 Message Date
Radosław Gierwiało
0e5dc34cbf docs: add Phase 1.6 Competition Heats System implementation plan 2025-11-14 15:21:00 +01:00
Radosław Gierwiało
61f504fa72 docs: update documentation for QR code check-in system 2025-11-14 14:43:33 +01:00
Radosław Gierwiało
21ba899f98 docs: update README and docs to reflect Phase 1.5 completion
Update documentation to accurately reflect all features implemented in Phase 1.5:

README.md updates:
- Replace outdated "mockup" references with real implementation status
- Add comprehensive feature list with Phase 1.5 additions
- Document 7 database tables (added event_participants)
- Add user profile features (social media, location, public profiles)
- Add event security features (unique slugs)
- Update tech stack versions and test coverage (81%+)
- Add detailed setup instructions for dev and prod profiles
- Update roadmap to show Phase 1.5 as completed

SESSION_CONTEXT.md updates:
- Update current status to Phase 1.5 completed (65% overall)
- Add new features to "What Works Now" section
- Update database schema to 7 tables with all Phase 1.5 fields
- Add new migrations (event slugs)
- Update key files list with Phase 1.5 changes
- Update frontend routes to use slugs (/events/:slug/chat)

TODO.md updates:
- Mark Phase 1.5 as completed with full feature list
- Update progress tracking table (65% overall completion)
- Update last modified date to 2025-11-13

Phase 1.5 features documented:
- Email verification (AWS SES with link + PIN code)
- Password reset workflow
- WSDC API integration
- User profiles (social media links: YouTube, Instagram, Facebook, TikTok)
- User location (country dropdown with 195 countries, city)
- Public profiles accessible at /{username}
- Event participation tracking (auto-save joined events)
- Event security (12-char unique slugs, prevent ID enumeration)
2025-11-13 21:51:11 +01:00
Radosław Gierwiało
3ff966defc refactor: migrate to native Docker Compose profiles
Simplified Docker Compose configuration by using native profiles
instead of override files, following best practices.

Changes:
- Consolidated docker-compose.yml with --profile dev/prod support
- Removed docker-compose.dev.yml and docker-compose.prod.yml
- Updated all documentation for new usage pattern
- Created comprehensive README.md and DEPLOYMENT.md
- Simplified commands: 'docker compose --profile dev up'

Environment-specific configurations:
- Development: relaxed security, hot reload, exposed ports
- Production: strict security, optimized builds, restricted access

This approach is cleaner, more maintainable, and follows Docker
Compose best practices.
2025-11-13 18:00:08 +01:00
Radosław Gierwiało
bf8a9260bd security: implement CRITICAL and MEDIUM security fixes with environment profiles
This commit addresses all CRITICAL and MEDIUM security vulnerabilities
identified in the security audit with environment-aware configuration.

## Docker Compose Profiles

- Added docker-compose.dev.yml for development (relaxed security)
- Added docker-compose.prod.yml for production (strict security)
- Environment-specific configurations for rate limiting, CSRF, logging

## CRITICAL Fixes (P0)

1. Fixed insecure random number generation
   - Replaced Math.random() with crypto.randomBytes() for verification codes
   - Now cryptographically secure

2. Implemented rate limiting
   - express-rate-limit for all endpoints
   - Strict limits on auth endpoints (5 attempts in dev=off, prod=5)
   - Email endpoint limits (20 in dev, 3 in prod)
   - API-wide rate limiting

3. Added request body size limits
   - Development: 50MB (for testing)
   - Production: 10KB (security)

4. Fixed user enumeration vulnerability
   - Generic error message for registration
   - No disclosure of which field exists

5. Added security headers
   - helmet.js with CSP, HSTS, XSS protection
   - No-sniff, hide powered-by headers

## MEDIUM Fixes (P1)

6. Strengthened password policy
   - Environment-aware validation (8+ chars)
   - Production: requires uppercase, lowercase, number
   - Development: relaxed for testing

7. Enhanced input validation
   - Validation for all auth endpoints
   - WSDC ID validation (numeric, max 10 digits)
   - Name validation (safe characters only)
   - Email normalization

8. Added input sanitization
   - DOMPurify for XSS prevention
   - Sanitize all user inputs in emails
   - Timing-safe string comparison for tokens

9. Improved error handling
   - Generic errors in production
   - Detailed errors only in development
   - Proper error logging

10. Enhanced CORS configuration
    - Whitelist-based origin validation
    - Environment-specific allowed origins
    - Credentials support

## New Files

- backend/src/config/security.js - Environment-aware security config
- backend/src/middleware/rateLimiter.js - Rate limiting middleware
- backend/src/utils/sanitize.js - Input sanitization utilities
- backend/.env.example - Development environment template
- backend/.env.production.example - Production environment template
- docker-compose.dev.yml - Development overrides
- docker-compose.prod.yml - Production configuration
- docs/DEPLOYMENT.md - Complete deployment guide
- docs/SECURITY_AUDIT.md - Full security audit report
- .gitignore - Updated to exclude .env files

## Dependencies Added

- helmet (^8.1.0) - Security headers
- express-rate-limit (^8.2.1) - Rate limiting
- dompurify (^3.3.0) - XSS prevention
- jsdom (^27.2.0) - DOM manipulation for sanitization

## Testing

-  Password validation works (weak passwords rejected)
-  User enumeration fixed (generic error messages)
-  WSDC lookup functional
-  Registration flow working
-  Rate limiting active (environment-aware)
-  Security headers present

## Usage

Development:
  docker compose -f docker-compose.yml -f docker-compose.dev.yml up

Production:
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up

See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
Radosław Gierwiało
7a2f6d07ec feat: add email verification, password reset, and WSDC integration (Phase 1.5)
Backend features:
- AWS SES email service with HTML templates
- Email verification with dual method (link + 6-digit PIN code)
- Password reset workflow with secure tokens
- WSDC API proxy for dancer lookup and auto-fill registration
- Extended User model with verification and WSDC fields
- Email verification middleware for protected routes

Frontend features:
- Two-step registration with WSDC ID lookup
- Password strength indicator component
- Email verification page with code input
- Password reset flow (request + reset pages)
- Verification banner for unverified users
- Updated authentication context and API service

Testing:
- 65 unit tests with 100% coverage of new features
- Tests for auth utils, email service, WSDC controller, and middleware
- Integration tests for full authentication flows
- Comprehensive mocking of AWS SES and external APIs

Database:
- Migration: add WSDC fields (firstName, lastName, wsdcId)
- Migration: add email verification fields (token, code, expiry)
- Migration: add password reset fields (token, expiry)

Documentation:
- Complete Phase 1.5 documentation
- Test suite documentation and best practices
- Updated session context with new features
2025-11-13 15:47:54 +01:00
Radosław Gierwiało
4d7f814538 docs: update documentation after Phase 1 completion
Updated documentation to reflect completion of Phase 1 (Backend Foundation):

- SESSION_CONTEXT.md: Updated status to Phase 1 completed, ~50% progress
  - Added completed backend infrastructure details
  - Updated tech stack with actual versions
  - Added Phase 2 next steps (Matches API, Ratings, WebRTC)
  - Updated key files list with backend files
  - Added Prisma OpenSSL bug fix to known issues

- TODO.md: Marked Phase 1 as completed, Phase 2 as active
  - Moved Phase 1 steps to completed section with checkmarks
  - Added detailed Phase 2 tasks (4 steps: Matches API, Ratings API, WebRTC Signaling, WebRTC File Transfer)
  - Reorganized future phases (removed Phase 2 from future, renumbered)

- COMPLETED.md: Added comprehensive Phase 1 completion record
  - All 4 steps documented with checkmarks
  - Test coverage statistics (81.19% overall)
  - Infrastructure updates
  - Bug fixes (OpenSSL for Prisma)
  - Git commit history for Phase 1
2025-11-12 22:51:11 +01:00
Radosław Gierwiało
a1357393e8 docs: optimize documentation structure for token efficiency
- Add SESSION_CONTEXT.md: ultra-compact context for new sessions (~500 lines)
- Add ARCHITECTURE.md: detailed technical specs and implementation details
- Add COMPLETED.md: archive of completed tasks (Phase 0)
- Add RESOURCES.md: learning resources and documentation links
- Refactor CONTEXT.md: keep only core project info and guidelines
- Refactor TODO.md: keep only active tasks and next steps
- Update README.md: reference new documentation structure

This change reduces token usage when resuming sessions by ~60% while maintaining complete project documentation in separate, well-organized files.
2025-11-12 18:07:42 +01:00
Radosław Gierwiało
f6882c7025 docs: update TODO.md with completed tasks and next steps
- Mark completed tasks from Phase 0 (frontend mockup)
- Add detailed next steps with time estimates
- Update project progress (~25% complete)
- Add suggested roadmap for Phase 1 (backend foundation)
- Include additional learning resources
2025-11-12 17:54:49 +01:00
Radosław Gierwiało
80ff4a70bf feat: initial project setup with frontend mockup
- Docker Compose setup with nginx reverse proxy and frontend service
- React + Vite + Tailwind CSS configuration
- Complete mockup of all application views:
  - Authentication (login/register)
  - Events list and selection
  - Event chat with matchmaking
  - 1:1 private chat with WebRTC P2P video transfer mockup
  - Partner rating system
  - Collaboration history
- Mock data for users, events, messages, matches, and ratings
- All UI text and messages in English
- Project documentation (CONTEXT.md, TODO.md, README.md, QUICKSTART.md)
2025-11-12 17:50:44 +01:00