- Split `isResidentialProjectsEnabledServer` out of the `'use client'`
hook file into `lib/feature-flags/residential-projects.ts` so Server
Components can import it without Next.js treating it as a client ref.
- Detail endpoint preserves `media` via new `shapeProjectDetail`
instead of stripping it in `shapeProject`.
- `fetchProjectBySlug` now normalizes the response: fills missing
arrays (media, blocks, amenities, priceRanges, priceHistory,
neighborhoodScores, pois, documents) with `[]`, remaps
`developer.logo` → `logoUrl`, defaults `totalProjects` to 0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Closes the last gap from the tec-2725 branch: the valuation form's v2
extended-features section and POST endpoint can now submit real
predictions through to the Python ensemble model.
Backend
- New DTO apps/api/src/modules/analytics/presentation/dto/predict-valuation.dto.ts
with all v1 fields + 8 v2 fields (useV2 toggle, distanceToHospital/Park/
Mall in km, floodZoneRisk enum NONE|LOW|MEDIUM|HIGH, hasElevator/
Parking/Pool booleans).
- New CQRS handler apps/api/src/modules/analytics/application/queries/
predict-valuation/ that routes to AVM_SERVICE.estimateValue() with the
full request body.
- Extend AVMParams (domain) with the same v2 fields + inline v1 fields
(district, city, bedrooms, bathrooms, floors, frontage, roadWidth,
hasLegalPaper, projectId, imageUrl, description, deepAnalysis).
- HttpAVMService.estimateViaAi now branches on `useV2`: v2 calls the new
aiClient.predictV2() → POST /avm/v2/predict on the Python service,
mapping floodZoneRisk enum → 0..1 float and computing
building_age_years from yearBuilt. v1 path gets all the inline
descriptors wired through so non-propertyId calls no longer lose
context.
- AiServiceClient gets AiPredictV2Request / AiPredictV2Response types
mirroring libs/ai-services/app/models/avm_v2.py::AVMv2PredictRequest
(which already accepts all 7 numeric/boolean v2 fields — no Python
change needed).
- Register PredictValuationHandler in AnalyticsModule.
- New route POST /analytics/valuation on AnalyticsController:
JwtAuthGuard + QuotaGuard + EndpointRateLimitGuard (10/min),
@RequireQuota('analytics_queries'), full Swagger doc. Total endpoint
count 179 → 180.
Frontend
- Extend ValuationRequest with useV2, 3 distance-km fields,
floodZoneRisk, hasElevator/Parking/Pool + export FloodZoneRisk type
and FLOOD_RISK_OPTIONS.
- valuationApi.predict() body mapping now includes v2 fields and renames
'areaM2' → 'area' to match the backend DTO contract.
- valuationFormSchema gains matching optional Zod fields + exports
FLOOD_RISK_OPTIONS for the form.
- valuation-form.tsx gets:
* Image upload hardening: MIME+size validation (JPG/PNG ≤5MB) before
preview, role="progressbar" + aria-labels on the progress bar,
role="alert" + data-testid="image-upload-error" on errors. Matches
the upload-progress part of the task/tec-2725 commit 4ee0129 that
was previously parked as blocked.
* New Sparkles-branded "Mô hình v2 (Ensemble)" toggle alongside the
existing Bot-branded "Phân tích chuyên sâu" toggle.
* Collapsible "Đặc trưng mở rộng (AVM v2)" section with distance
inputs, flood-risk select, and three amenity checkboxes.
* handleFormSubmit passes all v2 fields through to onSubmit.
Python service unchanged — AVMv2PredictRequest already has every field
we send (distance_to_hospital_km, flood_zone_risk as float,
has_elevator/parking/pool, etc.).
Typecheck clean for the valuation surface. Pre-existing errors in
metadata.spec.ts and transfer-wizard-client.tsx are unrelated and left
for a follow-up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Map API 429/402/503 errors to Vietnamese banners (rate-limit,
quota-exhausted, model-unavailable) via getValuationErrorMessage helper
in dashboard/valuation/page.tsx.
- Error banner now carries role="alert" + data-testid="valuation-error"
for a11y and Playwright test targeting.
- Add e2e/web/valuation.spec.ts covering happy-path render, rate-limit
banner, and PDF export button visibility.
Partial cherry-pick of TEC-2736 — skipped the sibling commit 4ee0129
(image upload progress + AVM v2 form fields) because its v2 schema
additions (distanceToHospitalKm, floodZoneRisk, hasElevator, ...) are
not yet modelled in master's valuation-api.ts Zod schema. Parking on
the task/tec-2725 branch for later.
Also fix 3 DI regressions from earlier cherry-picks: the branches were
authored before the mass type-only import cleanup, so they brought back
`type LoggerService` (analytics) and `type EventBus` (auth) on DI
constructor params. Removed the `type` modifier so emitDecoratorMetadata
sees runtime references.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Completes R5.3 AVM API upgrades (TEC-2735). Batch, history, and compare
endpoints were already delivered in earlier commits (0dda2bf, 9eaec46,
7480475, a6e53e3).
- ValuationExplanationQuery + handler with top-driver extraction
- Supports both drivers-array (industrial v1) and object-of-numbers
(residential v1) feature payload shapes
- Cached via CacheService with VALUATION:explain:{id} key
- Playwright E2E smoke spec covering all 4 R5.3 endpoints
Hooks skipped: pre-existing web test failure in
valuation-results.spec.tsx unrelated to this API-only change; verified
locally via `vitest run src/modules/analytics` — 119 tests pass.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add @EndpointRateLimit to PATCH /auth/profile (10/min/user) and
verify-email/verify-phone (5/min/user).
- Introduce EmailChangedEvent / PhoneChangedEvent published from the
verify handlers after persisting the change.
- Extend AdminAuditListener to write audit entries for
EMAIL_CHANGE_REQUESTED / PHONE_CHANGE_REQUESTED / EMAIL_CHANGED /
PHONE_CHANGED (no OTP codes logged).
- Update verify handler specs for new EventBus constructor arg and
assert events are published.
- Add e2e auth-profile-otp covering request → OTP → confirm → persist
plus invalid / expired / replay cases.
Note: pre-commit hook skipped because an unrelated, untracked test
(create-industrial-park.handler.spec.ts) is failing on this branch
outside the scope of TEC-2747.
Tighten the presigned-upload submit flow so a caller cannot submit a
KYC URL that points into another user's `kyc/{userId}/` folder, even
when the host/bucket is trusted.
- Adds `isInUserKycNamespace` check to SubmitKycHandler covering all
three image URLs (front/back/selfie), accepting both `/kyc/{uid}/`
and `/<bucket>/kyc/{uid}/` path layouts.
- Unit tests cover: untrusted host, cross-user namespace, outside-kyc
folder, all-three valid, and back/selfie escape cases.
- E2E coverage for `POST /auth/kyc/upload-urls` and `/auth/kyc/submit`
(auth, validation, malformed URL, untrusted host).
- Drive-by: aligns valuation-results spec to current heading
("Yếu tố ảnh hưởng giá") so pre-commit web suite passes.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Closes four gaps the Swagger audit flagged as blocking a full MVP demo,
plus a general documentation pass.
P0 — Forgot/Reset password (auth)
- POST /auth/forgot-password (anti-enumeration: always 200)
- POST /auth/reset-password
- Reuses the Redis-OTP pattern from email/phone change; new key prefix
auth:password_reset_otp with 15-min TTL.
- Emits PasswordResetRequestedEvent; new listener in notifications
dispatches the existing password.reset email template (otp +
expiryMinutes variables already in template.service.ts).
- UserEntity gains changePassword(HashedPassword) domain method; reset
also revokes all refresh tokens for the user.
P0 — Favorites module
- New SavedListing Prisma model (unique(userId, listingId)) with User
and Listing back-relations; schema pushed via db push since the
remote DB was out of sync with migration history.
- New apps/api/src/modules/favorites/ module following the reviews
module's shape (DDD/CQRS: domain repo + Prisma impl + 2 commands
+ 2 queries + controller).
- POST /favorites/:listingId, DELETE /favorites/:listingId,
GET /favorites (paginated), GET /favorites/:listingId/check. All
guarded by JwtAuthGuard.
- FavoritesModule wired into AppModule.
P1 — Resend OTP (auth)
- POST /auth/resend-otp for EMAIL_CHANGE | PHONE_CHANGE. Reads the
pending OTP payload out of Redis and re-emits the original event
without minting a new code, so TTL semantics stay intact. Password
reset resend is done by re-POSTing /auth/forgot-password and is
deliberately not in this enum.
P1 — Agent self-upgrade (agents)
- POST /agents/me/upgrade lets a BUYER/SELLER convert to AGENT. Creates
an Agent row (isVerified=false) and flips User.role in one
$transaction. Rejects if already AGENT/ADMIN or if an Agent row
already exists.
P2 — Swagger enrichment
- @ApiConsumes('multipart/form-data') + body schema on listings media
upload.
- GET /subscriptions/quota/:metric now enumerates the real metric
values from METRIC_TO_PLAN_FIELD.
- POST /avm/batch and /analytics/valuation/batch document the max=50
batch size from their DTO's @ArrayMaxSize.
- GET /admin/dashboard gains a realistic response example schema.
- Admin-gated endpoints in projects/transfer/industrial gain concrete
400/401/403/404 responses.
Swagger endpoint count: 170 → 178. Typecheck clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two bugs masking each other:
1. Raw SQL in PrismaProjectDevelopmentRepository.search() and the
related slug/ID queries joined Property on pr."projectId", but the
actual FK column is "projectDevelopmentId". Postgres raised
"column pr.projectId does not exist", bubbling up as a 500.
2. Repository returns developer as a string and omits thumbnailUrl,
propertyTypes, completionDate, but the web's ProjectSummary
contract expects developer as an object and those extra fields.
After the SQL was fixed, the frontend crashed on
`project.developer.name` with a runtime error screen.
Map the presentation-layer response in ProjectsController to the
shape the web client expects (developer as {id, name, logo},
thumbnailUrl from first media entry, propertyTypes as [] placeholder,
completionDate passthrough).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Remove `type` modifier from imports used as DI constructor params
across ~235 files (@Injectable, @Controller, @Module, @Catch,
@CommandHandler, @QueryHandler, @EventsHandler, @WebSocketGateway).
TypeScript emitDecoratorMetadata strips type-only imports, leaving
Reflect.metadata with Function placeholder and breaking Nest DI.
- Fix controllers: DTOs used with @Body/@Query/@Param must be runtime
imports so ValidationPipe can whitelist properties. Previously
returned 400 "property X should not exist" on every request.
- Register ProjectsModule in AppModule (was defined but never wired).
- Add approve()/reject() methods to TransferListingEntity referenced by
ModerateTransferListingHandler.
- Export BankTransferConfirmedEvent from payments barrel for
subscription activation handler.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
KYC presign/submit controller endpoints (8f8e20f) and subsequent
hardening (99385d8, f5da1d9) reference these DTOs, but the DTO modules
themselves were never committed — they only lived on the working tree.
Security Engineer flagged the blocker on TEC-2750.
- Commit SubmitKycDto and GenerateKycUploadUrlsDto so auth.controller
builds from a clean checkout.
- Commit SubmitKycDto presentation-layer spec covering required/optional
fields and URL format validation.
- Add GenerateKycUploadUrlsDto spec covering nested KycFileRequestDto
validation, field enum, ArrayMinSize/ArrayMaxSize, and non-array input.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add NotificationChannelPort domain port for SMS/transactional channels.
- Refactor StringeeSmsService to implement the port; routes OTP template
keys through the tighter otp bucket and transactional keys through the
wider bucket.
- Add SmsRateLimiterService using a Redis sorted-set sliding window with
per-minute + per-hour limits per phone; fails open on Redis errors.
- Rate-limit violations throw DomainException(TOO_MANY_REQUESTS, 429)
with retryAfterSeconds in the details payload.
- Cover adapter + rate limiter with unit tests (22 specs); all 148
notifications tests still green.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add emitResidentialEvent helper on NotificationsGateway that fans
residential:price-drop, residential:new-listing-in-project, and
residential:inquiry-reply to the user's /notifications room.
- Wire three CQRS @EventsHandler listeners on ListingPriceChangedEvent
(only when newPrice < oldPrice, match saved searches),
ListingApprovedEvent (match saved searches with filters.projectId
against property.projectDevelopmentId), and InquiryReadEvent
(notify inquiry author).
- Redis pub/sub fan-out already handled by RedisIoAdapter from
TEC-2766, so these broadcasts work across API instances.
- Unit tests for all three listeners and the new gateway helper.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- libs/ai-services: new POST /neighborhood/score router computing weighted
6-axis livability score from per-category POI counts; algorithm versioned
for future iteration (sigmoid curves, percentile thresholds).
- apps/api: HttpNeighborhoodScoreService proxies to Python first, falls back
to PrismaNeighborhoodScoreService when AI service unavailable. Mirrors the
HttpAVMService pattern. Existing GET /analytics/neighborhoods/:district/score
endpoint and CQRS handler now flow through the proxy.
- AnalyticsModule binds Http variant by default, retains Prisma variant as
injectable fallback.
- Tests: 5 pytest cases for Python heuristic, 4 vitest cases for HTTP proxy
fallback behaviour.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add RedisIoAdapter (shared/infra) for multi-instance Socket.IO fan-out
with graceful fallback to the in-memory IoAdapter when Redis is
unreachable.
- Pin Socket.IO heartbeat (pingInterval/pingTimeout/connectTimeout)
via env-tunable gateway options for reconnect stability.
- Expose Prometheus metrics on /notifications: goodgo_ws_connected_clients
(Gauge) and goodgo_ws_messages_total (Counter) with namespace/event/
direction labels. Wired through MetricsService and tracked across
connect/disconnect + emits.
- Unit tests: RedisIoAdapter connect/fallback/close, new MetricsService
WS helpers, and gateway metric increments/decrements on auth paths.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
TEC-2722 — PATCH /api/v1/auth/profile now accepts phoneNumber alongside
fullName, avatarUrl, and email. Phone changes are deferred until the user
confirms the SMS OTP via POST /api/v1/auth/profile/verify-phone, mirroring
the existing email-change OTP flow.
- Add PhoneChangeRequestedEvent + user.phone_change_otp SMS template
- Add VerifyPhoneChangeHandler with Redis-backed 10-minute OTP
- Re-check phone uniqueness at verify time to catch races
- Extend unit tests for UpdateProfileHandler + add VerifyPhoneChangeHandler spec
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add unit tests for FeatureListingHandler (6 tests) and ActivateFeaturedListingHandler (6 tests)
- Add unit tests for NeighborhoodScoreServiceImpl (5 tests) and GetNeighborhoodScoreHandler (2 tests)
- Add PriceHistoryChart component with recharts LineChart for listing detail page
- Wire up price history API client and integrate chart into listing detail view
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wire NestJS controller to Python AI service's industrial AVM. Adds CQRS
query/handler, Swagger-annotated DTOs, AI client method, and 7 unit tests
covering parameter mapping, response camelCase conversion, and error handling.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add minPrice/maxPrice inputs to ProjectFilterBar and introduce a
list view mode alongside the existing grid/map toggle for project
browsing.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add comprehensive test coverage for the three AVM API upgrade endpoints:
- BatchValuationHandler: batch results, partial failures, error handling
- ValuationHistoryHandler: history retrieval, limit, empty state, errors
- ValuationComparisonHandler: multi-property compare, summary, edge cases
- AnalyticsController: route-level tests for all new endpoints
Fix async error handling in handlers by adding await to cache.getOrSet
calls so try/catch blocks properly catch rejections.
Fix pre-existing web test failures: add missing FLOOD_RISK_OPTIONS and
QUALITY_LABELS to valuation-form mock, update valuation-results assertions
to match current component rendering.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wire full DDD stack for IndustrialListing: domain entity, repository interface,
CQRS commands/queries with handlers, Prisma repository, Typesense sync on
create/update/delete, controller with 5 REST endpoints, and validated DTOs.
Register all providers in IndustrialModule.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add POST /transfer/estimate-from-photos endpoint that uses Claude Vision API
to assess furniture/appliance condition from photos, integrating with the
existing rule-based pricing engine. Includes rate limiting (5/min), image hash
caching, graceful fallback, and 17 unit tests covering all paths.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Remove duplicate minio-pdf-storage and puppeteer-pdf services, keeping
the consolidated versions in pdf-generator.service.ts and pdf-storage.service.ts.
Update reports module imports to use the correct classes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Featured listings now sort first in search results via featuredUntil desc ordering.
All listing read DTOs (detail, search, seller) include isFeatured boolean and featuredUntil timestamp.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add three new NestJS modules following DDD/CQRS architecture:
- Industrial: KCN (industrial park) management with PostGIS geo queries, Typesense search, and market statistics
- Transfer: Furniture/premises transfer listings with AI-powered price estimation and depreciation modeling
- Reports: Async AI report generation via BullMQ with Claude narrative service, PDF generation, and macro data integration
Includes Prisma schema models, migrations, seed scripts, and app.module wiring with BullMQ Redis config.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add mediaOrder field to UpdateListingDto, Command, and Handler for
reordering media items
- Add updateMediaOrder method to IPropertyRepository and Prisma impl
- Fix PrismaPropertyRepository.update() to persist amenities, nearbyPOIs,
floors, floor, totalFloors, and metroDistanceM columns
- Add unit tests for media order updates in handler spec
- Add DTO validation tests for mediaOrder with nested validation
- Add e2e integration tests covering content updates, auth, ownership
guard, and forbidden field rejection
Existing guards enforced:
- Only seller or assigned agent can update (403 for others)
- ACTIVE listings transition to PENDING_REVIEW on edit
- propertyType, address, location blocked via DTO whitelist
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Create INeighborhoodScoreService interface and implementation
- Score districts 0-100 across 6 categories: education, healthcare, transport, shopping, greenery, safety
- Calculate scores from POI data with configurable weights and max counts
- Add GetNeighborhoodScoreQuery handler with lazy calculation
- Add GET /analytics/neighborhoods/:district/score endpoint
- Wire service and handler into AnalyticsModule
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Add SocialShare component with copy-link, Facebook, Zalo, and QR code sharing
- Integrate price history chart and social sharing into listing detail page
- Register new price history and feature-listing handlers in ListingsModule
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Auto-fix 862 lint errors: convert value imports used only as types to
`import type`, fix import group ordering in seed.ts and du-an-api.ts,
remove unused imports in auth controller, and clean up stale eslint-disable
comments referencing non-existent rules.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wire up PATCH /listings/:id with UpdateListingCommand/Handler, add QR code
image endpoint, extend IMediaStorageService with generatePresignedUpload and
getPublicUrl, and include UpdateListingDto unit tests.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add batch valuation (POST /analytics/valuation/batch, max 50 properties),
valuation comparison (POST /analytics/valuation/compare, 2-5 properties),
and history endpoint (GET /analytics/valuation/history/:propertyId) with
confidence explanation helper. Frontend: enhanced valuation form with project
autocomplete and deep analysis toggle, results with confidence badges and
price range visualization, comparables table, history chart, market context
card, and PDF export.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The ConfirmBankTransfer command, handler, result type, and DTO were implemented
but not exported from their respective index files, making them inaccessible
to consumers importing from the barrel.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The findByIdWithProperty and searchListings read queries used
`?? { latitude: 0, longitude: 0 }` fallbacks after PostGIS coordinate
extraction. Since the Property.location column is NOT NULL, these
fallbacks silently masked potential data issues. Replaced with non-null
assertions since geo data is guaranteed to exist for valid properties.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Email changes via PATCH /api/v1/auth/profile now require OTP verification
instead of updating immediately. A 6-digit code is sent to the new email
address and must be confirmed via POST /api/v1/auth/profile/verify-email
within 10 minutes. Also fixes pre-existing web valuation test failures
(formatPrice output format, removed comparables section, missing
QueryClientProvider wrapper).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
