Each device generates its own X25519 key pair on login (tweetnacl); the
private key never leaves localStorage or reaches our server. Messages are
encrypted client-side with the recipient's public key before being sent,
so the backend and anyone intercepting traffic only ever see ciphertext.
- src/lib/e2ee.ts: key generation/registration + encrypt/decrypt (NaCl box)
- Chat thread + matches list: encrypt on send, decrypt on receive/preview,
with a graceful fallback when a message can't be decrypted on this device
(e.g. after switching browsers) and full backward compat for legacy
plaintext messages sent before this change
- Privacy settings page explains the guarantee and its one deliberate
trade-off: there is no key backup/escrow, so clearing browser data or
switching devices makes old messages permanently unreadable
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Messages between matched users are now encrypted client-side with each
user's own key pair before they ever reach the server; the backend only
ever stores/relays opaque ciphertext + nonce and cannot read message
content, including for the last-message preview on the matches list.
- User gains a PublicKey field, registered/rotated via PUT /profile/public-key
- Message gains CipherText/Nonce; legacy plaintext Text is kept as-is for
messages sent before this change
- MatchView exposes the partner's public key and the last message's
ciphertext/nonce so the client can decrypt previews itself
- Removed the now-dead plaintext SanitizeMessageText utility — the server
can no longer sanitize message content since it's opaque ciphertext
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add the missing `photos` field to FullProfile so the user-detail page
can render a photo gallery (the backend already returned this data,
the type just never declared it)
- Show applicants' first photo (or a "no photo" badge) in the pending-
users list instead of a generic avatar
- Add a report action alongside delete on the photo moderation page, so
a photo can be flagged without being removed
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Fix reset-filters button being a no-op (referential-equality bug with
the DEFAULT_FILTERS constant) and add an unlimited-distance toggle to
discovery filters
- Replace the "coming soon" settings stubs with working Notifications,
Privacy & Security, and Help & Support pages
- Rework the onboarding profile-questions step to walk users through
one question at a time instead of picking 3 then filling them all at once
- Enforce a 10MB client-side cap on photo uploads (onboarding + profile)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Addresses user bug reports: settings pages needed real notification
preferences and account deletion, admin needed a way to flag a specific
photo independent of deleting it, and the pending-approval users list
needed to surface applicant photos for review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Applies a few Hook Model (trigger/action/reward/investment) patterns on top
of the existing swipe/match loop:
- Daily streak: a flame badge in the home header, backed by the new
checkin endpoint — an external trigger to return daily.
- Profile completeness meter + badge collection on the profile page
(client-computed from existing data) — the investment loop nudging
users to fill out bio/photos/answers.
- Bio editor on the profile page, shown on swipe cards and candidate
detail so profiles read richer.
- Catch the Hearts: a small tap mini-game (falling hearts, bonus items,
20s timer, persisted high score) shown instead of a dead end when the
discover feed runs out, so there's still a reason to stay in the app.
- Micro-animations: heart-burst on like, confetti on match, tap feedback
on all buttons (active:scale-95).
Fixed a React "purity" lint violation along the way (Math.random() can't
be called inside useMemo under this project's rules — moved to useState
lazy initializers, which run once on mount as intended).
- User.Bio: a short (300 char) freeform profile bio, editable via
PATCH /profile/bio, shown on discover cards and candidate detail (richer
profiles beyond the fixed onboarding fields).
- User.StreakCount/LastActiveDate: POST /profile/checkin increments the
streak on consecutive days, resets after a gap, no-ops if already
checked in today. Backs a daily-return hook on the frontend.
- New "همه کاربران" page: searchable/paginated full user list with
block/unblock/report actions and report-count badges.
- User detail page gained block/unblock/report buttons, a report history
section, and a recent-activity panel (via the backend's per-user
monitoring filter).
- New "رفقا" page listing every match across the app.
- New "نظارت بر عکسها" page: grid of every uploaded photo with uploader
info and a delete action, for content review without going profile-by-profile.
- User blocking (with reason) now closes the auth gap immediately — a
blocked user's still-valid access token stops working on the next
request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
uploader info, so admins can review and remove content without going
user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
per view, now 1) for consistency with the earlier N+1 fixes.
New sidebar sections wired to the backend's new admin APIs:
- Monitoring: live request/error-rate/latency stats plus a recent-requests
table, polling every 8s.
- Backups: create/list/download database backups (auth'd blob download
since the endpoint requires a Bearer token, not a plain link).
- OnboardingScreen used min-h-dvh instead of h-dvh, so the scrollable content
area never actually clipped/scrolled internally; the page just grew and the
primary CTA button scrolled away with it instead of staying visible. Switch
to h-dvh and give each step's button a sticky footer (StepFooterButton).
- SwipeCard crashed with "Cannot read properties of null" when a candidate
had no photos, because the backend could return null instead of an empty
array; guard with optional chaining.
- Recovery middleware (no more crash-on-panic), request metrics/monitoring
store + admin API, in-memory TTL caching for read-heavy option/question/
category lookups, gzip + rate-limiting middleware, sanitized chat message
encoding, and pg_dump-based database backups with an admin API.
- Fix N+1 queries in the discover feed, candidate detail, and match list
endpoints by batching selection/photo/user/last-message lookups into
single queries instead of one-per-item loops.
- Tune DB connection pooling and add HTTP server timeouts + graceful
shutdown so the API degrades gracefully instead of falling over under load.
- Fix a null (vs empty array) JSON response for candidates/matches without
photos or interests, which crashed the web app's swipe card.
The reject modal now offers 5 common rejection reasons as tickable
options (no photo, incomplete info, looks fake/bot, inappropriate
photos, contact info in profile), combined with an optional free-text
note. The combined string is sent as the existing reason field — no
backend change needed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- New /onboarding/photos step (upload/delete grid, needs >=1 photo to
continue), inserted as step 2 right after basic info.
- Pending screen gets an "edit your info" entry point into the wizard;
Rejected screen's edit button now goes there too instead of just
the read-only profile page.
- Step 1's back button now returns to /home instead of /login when
the user is already onboarded (was previously always /login).
- Progress bar segments become clickable to jump directly to any step
once the user is already onboarded.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Photos are now step 2 of onboarding (right after basic info) instead
of only being manageable from the profile page later. Uploading still
goes through the existing /profile/photos endpoint; the new
POST /onboarding/photos just confirms at least one photo exists and
advances the step counter. Renumbered the OnboardingStep enum
accordingly (9 steps total now).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Multi-stage Dockerfile producing a minimal runtime image via
next.config.ts's output:"standalone". NEXT_PUBLIC_API_URL is taken as
a build arg since it gets baked into the client bundle at build time.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Multi-stage Dockerfile producing a minimal runtime image via
next.config.ts's output:"standalone". NEXT_PUBLIC_API_URL is taken as
a build arg since it gets baked into the client bundle at build time.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Multi-stage Dockerfile for the Go API, plus a docker-compose.yml that
runs postgres + backend + both frontends together for local
full-stack dev (frontends built from the sibling repo directories).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Admin login, category/option and profile-question management, and
the pending-user review workflow (list, full profile detail,
approve/reject with a reason shown back to the user).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Phone+OTP auth, staged onboarding, admin-approval-gated home screen,
and the full discovery/match/chat UI (swipe deck with drag gestures,
match modal, profile detail, filters, messages/chat) wired to the
real backend, styled after a Figma dating-app UI kit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Phone+OTP auth, staged onboarding, admin approval workflow, and a
full discovery/swipe/match/chat system with photo upload and
approximate distance (haversine) based on user location.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mobiniqow