2 Commits

Include renames

Author	SHA1	Message	Date
Nick Szaunig	f1298eff08	fix: harden auth against brute force, add auth audit logging, fix cookie/TLS gaps ... Security review findings (HIGH-1/2/3, MEDIUM): - Rate limiting via @nestjs/throttler: global 100 req/min default, stricter 10 req/min on login and refresh. Also closes the MEDIUM finding (public batch-lookup enumeration) since it now sits behind the global limit too. Trust the K8s ingress's single proxy hop so throttling keys off the real client IP, not the ingress pod's IP. - Auth events (login success/failure, logout, token refresh) are now audit-logged via new AuditAction values, closing the gap where the project's own audit-log principle never actually covered the Auth module. - Refresh-token cookie now defaults to Secure=true (opt out only via COOKIE_SECURE=false for local HTTP dev), instead of keying off NODE_ENV which was never set in the K8s deploy templates. Added a TLS block + cert-manager annotation to both the backend and frontend ingress templates, which previously had no HTTPS termination configured at all.	2026-08-25 10:49:25 +02:00
Nick Szaunig	eae3fea957	feat: Grundgeruest fertigstellen (Backend/Frontend/K8s) ... Backend: Prisma-Client auf prisma-client-js + Driver-Adapter (@prisma/adapter-pg) umgestellt (Prisma 7 verlangt Adapter, ESM-Client brach an Jest), erste Migration erzeugt und angewendet, /api/v1 Versioning, Swagger unter /api/v1/docs, Helmet, globale ValidationPipe, PrismaModule, HealthModule (/health, /health/ready mit DB-Check), tsconfig.build.json Root-Dir-Fix (dist/main.js statt dist/src/main.js). Frontend: Tailwind v4 + shadcn/ui initialisiert, TanStack Query Provider, PWA Manifest (app/manifest.ts), Vitest + Testing Library Setup, next.config output standalone. deploy/k8s: Dockerfiles (Backend/Frontend, Multi-Stage) + Deployment/Service/ Ingress/ConfigMap/Secret-Vorlagen fuer beide Projekte. Lokale Dev-/Test-Postgres-Instanz unter ApiCore-Backend/.devdb angelegt (eigene Rolle, kein bestehendes Passwort noetig), .env/.env.test lokal befuellt. Lint, Typecheck, Tests und Build sind fuer Backend und Frontend gruen; Server wurde lokal gestartet und /health, /health/ready, /api/v1/docs manuell verifiziert.	2026-08-21 05:17:26 +02:00