Messages between matched users are now encrypted client-side with each
user's own key pair before they ever reach the server; the backend only
ever stores/relays opaque ciphertext + nonce and cannot read message
content, including for the last-message preview on the matches list.
- User gains a PublicKey field, registered/rotated via PUT /profile/public-key
- Message gains CipherText/Nonce; legacy plaintext Text is kept as-is for
messages sent before this change
- MatchView exposes the partner's public key and the last message's
ciphertext/nonce so the client can decrypt previews itself
- Removed the now-dead plaintext SanitizeMessageText utility — the server
can no longer sanitize message content since it's opaque ciphertext
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Recovery middleware (no more crash-on-panic), request metrics/monitoring
store + admin API, in-memory TTL caching for read-heavy option/question/
category lookups, gzip + rate-limiting middleware, sanitized chat message
encoding, and pg_dump-based database backups with an admin API.
- Fix N+1 queries in the discover feed, candidate detail, and match list
endpoints by batching selection/photo/user/last-message lookups into
single queries instead of one-per-item loops.
- Tune DB connection pooling and add HTTP server timeouts + graceful
shutdown so the API degrades gracefully instead of falling over under load.
- Fix a null (vs empty array) JSON response for candidates/matches without
photos or interests, which crashed the web app's swipe card.
Phone+OTP auth, staged onboarding, admin approval workflow, and a
full discovery/swipe/match/chat system with photo upload and
approximate distance (haversine) based on user location.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mobiniqow