[souravC01]

Summary

This pull request delivers the full suite of public launch remediation fixes, security hardening, data safety protections, and operational runbooks for JobHelperGuru. It addresses all findings from the production audit (L01 through L12) and establishes production-ready safeguards for multi-tenant deployment on Render, Neon PostgreSQL, and Cloudflare R2.

---

Key Changes

1. Security Hardening & Rate Limiting (L04, L05, L07)

• SSRF & DNS Rebinding Protection: Implemented pinned IP transport (backend/services/outbound_http.py) enforcing private IP blacklists on all outbound HTTP requests (AI providers and scraper targets).
• Atomic Rate Limiting & Concurrency: Implemented sliding-window rate limiters and concurrency leases (backend/services/rate_limiter.py, backend/services/resource_leases.py) for AI generation, auth, and scraper endpoints.
• Trusted Proxy Handling: Correctly derived client IPs from proxy headers (X-Forwarded-For) only when TRUST_PROXY_HEADERS is active.
• Vulnerability Remediation: Upgraded vitest to 4.1.11 to resolve GHSA-82fw-gwwq-j7x9.

2. Authentication & Identity Linking (L01, L06)

• Email Delivery (Brevo): Added production Brevo API transport for password reset, email verification, and recovery links (backend/services/email_service.py).
• Account Recovery Flow: Added dedicated frontend landing page (/auth/link) and backend token endpoints for account recovery and identity linking.
• Secure Google OAuth: Enforced explicit email verification requirements and protected against account linking hijacking.
• SPA Fallback Handling: Configured client-side routing fallback so password reset and deep links route cleanly without 404s.

3. Object Storage & Resume Vault (L08, L09, L10)

• Atomic Quotas: Enforced atomic per-user quotas (10 resumes max, 50MB aggregate storage) in backend/services/resume_files.py.
• Cloudflare R2 Integration: Streamlined direct storage integration with explicit failure reporting (no silent fallback to ephemeral disk).
• Local Fallback Support: Added explicit STORAGE_BACKEND=local configuration for development.
• Environment Priority: Added load_dotenv(override=True) to ensure project .env takes precedence over stale shell variables.
• Safe Downloads: Added RFC 5987 / RFC 6266 Unicode Content-Disposition header formatting and path traversal validation.

4. Data Safety & Migration (L02, L03, L11)

• Application Validation: Enforced non-empty company and role constraints across API and database layers.
• Data Repair Script: Built backend.repair_data audit and repair tool to sanitize legacy orphaned attachments and invalid records.
• PostgreSQL Migration Tool: Enhanced backend.migrate with dry-run mode, table-by-table verification, transaction safety, and migration ledger tracking.
• Rotated Key Detection: Added graceful detection for Fernet encryption key rotations with clear user guidance in settings.

5. Frontend & UX Enhancements (L12)

• Duplicate Job Detection: Added inline detection and notification for duplicate job URLs during application entry.
• Responsive Kanban: Optimized application tracker columns with touch-friendly scrolling and responsive card heights.
• Cover Letter Plain-Text Export: Formatted printed cover letters as plain text to prevent formula injection.

6. Operations & Documentation

• Added docs/STEP_BY_STEP_LAUNCH_GUIDE.md for guided pre-launch staging, migration, and verification.
• Added docs/PUBLIC_LAUNCH_RUNBOOK.md detailing operational rollout, health monitoring, and rollback procedures.

---

Verification & Testing

Automated Test Suites

• Backend: 205 passed in 31.29s (python -m pytest)
• Frontend: 31 passed across 12 test files (npm test -- --run)

Manual Verification

• Brevo Delivery: Successfully sent and received password reset email in staging environment.
• R2 Upload: Successfully uploaded and downloaded resume PDF directly against Cloudflare R2 bucket.
• Data Repair: Executed python -m backend.repair_data --apply cleanly against local database.
• Environment Isolation: Verified .env override priority over system environment variables.