cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: require verified production email
CI and Deploy / test (pull_request) Successful in 4m42s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details
CI and Deploy / test (push) Successful in 4m2s
Details
CI and Deploy / deploy (push) Failing after 1m15s
Details

Browse Source 
Expose the existing email-verification setting through Compose and close the completed DataProtection rotation blocker.
This commit is contained in:
cesnimda
2026-08-02 17:59:05 +02:00
parent 955182b7c2
commit 06518a7d52
7 changed files with 13 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/current.md
+1 -1
View File
@@ -386,7 +386,7 @@ Compose bounds each container's local logs to three 10 MB files. There is still
| Sev | Finding | Status |
|---|---|---|
| Medium | DataProtection keys recoverable from git history (`519c32e`, `955cae6`) | **Open — rotation required, needs an operator** |
| Medium | DataProtection keys recoverable from git history (`519c32e`, `955cae6`) | **Closed 2026-08-02 — production keys rotated by the operator** |
| Medium | Wildcard credentialed CORS configuration | **Closed — startup rejects it** |
| Medium | AI cost ceiling | **Closed — monthly generation/token limits are enforced by plan** |
| Low | Public-registration abuse control | Implemented with Turnstile; production keys/configuration still required |
docs/deferred-inputs.md
+2 -3
View File
@@ -13,14 +13,14 @@ Needed from the operator before the implemented flow can be activated:
## Production key rotation — Phase 1.4
Confirm the DataProtection keys exposed in git history have been rotated on the production host.
DataProtection key rotation was confirmed complete by the production operator on 2026-08-02.
## Operator handoff
The remaining work requires external systems or production access, in this order:
1. **Run remote CI** for the reviewed working tree and diagnose the self-hosted runner only if it still fails.
2. **Rotate production DataProtection keys** and complete the documented backup/restore rehearsal.
2. **Completed 2026-08-02:** production DataProtection keys rotated.
3. **Deploy and verify production** login, OAuth, registration/Turnstile, real data, public CV/PDF, AI, and attachments.
4. **Activate Stripe billing** after its product, price, portal, webhook, and secrets exist.
5. **Rehearse the legacy-column cutover** against the restored production backup; remove columns only in a later expand/contract release.
@@ -29,7 +29,6 @@ The remaining work requires external systems or production access, in this order
- **CI:** a reviewed commit/branch submitted to Gitea Actions; runner host/log access if the workflow remains unstable.
- **Stripe:** create/configure the Premium recurring price, portal, and webhook, then set `STRIPE_SECRET_KEY`, `STRIPE_PRICE_PREMIUM`, and `STRIPE_WEBHOOK_SECRET` outside the repository and chat.
- **Production security:** confirm the DataProtection keys exposed in git history were rotated.
- **Production access:** authorized host credentials for backup/restore, deploy, authenticated smoke tests, OAuth, and legacy-data validation.
Recruiter-facing PDF download and job-specific learning paths are implemented and tested in the working tree. Separate recruiter discovery/messaging and portfolio hosting are intentionally outside the current product scope. The existing `.agent.md`/`AGENTS.md` changes and the migration designer's line-ending-only status are unrelated and must be preserved.
docs/implementation-roadmap.md
+2 -2
View File
@@ -38,7 +38,7 @@ Goal: finish surfacing the pre-application workflow in the UI, and close the sec
| 1.1 | ✅ **DONE** — `Saved`, `Interested`, and `Preparing` are exposed through the shared pipeline model, grouped Kanban, filters, and status menus. | **P0** | **M** | Phase 0 | Prospect workflow is visible end to end. |
| 1.2 | ✅ **DONE (2026-07-30)** — new jobs default to `Saved`; users can choose any later stage in the wizard. | **P0** | **XS** | 1.1 | New opportunities no longer imply an application was already submitted. |
| 1.3 | ✅ **DONE** — draggable cards move between grouped Kanban columns, persist the destination entry stage, and retain precise stage selection in the card menu. | **P2** | **M** | 1.1 | Covered by grouped-board drag/drop regression tests. |
| 1.4 | **Rotate DataProtection keys** | **P1** | **XS** | none | **Needs an operator — cannot be done from here.** Keys remain recoverable from git history (`519c32e`, `955cae6`). Open since 2026-07-03. |
| 1.4 | **Rotate DataProtection keys** | **P1** | **XS** | none | **Complete 2026-08-02.** Production keys rotated by the operator. |
| 1.5 | ✅ **DONE (2026-07-30)** — startup rejects wildcard CORS origins when credentialed requests are enabled. | **P1** | **XS** | none | Unsafe configuration now fails closed. |
| 1.6 | ✅ **DONE** — the dead `careerView` prop/tab is gone; the implemented CV Builder has its own routed workspace. | **P1** | **XS** | none | No dead navigation remains. |
| 1.7 | ✅ **DONE** — onboarding reads structured career-profile collections with raw CV text only as fallback. | **P2** | **XS** | none | Parsed profiles are recognized correctly. |
@@ -226,7 +226,7 @@ Stripe code is complete; activation can follow once the product, monthly price,
| Phase | Rough size | Note |
|---|---|---|
| 0 — Foundation | **done** | Delivered 2026-07-17. |
| 1 — Critical fixes | **code complete** | DataProtection rotation remains an operator task. |
| 1 — Critical fixes | **complete** | DataProtection rotation confirmed 2026-08-02. |
| 2 — UX | **done** | Delivered 2026-07-30. |
| 3 — Career Workspace | **done** | Delivered 2026-07-30. |
| 4 — CV Builder | **done** | Delivered 2026-07-30; public PDF completed 2026-07-31. |