[parth2711]

Summary

This PR addresses critical reliability, security, architecture, and UI findings identified in the Phase 1 audit. It introduces production-ready scheduled background sync, hardens JWT authentication and session handling, eliminates duplicated server initialization, adds automated test suites with GitHub Actions CI, and polishes user-facing UI copy.

---

Key Changes

1. 🔄 Scheduled Background Sync in Production

• Dedicated Endpoint: Created /api/cron/sync (api/cron/sync.js) secured via Authorization: Bearer <CRON_SECRET>.
• Bounded Sync Execution: Extracted syncAllUsers() in server/services/sync.service.js with deduplication (skips users synced within the last 2h) and throttled batch processing to prevent serverless execution timeouts.
• API Call Timeouts: Added withTimeout helper (12s ceiling per platform) so hanging external APIs (GitHub, LeetCode, Codeforces, WakaTime, Stack Overflow, npm/PyPI) do not stall the process.
• GitHub Actions Scheduler: Added .github/workflows/sync-cron.yml running every 3 hours (0 */3 * * *) with manual trigger (workflow_dispatch) and concurrency protection.

2. 🔐 Authentication & Session Hardening

• Algorithm Enforcement: Explicitly restricted JWT generation and verification to algorithm: 'HS256' in auth.controller.js, auth.middleware.js, and auth.routes.js.
• Credential Leak Prevention: Removed console.log logging raw password reset tokens in forgotPassword.
• Eliminated Hardcoded Session Fallback: Removed 'devact_session_secret' fallback; SESSION_SECRET is now required and validated.

3. 🏗️ Consolidate Backend Entry Points

• Shared App Factory: Extracted Express setup into server/app.js with shared middleware (Helmet, CORS, sessions, Passport, rate limiting, error handlers) and fail-fast environment validation.
• Serverless DB Initialization Order: Fixed api/index.js so per-request connectDB() middleware executes before route handlers.
• Mongoose Connection Pooling: Set maxPoolSize: 10 in server/config/db.js and ensured dynamic global.mongoose caching across warm serverless invocations.

4. 🧪 Automated Testing & CI Pipeline

• Added vitest and supertest to root package.json with npm test.
• Created 17 unit and integration tests across 3 suites:
  • tests/auth.test.js: HS256 enforcement, expired/invalid token handling, protected route authorization.
  • tests/cron-sync.test.js: Secret validation, 401/405/500 guards, bounded sync dispatching.
  • tests/db.test.js: Serverless connection caching, pooling parameters, connection failure recovery.
• Added .github/workflows/ci.yml to run tests and verify the frontend build on pushes and PRs.
• Protected Mongoose models (User, SyncData) against OverwriteModelError.

5. 🎨 UI & Copy Polish

• Replaced informal em-dashes (—) in user-facing copy across Dashboard.jsx, CPTracker.jsx, PracticeReview.jsx, ManageAccount.jsx, Profile.jsx, Journal.jsx, Contests.jsx, and Home.jsx.
• Standardized navbar buttons from "Login" $\rightarrow$ "Sign in" and "Logout" $\rightarrow$ "Sign out".

---

Verification

• npm test passes 17 / 17 tests locally.
• npm --prefix client run build succeeds cleanly.
• Working tree clean and existing stashes preserved.

Required Environment Variables / Secrets

• Vercel: CRON_SECRET, SESSION_SECRET
• GitHub Actions Secrets: CRON_SECRET, CRON_SYNC_URL

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
devact	Ready	Preview	Oct 31, 2026 6:37pm UTC