saravanakumardb1
aaf7ec5b59
fix(licenses): add deviceName and platform to ActivateLicenseSchema
...
Desktop and mobile clients send deviceName and platform in the activate
payload. Without these fields in the schema, they were silently stripped
by Zod. Now accepted as optional fields for contract alignment.
2026-02-15 15:41:52 -08:00
saravanakumardb1
daccbaea6c
fix(stripe): remove dead syncUserPlan call to deleted backend /api/users/:userId/plan route
...
The Python backend users.py route was deleted in the backend cleanup.
Plan updates are already handled by authRepo.updatePlan() inline in
each webhook handler — the syncUserPlan fetch was redundant dead code.
2026-02-15 15:40:42 -08:00
saravanakumardb1
d829c41fd4
docs: update migration checklist — Phases 1-4 complete
2026-02-15 15:38:11 -08:00
saravanakumardb1
c6937b74a6
docs(migration): mark Phase 2 Commit 17 complete
...
- Updated Phase 2 checklist with Android migration commit hash 63aa2ae
2026-02-15 15:19:12 -08:00
saravanakumardb1
855ebffcf6
docs(migration): mark Phase 2 Commit 16 complete
...
- Added Phase 2 progress checklist
- Marked Commit 16 complete with learning_voice_ai_agent hash 26d2a8b
2026-02-15 15:15:08 -08:00
saravanakumardb1
e7c8023aa8
docs(migration): mark Commit 15 complete with test commit hash
2026-02-15 15:09:54 -08:00
saravanakumardb1
8a7a0495b0
test(platform-service): add route-level tests for Phase 1 migration behaviors
...
- Added auth register route tests for default provisioning and best-effort fallback
- Added license activate route tests for token issuance, product device limits, and lockout
- Added Stripe webhook route tests for any-product fallback and plan normalization
- Verified: tsc --noEmit clean, 23 test files / 189 tests passing
2026-02-15 15:09:23 -08:00
saravanakumardb1
d236f19d42
docs(migration): track Phase 1 commit progress and review fixes
...
- Added checklist with commit hashes for commits 9-14
- Marked commit 15 pending
- Documented post-implementation bugfix commits from systematic review
2026-02-15 15:01:54 -08:00
saravanakumardb1
b987dec92c
fix(platform-service): make Stripe webhook product routing resilient
...
- Added cross-product fallback lookup by stripeCustomerId when metadata lacks productId
- Ensure invoice payments are stored under the resolved subscription productId
- Normalize checkout metadata plan value before persistence/sync
- Keep auth plan sync aligned with resolved product context
- Verified: tsc --noEmit clean, 20 test files / 183 tests passing
2026-02-15 15:01:02 -08:00
saravanakumardb1
a699dd9073
fix(platform-service): harden register/stripe flows for multi-product correctness
...
- Make auth register provisioning truly best-effort (warn on failure, do not fail signup)
- Process Stripe webhook events for all products (remove non-default skip)
- Derive updated subscription plan from Stripe price IDs on subscription.updated
- Sync derived plan to auth users and backend plan sync endpoint
- Verified: tsc --noEmit clean, 20 test files / 183 tests passing
2026-02-15 14:59:27 -08:00
saravanakumardb1
0c3c109bf1
feat(platform-service): add settings module with device overrides
...
- Added settings module (types, repository, routes)
- Endpoints: GET/PUT /settings, GET/PUT/DELETE /settings/device/:deviceId
- Enforced userId from JWT and productId request scoping
- Added settings Cosmos container registration and route registration in server
- Added module tests for settings schemas and route export
- Verified: tsc --noEmit clean, 20 test files / 183 tests passing
2026-02-15 14:57:20 -08:00
saravanakumardb1
84681cbf75
feat(platform-service): add user plan update to auth module for Stripe webhooks
...
- Added auth repository updatePlan(userId, productId, plan) helper
- Stripe webhook handlers now sync plan changes into auth users container
- Handles checkout completion and cancellation downgrade paths
- Keeps existing backend sync behavior intact
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:47:26 -08:00
saravanakumardb1
a264538c5e
feat(platform-service): register hook provisions subscription + license from product config
...
- /auth/register now validates product from products cache
- Automatically provisions initial subscription using product defaultPlan + trialDays
- Automatically provisions initial license using product licensePrefix + deviceLimits
- Keeps auth user creation as primary flow while adding provisioning side-effects
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:44:31 -08:00
saravanakumardb1
5e38342930
feat(platform-service): licenses/activate issues JWT tokens + IP lockout
...
- /licenses/activate now enforces in-memory IP lockout window for failed attempts
- Device limit enforcement now reads from product config by plan (deviceLimits)
- Successful activation returns { license, accessToken, refreshToken }
- Re-activation on existing device also returns tokens
- Keeps existing license validity checks (status, expiry)
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:42:58 -08:00
saravanakumardb1
17772ed42a
feat(platform-service): auth/refresh returns both accessToken + refreshToken
...
- Refresh endpoint now rotates refresh token and returns both tokens
- Keeps existing refresh token validation semantics
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:40:34 -08:00
saravanakumardb1
a9ac953ed1
feat(platform-service): add plan field to auth UserDoc + auth responses
...
- Added plan to auth UserDoc model and token payload typing
- Register flow initializes user.plan from product default plan
- Login/Register/Me responses now include user.plan
- Access tokens now include optional plan claim
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:39:42 -08:00
saravanakumardb1
0fee7e9ee7
test(platform-service): add products module tests and fix product schema defaults
...
- Added products.test.ts covering CreateProductSchema and UpdateProductSchema
- Added route export smoke test for productRoutes
- Fixed CreateProductSchema packageName default validation (allow empty default)
- Verified: tsc --noEmit clean, 19 test files / 178 tests passing
2026-02-15 14:36:33 -08:00
saravanakumardb1
c0830e3dec
refactor(platform-service): remove BILLING_INTERNAL_KEY guard from server.ts
...
- Billing routes (subscriptions, usage, plans, licenses) now registered directly
- No more X-Internal-Key header check — JWT-based productId auth is sufficient
- BILLING_INTERNAL_KEY removed from config schema and AKV secret resolution
- 166 tests pass, tsc clean
2026-02-15 14:30:30 -08:00
saravanakumardb1
60617ab050
refactor(platform-service): replace PRODUCT_ID with getRequestProductId(req) in all modules
...
- 26 files updated: all repositories accept productId parameter instead of env var
- All route handlers extract productId via getRequestProductId(req) (JWT → header → env fallback)
- Repositories: auth, flags, audit, notifications, licenses, plans, referrals, usage, subscriptions, invitations
- Routes: all above + promos, items, memory, public, ratelimit, stripe
- lib/webhooks.ts: dispatchWebhook accepts optional productId parameter
- Stripe webhook handler uses metadata-based productId (no client JWT available)
- Ratelimit default config uses DEFAULT_PRODUCT_ID at startup
- 166 tests pass, tsc --noEmit clean
2026-02-15 14:29:11 -08:00
saravanakumardb1
8e5c6dc2d6
refactor(platform-service): auth routes + types — add productId to login/register schemas
...
- LoginSchema and RegisterSchema now require productId field
- Login/Register routes use productId from request body (not env var)
- PRODUCT_ID import removed from auth/routes.ts
- Test fixtures updated with productId: 'lysnrai'
2026-02-15 14:18:59 -08:00
saravanakumardb1
8cc70db676
refactor(platform-service): auth/jwt.ts — productId from caller, issuer → 'bytelyst-platform'
...
- createAccessToken() and createRefreshToken() now require productId parameter
- Issuer changed from PRODUCT_ID env var to generic 'bytelyst-platform'
- verifyToken() validates against 'bytelyst-platform' issuer
- auth/routes.ts callers updated to pass productId (still from PRODUCT_ID env var for now)
- Refresh endpoint reads productId from user doc
2026-02-15 14:16:49 -08:00
saravanakumardb1
465d429e09
feat(platform-service): add Fastify onRequest hook to parse JWT → req.jwtPayload
...
- Best-effort JWT parsing on every request (non-blocking for unauthenticated routes)
- Attaches parsed payload to req.jwtPayload for downstream use by getRequestProductId()
- Invalid/expired tokens silently ignored — auth-required routes handle their own validation
2026-02-15 14:15:17 -08:00
saravanakumardb1
365061566a
feat(platform-service): add getRequestProductId() + getRequestProductConfig() helpers
...
- New lib/request-context.ts with product validation against cache
- Priority: JWT payload > X-Product-Id header > env var fallback
- Rejects unknown or disabled products with 400 Bad Request
- Augments FastifyRequest with jwtPayload type declaration
- getRequestProductConfig() for modules needing product-specific values
2026-02-15 14:14:17 -08:00
saravanakumardb1
755c16dbfb
feat(platform-service): add products module (types, repository, cache, routes)
...
- New products container in Cosmos DB (partition key: /id)
- ProductDoc: displayName, licensePrefix, deviceLimits, trialDays, status
- In-memory cache loaded on startup via loadProductCache()
- CRUD routes: GET/POST /products, GET/PUT /products/:id
- Cache refreshed after admin writes (create/update)
- Registered before all other modules in server.ts
2026-02-15 14:13:03 -08:00
588d164ea0
docs(workstreams): align checklist with service consolidation
2026-02-15 08:58:58 -08:00
6acb3c05cd
docs(workstreams): link MindLyst Android mic + blob upload commits
2026-02-15 04:04:46 -08:00
4d062ea6ca
docs(workstreams): link MindLyst iOS voice blob upload
2026-02-15 03:57:40 -08:00
5eba8f5b60
docs(workstreams): link triageResult + blob media ref work
2026-02-15 03:52:19 -08:00
e64bba258f
feat(platform-service): allow memory-items to store blob media refs
2026-02-15 03:50:51 -08:00
759fd78f3e
docs(workstreams): link MindLyst iOS/Android memory-items wiring commits
2026-02-15 03:45:54 -08:00
224c78f90f
docs(workstreams): note MindLyst iOS posting memory-items
2026-02-15 03:37:49 -08:00
1011fd85f8
feat(platform-service): restrict blob SAS/list/info to user scope
2026-02-15 03:31:27 -08:00
saravanakumardb1
63ab1631e1
docs(workstreams): update progress — TestFlight builds, delete history, sessions design, devops docs, production readiness
2026-02-15 03:25:05 -08:00
17c41e8441
feat(platform-service): add memory-items API backed by Cosmos
2026-02-15 03:20:09 -08:00
saravanakumardb1
cb728d3dfe
docs: update agent docs — add missing packages, fix stale service refs, update test counts
2026-02-15 01:09:29 -08:00
saravanakumardb1
4d78c45e85
docs: mark all 13 lysnr-* secrets as seeded, remove kv.txt + kv_azure.txt, update audit + rotation docs
2026-02-15 00:53:04 -08:00
7b529b420c
docs: kv values
2026-02-15 00:51:19 -08:00
469efc6b8a
chore: add kv export audit
2026-02-15 00:43:29 -08:00
7c72ed702a
ci: add lysnr kv seeder
2026-02-15 00:31:31 -08:00
saravanakumardb1
a7dd0a3daf
chore: add kv.txt seed script for 13 lysnr-* secrets + update audit doc recovery status
2026-02-14 23:52:16 -08:00
saravanakumardb1
3bfdb7a084
docs: add git history recovery summary to KV audit, gitignore kv.txt seed file
2026-02-14 23:43:27 -08:00
saravanakumardb1
e5a481fb05
docs: holistic devops docs review — fix stale refs, rewrite KV rotation doc, delete scratchpad + outdated files
2026-02-14 23:24:41 -08:00
e4a9998e4b
devops: kv action
2026-02-14 23:11:48 -08:00
ea44a73b62
docs(devops): add environment variables and Key Vault audit
...
Comprehensive audit of environment variables and Azure Key Vault secrets:
- Scanned all 35+ environment variables used across services
- Audited all 17 secrets in Azure Key Vault
- Identified critical gap: ZERO LysnrAI secrets in Key Vault
- MindLyst: 12 secrets (fully populated)
- MyWisprAI: 7 secrets (partially populated)
- LysnrAI: 0 secrets (100% missing)
- Listed 13 missing critical/high priority secrets
- Provided remediation plan with seed script instructions
- Added secret rotation strategy
- Included quick fix commands for Azure CLI
Critical findings:
- Missing Cosmos DB, JWT, Stripe, Gemini API keys for LysnrAI
- Code expects lysnr-* prefixed secrets but none exist
- Immediate action required to seed Key Vault
Co-Authored-By: Warp <agent@warp.dev>
2026-02-14 23:05:56 -08:00
598a84513a
docs(devops): add comprehensive Azure resource inventory
...
Added AZURE_RESOURCE_INVENTORY.md with complete Azure infrastructure documentation:
- Subscription details and resource groups
- Full resource tree with all 13 Azure resources
- Cosmos DB databases (mindlyst, lysnrai, mywisprai) with all containers
- Storage, Key Vault, OpenAI, Speech Services, Notification Hubs
- Environment variables and resource IDs
- Geographic distribution and cost optimization notes
- Azure CLI quick commands
Co-Authored-By: Warp <agent@warp.dev>
2026-02-14 22:59:46 -08:00
saravanakumardb1
dcf6914419
docs: move Azure KV and portal setup docs into docs/devops/
2026-02-14 22:52:06 -08:00
saravanakumardb1
25594381ab
feat: add AKV seed script and AZURE_KEYVAULT_URL to .env.example
2026-02-14 22:25:04 -08:00
saravanakumardb1
81999dcbb3
feat(services): wire AKV secret resolution in platform-service and extraction-service startup
2026-02-14 22:18:01 -08:00
saravanakumardb1
2e5b4de0c4
feat(config): add Azure Key Vault secret resolution with env fallback
2026-02-14 22:15:02 -08:00
saravanakumardb1
fb3bc750eb
fix: update .env.example comments, Grafana dashboard, and debug-service.md for consolidated services
2026-02-14 22:01:55 -08:00
