3 Commits

Author	SHA1	Message	Date
Ho Ngoc Hai	d4652fd0f9	fix(auth): use env-configurable bcrypt rounds to prevent test timeout ... HashedPassword.vo.spec.ts was timing out because SALT_ROUNDS=12 is too expensive for the test runner. Make bcrypt rounds configurable via BCRYPT_ROUNDS env var (default 12 for production), and set BCRYPT_ROUNDS=4 in vitest config for fast unit tests. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 23:26:43 +07:00
Ho Ngoc Hai	03231271ca	fix(security): remove MinIO hardcoded credentials & add presigned URL support ... - Remove hardcoded minioadmin/minioadmin_secret fallback from docker-compose.yml, require MINIO_ACCESS_KEY/MINIO_SECRET_KEY env vars (fail-fast with :? syntax) - Align docker-compose.yml env var names with .env.example (MINIO_ACCESS_KEY/SECRET_KEY) - Update CI e2e workflow to use GitHub vars with non-default fallbacks - Update .env.test to use non-default test credentials - Add @aws-sdk/s3-request-presigner and getPresignedUploadUrl() method to MinioMediaStorageService for properly signed client-side uploads - Remove hardcoded credentials from dev-environment docs Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-08 22:44:50 +07:00
Ho Ngoc Hai	bac3313873	test(auth,payments,subs): add 58 unit tests for critical auth, payment, and subscription paths ... Cover auth handlers (RegisterUser, LoginUser, RefreshToken), TokenService (token rotation, reuse attack detection), payment callback edge cases (duplicate/concurrent callbacks, multi-provider), subscription lifecycle transitions (expire, pastDue, renew), and throttler proxy guard. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-08 13:49:19 +07:00