- User blocking (with reason) now closes the auth gap immediately — a
blocked user's still-valid access token stops working on the next
request, not just on their next OTP/refresh.
- Admin-created reports (moderation notes) per user, viewable in a history
list independent of block status.
- GET /admin/users: full paginated, searchable user list with report counts.
- GET /admin/matches: all matches across the app ("friends" who mutually
liked each other), for admin visibility.
- GET/DELETE /admin/photos: paginated feed of every uploaded photo with
uploader info, so admins can review and remove content without going
user-by-user.
- Per-user activity: monitoring requests can now be filtered by user_id, so
a user's detail page can show their recent API activity.
- Batched the profile-selections query in fullProfilePayload (was 6 queries
per view, now 1) for consistency with the earlier N+1 fixes.
- Recovery middleware (no more crash-on-panic), request metrics/monitoring
store + admin API, in-memory TTL caching for read-heavy option/question/
category lookups, gzip + rate-limiting middleware, sanitized chat message
encoding, and pg_dump-based database backups with an admin API.
- Fix N+1 queries in the discover feed, candidate detail, and match list
endpoints by batching selection/photo/user/last-message lookups into
single queries instead of one-per-item loops.
- Tune DB connection pooling and add HTTP server timeouts + graceful
shutdown so the API degrades gracefully instead of falling over under load.
- Fix a null (vs empty array) JSON response for candidates/matches without
photos or interests, which crashed the web app's swipe card.
mobiniqow