Commit Graph

14 Commits

Author SHA1 Message Date
Ho Ngoc Hai
e03c4699d0 feat(api): implement GDPR-compliant user data deletion
- Add deletedAt/deletionScheduledAt fields to User model with indexes
- Implement 5 CQRS command handlers:
  - RequestUserDeletion: 30-day soft-delete grace period
  - CancelUserDeletion: restore within grace period
  - ForceDeleteUser: admin immediate deletion with PII anonymization
  - ProcessScheduledDeletions: cron-ready batch processor
  - ExportUserData: GDPR Article 20 data portability
- Cascade strategy: anonymize PII, expire listings, cancel subscriptions,
  delete reviews/inquiries/searches/notifications, preserve payments for audit
- Add UserDataController with DELETE /users/me, POST /users/me/cancel-deletion,
  GET /users/me/export, DELETE /users/:id/force (admin)
- 22 unit tests covering all handlers (160 files, 853 tests passing)
- Migration: 20260410000000_add_user_soft_delete_fields

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-10 05:43:54 +07:00
Ho Ngoc Hai
ef47d9eb80 chore(db): add query indexes migration and update project config
- Add database migration for missing query indexes on frequently filtered columns
- Update Prisma schema
- Update .env.example, eslint config, and dependency-cruiser config

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-09 09:44:37 +07:00
Ho Ngoc Hai
45ebc6cf1d feat: API versioning, compound indexes, and new exports
- Add global /api/v1/ prefix with health/ready exclusions
- Add compound indexes on Property and Listing for query optimization
- Export CsrfMiddleware and UploadedFile type from shared infra
- New Prisma migration for compound indexes

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-09 01:27:17 +07:00
Ho Ngoc Hai
6f3e6998ac feat(notifications): complete notification delivery system with email, push, and in-app support
Add 5 new event listeners (listing.approved, listing.rejected, payment.confirmed,
subscription.expiring, inquiry.received), 3 new Handlebars templates, readAt field
for in-app read/unread tracking, unread/mark-as-read API endpoints, and unit tests.

All 57 notification tests pass, lint clean, typecheck clean.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-09 00:11:34 +07:00
Ho Ngoc Hai
0abf9df84e fix(db): add missing Review.userId index for FK query performance
The Review table was missing an index on userId, causing full table scans
when querying reviews by user. All other FK columns across 22 models were
verified to have proper indexes already (including Listing.sellerId which
was added in a prior migration).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 22:43:59 +07:00
Ho Ngoc Hai
3864f78405 feat(subscriptions): implement subscription quota enforcement
- Apply QuotaGuard + @RequireQuota to listing creation and analytics endpoints
- Add QuotaExceeded domain event emitted when quota is exceeded
- Create ListingCreatedUsageHandler to auto-meter usage on listing creation
- Create QuotaExceededListener to send email notifications on quota exceeded
- Add maxAnalyticsQueries and maxMediaUploads fields to Plan model
- Add quota.exceeded email notification template
- Define quota limits per plan tier in seed data
- Add 15 unit tests covering guard, event handler, listener, and event

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 14:16:32 +07:00
Ho Ngoc Hai
af71270a2e feat: upgrade major dependencies to latest versions
- Prisma 6.19 → 7.7 (driver adapter pattern, prisma.config.ts)
- TypeScript 5.9 → 6.0 (ignoreDeprecations, CSS type declarations)
- Vitest 3.2 → 4.1
- Pino 9.14 → 10.3
- @types/node 22.x → 25.x

All 307 tests pass, typecheck clean, build succeeds.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 13:15:36 +07:00
Ho Ngoc Hai
91ef71d5e1 fix(db): add missing indexes, bound unbounded queries, parallelize admin queries
- Add 7 missing indexes: User(kycStatus, isActive, createdAt),
  Listing(createdAt, featuredUntil, expiresAt), Payment(createdAt)
- Add take:50 limit to unbounded findMediaByPropertyId and findByPropertyId
- Parallelize sequential queries in getUserDetail with Promise.all

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 13:10:39 +07:00
Ho Ngoc Hai
91b76d567b fix(api): add JWT scheme to @ApiBearerAuth and fix Prisma 7 extensions config
- Add 'JWT' scheme name to @ApiBearerAuth() in payments & subscriptions
  controllers so Swagger UI correctly links to the JWT security definition
- Add postgresqlExtensions preview feature to Prisma schema for v7 compat

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 13:08:03 +07:00
Ho Ngoc Hai
9583d1cb66 fix(payments): harden payment flow with idempotency keys, amount validation, and magic byte file validation
- Add dedicated idempotencyKey column with unique constraint (userId, provider, idempotencyKey) to prevent duplicate payments at DB level
- Add @Min(1) @Max(100B) validators on amountVND in CreatePaymentDto to reject invalid amounts at API boundary
- Replace read-check-write callback handler with atomic updateIfStatus to eliminate race condition on concurrent callbacks
- Add magic byte verification in FileValidationPipe to validate file content matches declared MIME type server-side

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 06:18:26 +07:00
Ho Ngoc Hai
f55c8a8788 feat(db): add missing FK indexes on Listing, Payment, Subscription
- Add @@index([sellerId]) and @@index([propertyId]) to Listing model
- Add @@index([transactionId]) to Payment model
- Add @@index([planId]) to Subscription model
- Prevents full table scans on frequently-queried foreign keys

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 04:02:13 +07:00
Ho Ngoc Hai
0b29fac35e feat(notifications): add multi-channel notification module with Email, FCM, templates, and event listeners
- Domain: NotificationLog/NotificationPreference entities, repositories, channel value object
- Infrastructure: EmailService (nodemailer/SMTP), FcmService (firebase-admin), TemplateService (Handlebars)
- Application: SendNotification CQRS command, UserRegistered + AgentVerified event listeners
- Presentation: NotificationsController with history, preferences, and templates endpoints
- Prisma: NotificationLog and NotificationPreference models with proper indexes
- Templates: Vietnamese notification templates for user.registered, agent.verified, listing.approved, inquiry.received, password.reset

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 01:42:17 +07:00
Ho Ngoc Hai
391c040100 feat(auth): implement Auth module with register, login, JWT, guards, and CQRS
- Add RefreshToken and OAuthAccount models to Prisma schema
- Implement clean architecture: domain (entities, VOs, events, repo interfaces),
  infrastructure (Prisma repos, Passport strategies, token service),
  application (CQRS command/query handlers), presentation (controller, guards, DTOs)
- Endpoints: POST /auth/register, /auth/login, /auth/refresh, GET /auth/profile,
  GET /auth/profile/agent, PATCH /auth/kyc
- JWT access + refresh token rotation with family-based revocation
- Role-based guards (BUYER, SELLER, AGENT, ADMIN)
- 16 unit tests (value objects, entity) + integration test suite
- All 80 tests passing, clean TypeScript build

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 00:24:42 +07:00
Ho Ngoc Hai
e1e5fa6252 feat: scaffold monorepo with Turborepo + NestJS + Next.js
- Turborepo monorepo with pnpm workspaces
- apps/api: NestJS 11.x with CQRS module
- apps/web: Next.js 14 App Router + TailwindCSS
- src/modules/shared: base entities, Result pattern, value objects
- TypeScript 5.7+ strict mode, shared tsconfig base
- Build pipeline: dev, build, lint, test, typecheck

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-07 23:52:33 +07:00