cesnimda
ce76046a29
- consolidate API ownership and remove dead vendor code - add Stripe billing, learning paths, and public CV hardening - add migration, recovery, security, audit, and browser gates
40 lines
2.8 KiB
Markdown
40 lines
2.8 KiB
Markdown
# Deferred inputs
|
|
|
|
Updated: 2026-07-31
|
|
|
|
## Stripe billing — Phase 7.5
|
|
|
|
Needed from the operator before the implemented flow can be activated:
|
|
|
|
- Add `STRIPE_SECRET_KEY` to the production environment. Hosted Checkout does not need a publishable key in the browser.
|
|
- Create the recurring Premium price and add `STRIPE_PRICE_PREMIUM`.
|
|
- Enable the customer portal, register `/api/billing/webhook` for subscription created/updated/deleted events, and add `STRIPE_WEBHOOK_SECRET`.
|
|
- Do not store or paste secret values in the repository or chat.
|
|
|
|
## Production key rotation — Phase 1.4
|
|
|
|
Confirm the DataProtection keys exposed in git history have been rotated on the production host.
|
|
|
|
## Operator handoff
|
|
|
|
The remaining work requires external systems or production access, in this order:
|
|
|
|
1. **Run remote CI** for the reviewed working tree and diagnose the self-hosted runner only if it still fails.
|
|
2. **Rotate production DataProtection keys** and complete the documented backup/restore rehearsal.
|
|
3. **Deploy and verify production** login, OAuth, registration/Turnstile, real data, public CV/PDF, AI, and attachments.
|
|
4. **Activate Stripe billing** after its product, price, portal, webhook, and secrets exist.
|
|
5. **Rehearse the legacy-column cutover** against the restored production backup; remove columns only in a later expand/contract release.
|
|
|
|
### Access and inputs still needed
|
|
|
|
- **CI:** a reviewed commit/branch submitted to Gitea Actions; runner host/log access if the workflow remains unstable.
|
|
- **Stripe:** create/configure the Premium recurring price, portal, and webhook, then set `STRIPE_SECRET_KEY`, `STRIPE_PRICE_PREMIUM`, and `STRIPE_WEBHOOK_SECRET` outside the repository and chat.
|
|
- **Production security:** confirm the DataProtection keys exposed in git history were rotated.
|
|
- **Production access:** authorized host credentials for backup/restore, deploy, authenticated smoke tests, OAuth, and legacy-data validation.
|
|
|
|
Recruiter-facing PDF download and job-specific learning paths are implemented and tested in the working tree. Separate recruiter discovery/messaging and portfolio hosting are intentionally outside the current product scope. The existing `.agent.md`/`AGENTS.md` changes and the migration designer's line-ending-only status are unrelated and must be preserved.
|
|
|
|
## Progress
|
|
|
|
Phases 2 through 7.9 are implemented. Production reports registration and Turnstile enabled; remote CI, interactive production verification, key rotation, Stripe activation, deployment, and the production-backed legacy cutover remain. Public CV sharing, job-specific learning paths, premium themes, AI call and token limits, visible account usage, storage limits, NAV discovery, provider market dual-write with synchronized edits, CORS hardening, the prospect workflow, migration-history reconciliation, salary insights, browser smoke coverage, and Stripe billing are present in the working tree.
|