cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: complete release readiness work

Browse Source 
- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates
This commit is contained in:
cesnimda
2026-07-31 16:54:16 +02:00
parent a23c3dfc97
commit ce76046a29
1634 changed files with 6889 additions and 135429 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deferred-inputs.md
+21 -6
View File
@@ -4,21 +4,36 @@ Updated: 2026-07-31
## Stripe billing — Phase 7.5
Needed from the operator before implementation can finish:
Needed from the operator before the implemented flow can be activated:
- Add `STRIPE_SECRET_KEY` and `STRIPE_PUBLISHABLE_KEY` to the production environment.
- Add `STRIPE_SECRET_KEY` to the production environment. Hosted Checkout does not need a publishable key in the browser.
- Create the recurring Premium price and add `STRIPE_PRICE_PREMIUM`.
- Create the billing webhook and add `STRIPE_WEBHOOK_SECRET`.
- Enable the customer portal, register `/api/billing/webhook` for subscription created/updated/deleted events, and add `STRIPE_WEBHOOK_SECRET`.
- Do not store or paste secret values in the repository or chat.
## Production key rotation — Phase 1.4
Confirm the DataProtection keys exposed in git history have been rotated on the production host.
## Product direction
## Operator handoff
The committed roadmaps are exhausted after the operator blockers above. The remaining long-term options need prioritization before implementation: separate portfolio hosting, recruiter visibility, or learning paths. Public CV custom sections already cover a basic portfolio, so a separate product should only be built if that distinction is intentional.
The remaining work requires external systems or production access, in this order:
1. **Run remote CI** for the reviewed working tree and diagnose the self-hosted runner only if it still fails.
2. **Rotate production DataProtection keys** and complete the documented backup/restore rehearsal.
3. **Deploy and verify production** login, OAuth, registration/Turnstile, real data, public CV/PDF, AI, and attachments.
4. **Activate Stripe billing** after its product, price, portal, webhook, and secrets exist.
5. **Rehearse the legacy-column cutover** against the restored production backup; remove columns only in a later expand/contract release.
### Access and inputs still needed
- **CI:** a reviewed commit/branch submitted to Gitea Actions; runner host/log access if the workflow remains unstable.
- **Stripe:** create/configure the Premium recurring price, portal, and webhook, then set `STRIPE_SECRET_KEY`, `STRIPE_PRICE_PREMIUM`, and `STRIPE_WEBHOOK_SECRET` outside the repository and chat.
- **Production security:** confirm the DataProtection keys exposed in git history were rotated.
- **Production access:** authorized host credentials for backup/restore, deploy, authenticated smoke tests, OAuth, and legacy-data validation.
Recruiter-facing PDF download and job-specific learning paths are implemented and tested in the working tree. Separate recruiter discovery/messaging and portfolio hosting are intentionally outside the current product scope. The existing `.agent.md`/`AGENTS.md` changes and the migration designer's line-ending-only status are unrelated and must be preserved.
## Progress
Phases 2 through 7.9 are complete except Stripe billing. Public CV sharing, premium themes, AI call and token limits, visible account usage, storage limits, NAV discovery, provider market dual-write with synchronized edits, CORS hardening, the prospect workflow, migration-history reconciliation, and salary insights are pushed to `main`. Latest completed commit: `6ed56fd`.
Phases 2 through 7.9 are implemented. Production reports registration and Turnstile enabled; remote CI, interactive production verification, key rotation, Stripe activation, deployment, and the production-backed legacy cutover remain. Public CV sharing, job-specific learning paths, premium themes, AI call and token limits, visible account usage, storage limits, NAV discovery, provider market dual-write with synchronized edits, CORS hardening, the prospect workflow, migration-history reconciliation, salary insights, browser smoke coverage, and Stripe billing are present in the working tree.