Merge branch 'develop'

Author: Ahtisham992

apps/backend/.env.example

@@ -8,6 +8,7 @@ JWT_REFRESH_SECRET=
 JWT_REFRESH_EXPIRES_IN=7d
 
 # Redis
+REDIS_URL=
 REDIS_HOST=
 REDIS_PORT=6379
 

apps/backend/package-lock.json

@@ -29,6 +29,7 @@
     "@nestjs/passport": "^11.0.5",
     "@nestjs/platform-express": "^11.0.1",
     "@nestjs/platform-socket.io": "^11.1.26",
+    "@nestjs/throttler": "^6.5.0",
     "@nestjs/websockets": "^11.1.26",
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
@@ -38,6 +39,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
     "dotenv": "^17.4.2",
+    "helmet": "^8.2.0",
     "ioredis": "^5.11.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",

apps/backend/package.json

@@ -30,6 +30,8 @@ model Workspace {
   userId      String
   user        User      @relation(fields: [userId], references: [id], onDelete: Cascade)
   projects    Project[]
+
+  @@index([userId])
 }
 
 model Project {
@@ -46,6 +48,8 @@ model Project {
   notes       Note[]
   repoEmbeddings RepoEmbedding[]
   conversations Conversation[]
+
+  @@index([workspaceId])
 }
 
 model Note {
@@ -64,6 +68,8 @@ model Note {
   embeddings   NoteEmbedding[]
 
   @@index([searchVector], type: Gin)
+  @@index([userId])
+  @@index([projectId])
 }
 
 model NoteEmbedding {
@@ -94,6 +100,9 @@ model Conversation {
   projectId String?
   project   Project?  @relation(fields: [projectId], references: [id], onDelete: SetNull)
   messages  Message[]
+
+  @@index([userId])
+  @@index([projectId])
 }
 
 model Message {
@@ -103,6 +112,8 @@ model Message {
   createdAt      DateTime     @default(now())
   conversationId String
   conversation   Conversation @relation(fields: [conversationId], references: [id], onDelete: Cascade)
+
+  @@index([conversationId])
 }
 
 model RepoEmbedding {
@@ -112,6 +123,8 @@ model RepoEmbedding {
   embedding Unsupported("vector(768)")?
   projectId String
   project   Project                @relation(fields: [projectId], references: [id], onDelete: Cascade)
+
+  @@index([projectId])
 }
 
 model Notification {
@@ -123,4 +136,6 @@ model Notification {
   createdAt DateTime @default(now())
   userId    String
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
 }

apps/backend/prisma/schema.prisma

@@ -1,6 +1,9 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { BullModule } from '@nestjs/bullmq';
+import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
+import { APP_GUARD } from '@nestjs/core';
+import Redis from 'ioredis';
 import { AppController } from './app.controller';
 import { AppService } from './app.service';
 import { PrismaModule } from './prisma/prisma.module';
@@ -18,11 +21,19 @@ import { NotificationsModule } from './notifications/notifications.module';
   imports: [
     ConfigModule.forRoot({ isGlobal: true }),
     BullModule.forRoot({
-      connection: {
-        host: process.env.REDIS_HOST || 'localhost',
-        port: parseInt(process.env.REDIS_PORT || '6379'),
-      },
+      connection: process.env.REDIS_URL
+        ? new Redis(process.env.REDIS_URL, { maxRetriesPerRequest: null })
+        : {
+            host: process.env.REDIS_HOST || 'localhost',
+            port: parseInt(process.env.REDIS_PORT || '6379'),
+          },
     }),
+    ThrottlerModule.forRoot([
+      {
+        ttl: 60000,
+        limit: 100, // 100 requests per minute
+      },
+    ]),
     PrismaModule,
     RedisModule,
     AuthModule,
@@ -34,6 +45,12 @@ import { NotificationsModule } from './notifications/notifications.module';
     NotificationsModule,
   ],
   controllers: [AppController],
-  providers: [AppService],
+  providers: [
+    AppService,
+    {
+      provide: APP_GUARD,
+      useClass: ThrottlerGuard,
+    },
+  ],
 })
 export class AppModule {}

apps/backend/src/app.module.ts

@@ -1,6 +1,7 @@
 import { NestFactory } from '@nestjs/core';
 import { AppModule } from './app.module';
 import { ValidationPipe } from '@nestjs/common';
+import helmet from 'helmet';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
@@ -12,7 +13,16 @@ async function bootstrap() {
     }),
   );
 
-  app.enableCors();
+  app.use(helmet());
+
+  app.enableCors({
+    origin: [
+      'http://localhost:3000',
+      'http://10.0.2.2:3000',
+      'https://devflowai.vercel.app',
+    ],
+    credentials: true,
+  });
 
   await app.listen(process.env.PORT ?? 3001);
   console.log(

apps/backend/src/main.ts

@@ -7,10 +7,15 @@ export class RedisService implements OnModuleDestroy {
   private client: Redis;
 
   constructor(private config: ConfigService) {
-    this.client = new Redis({
-      host: this.config.get('REDIS_HOST'),
-      port: this.config.get<number>('REDIS_PORT'),
-    });
+    const url = this.config.get<string>('REDIS_URL');
+    if (url) {
+      this.client = new Redis(url);
+    } else {
+      this.client = new Redis({
+        host: this.config.get<string>('REDIS_HOST') || 'localhost',
+        port: this.config.get<number>('REDIS_PORT') || 6379,
+      });
+    }
   }
 
   async set(key: string, value: string, ttlSeconds?: number): Promise<void> {

apps/backend/src/redis/redis.service.ts

@@ -4,6 +4,35 @@ const nextConfig: NextConfig = {
   turbopack: {
     root: __dirname,
   },
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'X-DNS-Prefetch-Control',
+            value: 'on'
+          },
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=63072000; includeSubDomains; preload'
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'SAMEORIGIN'
+          },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'nosniff'
+          },
+          {
+            key: 'Referrer-Policy',
+            value: 'strict-origin-when-cross-origin'
+          }
+        ]
+      }
+    ];
+  },
 };
 
 export default nextConfig;

apps/web/next.config.ts

@@ -3808,16 +3808,16 @@ MIT
 
 | Day | Focus | Tasks |
 |-----|-------|-------|
-| 81 | Neon DB setup | Create database, run migrations |
-| 82 | Railway backend | Deploy Docker container |
-| 83 | Vercel frontend | Connect repo, configure env vars |
-| 84 | Upstash Redis | Set up, connect to backend |
-| 85 | Ollama (Oracle VM) | Set up Oracle free VM, deploy Ollama |
-| 86 | CI/CD pipeline | GitHub Actions deploy on main push |
-| 87 | Production testing | Test all features on live URLs |
-| 88 | Screenshots + demo | Record Loom video, capture screenshots |
-| 89 | README complete | Full README, architecture diagram |
-| 90 | Portfolio launch | Update portfolio, LinkedIn post, GitHub public |
+| 81 | Neon DB setup | Create free DB, enable pgvector, run migrations |
+| 82 | Upstash Redis | Set up serverless free tier Redis |
+| 83 | Oracle Cloud VM | Set up Always Free ARM VM, install Docker & Ollama |
+| 84 | Render backend | Deploy NestJS API on Render Web Service (Free) |
+| 85 | Vercel frontend | Deploy Next.js app on Vercel Hobby tier |
+| 86 | Mobile config | Set production endpoints for React Native |
+| 87 | Production testing | End-to-End testing on live URLs |
+| 88 | CI/CD pipeline | GitHub Actions automated deploys |
+| 89 | Architecture assets| Generate architecture diagrams, finalize README |
+| 90 | Portfolio launch | Record Loom, LinkedIn post, make public |
 
 ---
 
@@ -3832,7 +3832,7 @@ MIT
 | AI Chat working | Day 50 | Streaming chat E2E |
 | AI Tools + RAG | Day 60 | All AI features |
 | GitHub + Notifications | Day 70 | GitHub integration |
-| Mobile complete | Day 77 | Flutter app functional |
+| Mobile complete | Day 77 | React Native app functional |
 | Tests + Polish | Day 80 | 70% test coverage |
 | **Live in production** | Day 87 | Public URL working |
 | **Portfolio ready** | Day 90 | Open sourced, showcased |