Skip to content

feat: harden production setup and redesign frontend - #1

Merged
Laurowd merged 20 commits into
mainfrom
feat/production-hardening
Jul 30, 2026
Merged

feat: harden production setup and redesign frontend#1
Laurowd merged 20 commits into
mainfrom
feat/production-hardening

Conversation

@Laurowd

@Laurowd Laurowd commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Resumo

  • reformula a interface Vue e amplia a cobertura Cypress;
  • adiciona Prisma, migrations e proteção para bancos legados;
  • endurece autenticação, autorização, TLS, rate limiting e idempotência;
  • adiciona Swagger/OpenAPI;
  • adiciona testes de integração com PostgreSQL;
  • adiciona ESLint, Prettier e GitHub Actions;
  • atualiza a documentação e o modo demonstrativo.

Validação

  • 98 testes de backend passando;
  • 40 testes Cypress passando;
  • build do backend e frontend passando;
  • ESLint e Prettier passando;
  • migrations e integração PostgreSQL passando;
  • Prisma sem drift;
  • npm audit sem vulnerabilidades.

Laurowd and others added 20 commits July 29, 2026 17:50
@Laurowd
feat(api): harden loan lifecycle and add Prisma migrations
43b87f5
@Laurowd
feat(web): redesign interface and add Cypress coverage
14f72f6
@Laurowd
docs: rewrite setup and frontend documentation
d42258b
@Laurowd
feat(api): add OpenAPI documentation with Swagger UI
8cadf54
@Laurowd
test(api): add PostgreSQL integration coverage
59815be
@Laurowd
ci: add GitHub Actions verification pipeline
7b851a8
@Laurowd
docs: add ISC license
eb03ac4
@Laurowd @claude
chore: adopt prettier and eslint tooling
f0d303b 
Add Prettier and ESLint configuration, pin Node/npm via engines and
.nvmrc, and register format, format:check and lint scripts.

Dependency and script updates for the whole hardening effort land here so
that every later commit resolves against a consistent lockfile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
style: format codebase with prettier
1976a52 
Mechanical reformatting only: quote style, trailing commas and line
wrapping. No behavioural change, isolated in its own commit so the
functional commits that follow contain no formatting noise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(api): harden HTTP, token and role security
18b8e0f 
Add helmet, CORS allow-listing and per-route rate limiting. Reject
placeholder and undersized JWT secrets, sign access tokens with an
explicit issuer, audience and one-hour expiry, and verify those claims on
every request.

Enforce the bcrypt 72-byte password limit and separate client-only routes
from admin routes with a dedicated middleware.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(db): make migration deployment idempotent and legacy-aware
ecf4869 
Replace the direct prisma migrate deploy call with a deploy script that
fingerprints a legacy schema, adopts it into the migration history when
needed, and verifies published migration checksums before applying.

Add migrations that reconcile the legacy hardening, enforce loan safety
constraints and normalise user identifiers. Require explicit TLS
verification settings and drop the unused database-postgres re-export.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(api): make loan creation idempotent with business-timezone due d…
52d9deb 
…ates

Require an Idempotency-Key header on loan creation and return the existing
loan when a key is replayed, so a retried request cannot open a second
contract. Reject a key reused with different terms.

Derive instalment due dates from a civil date in the business timezone and
clamp to the last valid day of the month, so contracts opened on the 29th
to 31st no longer skip a month.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(api): paginate the admin loan queue
6801d4e 
Accept cursor and limit on the admin listing and return a nextCursor, so
the review queue no longer loads every proposal in a single response.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(api): guard destructive seeding and cover migration upgrades
22abbc7 
Require an explicit opt-in for demo seeding and refuse it against
non-local databases or example passwords. Restrict the integration reset
to local databases whose name ends in _test.

Run the seed inside a transaction and add an integration test that
upgrades a legacy schema through the full migration history.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
docs(api): correct OpenAPI date formats and token lifetime
6a1d491 
Describe date-only fields with format date and document the one-hour
token lifetime that replaced the previous seven-day claim.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
feat(web): revalidate sessions and mirror API validation
2631fa9 
Validate the stored session against the API on startup and clear it on a
401, so an expired token no longer keeps the router authenticated.

Send an idempotency key with each loan request and remember the attempt
locally, so a retry after a network failure reuses the same key. Apply the
API's own amount, term and justification limits in the forms, and page
through the admin queue with a load-more control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
fix(web): keep monospace figures off non-numeric fallbacks
c51b459 
The figure utility forces a monospace face with tabular numerals, so it
rendered the prose fallbacks "Sem parcelas pendentes" and "Dados
insuficientes" in the wrong typeface. Apply it only when the slot holds a
number.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
test(e2e): cover idempotent requests, pagination and session expiry
972207d 
Extend the Cypress suite for the idempotency header, the paginated admin
queue and the session revalidation that clears an expired token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd @claude
docs: document security settings, migrations and CI checks
2f54bb8 
Describe the new environment variables, the non-destructive migration
commands, the explicit opt-ins for seeding and resets, and the requirement
to generate a real JWT secret. Extend the CI pipeline with format, lint
and migration checks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@Laurowd
chore: merge main into production hardening
cc8652a
@Laurowd
Laurowd marked this pull request as ready for review July 30, 2026 04:40
@Laurowd Laurowd changed the title Feat/harden production setup and redesign frontend feat: harden production setup and redesign frontend Jul 30, 2026
@Laurowd
Laurowd merged commit f8262d8 into main Jul 30, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Laurowd