feat(company-prep): add company interview prep board

.github/workflows/closes_comment.yml

@@ -0,0 +1,37 @@
+name: Issue Closed Comment
+
+on:
+  issues:
+    types: [closed]
+
+permissions:
+  issues: write
+
+jobs:
+  comment-on-close:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Post Closing Comment
+        uses: actions/github-script@v7
+
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+          script: |
+            const issue = context.payload.issue;
+            const creator = issue.user.login;
+            const repoName = context.repo.repo;
+
+            const commentBody = `### Issue Closed\n\n` +
+                                `Thank you, @${creator}, for taking the time to report or engage with this issue in **${repoName}**! 🛡️\n\n` +
+                                `Your input helps us manage our project roadmap effectively.\n\n` +
+                                `If you discover new edge cases or have ideas for enhancements, feel free to open a new issue. Happy coding! 🌟`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              body: commentBody
+            });
+

.github/workflows/pr_raise.yml

@@ -0,0 +1,35 @@
+name: Auto Comment on PR
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Add Comment to Pull Request
+        uses: actions/github-script@v7
+
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const contributor = context.payload.pull_request.user.login;            
+            const commentBody = `Thank you for submitting your pull request, @${contributor}! 🙌 
+            We'll review it as soon as possible. 
+            If there are any specific instructions or feedback regarding your PR, we'll provide them here. 
+            Thanks again for your contribution to our project! 😊`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+
+

backend/Input_validators/ValidateCompanyPrep.js

@@ -0,0 +1,81 @@
+const z = require("zod");
+
+const STATUSES = ["researching", "preparing", "applied", "interviewing", "offer", "rejected", "withdrawn"];
+
+const validateCreateCompanyPrep = (req, res, next) => {
+  const schema = z.object({
+    companyName: z.string().min(1, "Company name required").max(100),
+    role: z.string().min(1, "Role required").max(100),
+    status: z.enum(STATUSES).default("researching"),
+    applicationUrl: z.string().max(500).optional(),
+    salaryRange: z.string().max(80).optional(),
+    location: z.string().max(100).optional(),
+    readinessScore: z.number().min(0).max(100).optional(),
+    focusTopics: z.array(z.string().max(40)).max(8).optional(),
+    processNotes: z.string().max(2000).optional(),
+    priority: z.enum(["low", "medium", "high"]).optional(),
+    deadline: z.string().datetime().optional(),
+  });
+
+  const result = schema.safeParse(req.body);
+  if (!result.success) {
+    return res.status(400).json({ success: false, message: result.error.errors.map((e) => e.message).join(", ") });
+  }
+  req.validatedBody = result.data;
+  next();
+};
+
+const validateUpdateCompanyPrep = (req, res, next) => {
+  const schema = z.object({
+    companyName: z.string().min(1).max(100).optional(),
+    role: z.string().min(1).max(100).optional(),
+    status: z.enum(STATUSES).optional(),
+    applicationUrl: z.string().max(500).optional(),
+    salaryRange: z.string().max(80).optional(),
+    location: z.string().max(100).optional(),
+    readinessScore: z.number().min(0).max(100).optional(),
+    focusTopics: z.array(z.string().max(40)).max(8).optional(),
+    processNotes: z.string().max(2000).optional(),
+    priority: z.enum(["low", "medium", "high"]).optional(),
+    deadline: z.string().datetime().nullable().optional(),
+  });
+
+  const result = schema.safeParse(req.body);
+  if (!result.success) {
+    return res.status(400).json({ success: false, message: result.error.errors.map((e) => e.message).join(", ") });
+  }
+  req.validatedBody = result.data;
+  next();
+};
+
+const validateAddQuestion = (req, res, next) => {
+  const schema = z.object({
+    question: z.string().min(1, "Question required").max(500),
+    difficulty: z.enum(["Easy", "Medium", "Hard"]).default("Medium"),
+    notes: z.string().max(300).optional(),
+  });
+
+  const result = schema.safeParse(req.body);
+  if (!result.success) {
+    return res.status(400).json({ success: false, message: result.error.errors.map((e) => e.message).join(", ") });
+  }
+  req.validatedBody = result.data;
+  next();
+};
+
+const validateAddRound = (req, res, next) => {
+  const schema = z.object({
+    name: z.string().min(1, "Round name required").max(80),
+    description: z.string().max(300).optional(),
+    scheduledAt: z.string().datetime().optional(),
+  });
+
+  const result = schema.safeParse(req.body);
+  if (!result.success) {
+    return res.status(400).json({ success: false, message: result.error.errors.map((e) => e.message).join(", ") });
+  }
+  req.validatedBody = result.data;
+  next();
+};
+
+module.exports = { validateCreateCompanyPrep, validateUpdateCompanyPrep, validateAddQuestion, validateAddRound };

backend/Input_validators/ValidateNotesSummary.js

@@ -56,7 +56,7 @@ const aiOutputSchema = z.object({
 
 
 const saveNotesSummarySchema = z.object({
-  fileName: z.string().min(1).max(200),
+  fileName: z.string().min(1).max(200, "File name cannot exceed 200 characters"),
   sourceType: z.enum(["upload", "platform"]),
   sourceUrl: z.string().url().optional().nullable(),
   pageCount: z.number().int().nonnegative().optional().default(0),

backend/constants/achievements.js

@@ -12,6 +12,7 @@ const VALID_ACHIEVEMENTS = new Set([
   "DSA Master",
   "3-Day Streak",
   "7-Day Streak",
+  "14-Day Streak",
   "30-Day Streak",
 ]);
 

backend/controllers/achievementController.js

@@ -1,22 +1,14 @@
 const User = require('../models/User');
 const { VALID_ACHIEVEMENTS } = require('../constants/achievements');
+const { resetStreakIfMissed } = require('../utils/streakTracker');
 
 exports.getAchievements = async (req, res) => {
     try {
         const user = await User.findById(req.user._id).select('unlockedAchievements lastPracticeDate currentStreak');
         if (!user) return res.status(404).json({ success: false, error: 'User not found' });
 
-        // Reset streak to 0 if one or more calendar days were missed
-        if (user.lastPracticeDate && user.currentStreak > 0) {
-            const now = new Date();
-            const d1 = new Date(user.lastPracticeDate);
-            const utc1 = Date.UTC(d1.getUTCFullYear(), d1.getUTCMonth(), d1.getUTCDate());
-            const utc2 = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
-            const diffDays = Math.floor((utc2 - utc1) / (1000 * 60 * 60 * 24));
-            if (diffDays > 1) {
-                user.currentStreak = 0;
-                await user.save();
-            }
+        if (resetStreakIfMissed(user)) {
+            await user.save();
         }
 
         res.json({ success: true, unlockedAchievements: user.unlockedAchievements });
@@ -35,7 +27,6 @@ exports.saveAchievements = async (req, res) => {
         });
     }
 
-    // Reject any ID not in the server-side allowlist
     const unknown = unlockedAchievements.filter((id) => !VALID_ACHIEVEMENTS.has(id));
 
     if (unknown.length > 0) {
@@ -46,8 +37,6 @@ exports.saveAchievements = async (req, res) => {
     }
 
     try {
-        // $addToSet is idempotent and additive-only — it never removes
-        // achievements the user already earned, and never duplicates.
         await User.findByIdAndUpdate(
             req.user._id,
             { $addToSet: { unlockedAchievements: { $each: unlockedAchievements } } },

backend/controllers/authController.js

@@ -4,6 +4,8 @@ const jwt = require("jsonwebtoken");
 const crypto = require("crypto");
 const { sendVerificationEmail } = require("../utils/sendEmail");
 const { validatePassword } = require('../utils/passwordPolicy');
+const { isValidCountry } = require("../utils/nameCountry");
+const { resetStreakIfMissed } = require("../utils/streakTracker");
 
 // Models for cascade deletion on account delete
 const Session = require("../models/Session");
@@ -97,27 +99,13 @@ const registerUser = async (req, res) => {
 
         const userExists = await User.findOne({ email: cleanEmail });
         if (userExists) {
-            if (!userExists.isEmailVerified) {
-                const rawToken = crypto.randomBytes(32).toString("hex");
-                userExists.emailVerificationToken = crypto.createHash("sha256").update(rawToken).digest("hex");
-                userExists.emailVerificationExpires = new Date(Date.now() + 24 * 60 * 60 * 1000);
-                await userExists.save();
-                try {
-                    const verificationUrl = `${process.env.FRONTEND_URL}/verify-email?token=${rawToken}`;
-                    await sendVerificationEmail(userExists.email, verificationUrl);
-                } catch (err) {
-                    console.error("Failed to resend verification email on re-registration:", err);
-                }
-            }
-            return res.status(201).json({
-                success: true,
-                message: "If this email is not already registered, your account has been created. Please check your email to verify your account before logging in.",
+            // Always return the same ambiguous message to prevent email enumeration
+            return res.status(409).json({
+                success: false,
+                message: "An account with this email already exists. Please log in.",
             });
         }
 
-        // Hash raw password with bcrypt before DB creation (#757)
-        const hashedPassword = await bcrypt.hash(password, PASSWORD_SALT_ROUNDS);
-
         // Split name into first and last names for defaults
         const nameParts = cleanName.split(/\s+/);
         const firstName = nameParts[0] || "";
@@ -126,14 +114,12 @@ const registerUser = async (req, res) => {
         // Generate default unique PrepPilot ID
         const defaultPrepPilotId = cleanEmail.split("@")[0] + Math.floor(1000 + Math.random() * 9000);
 
-        const rawToken = crypto.randomBytes(32).toString("hex");
-        const emailVerificationToken = crypto.createHash("sha256").update(rawToken).digest("hex");
-        const emailVerificationExpires = new Date(Date.now() + 24 * 60 * 60 * 1000);
-
+        // Email verification is currently disabled — accounts are active immediately on creation.
+        // To re-enable: set isEmailVerified to false, generate a token, and call sendVerificationEmail.
         const user = await User.create({
             name: cleanName,
             email: cleanEmail,
-            password: hashedPassword,
+            password,
             profileImageUrl,
             firstName,
             lastName,
@@ -147,21 +133,29 @@ const registerUser = async (req, res) => {
                 socials: { github: "", linkedin: "", twitter: "", portfolio: "" }
             },
             platformPreferences: { theme: "light", notificationsEnabled: true },
-            isEmailVerified: false,
-            emailVerificationToken,
-            emailVerificationExpires,
+            isEmailVerified: true, // verification disabled — users can log in immediately
+            emailVerificationToken: null,
+            emailVerificationExpires: null,
         });
 
-        try {
-            const verificationUrl = `${process.env.FRONTEND_URL}/verify-email?token=${rawToken}`;
-            await sendVerificationEmail(user.email, verificationUrl);
-        } catch (err) {
-            console.error("Failed to send initial verification email:", err);
-        }
+        // Issue tokens immediately so the user is logged in right after signup
+        const accessToken = generateAccessToken(user._id, user.tokenVersion);
+        const refreshToken = generateRefreshToken(user._id);
+
+        user.refreshTokenHash = await bcrypt.hash(refreshToken, REFRESH_TOKEN_SALT_ROUNDS);
+        user.refreshTokenExpiresAt = new Date(Date.now() + REFRESH_TOKEN_MAX_AGE_MS);
+        await user.save();
+
+        res.cookie("refreshToken", refreshToken, getRefreshCookieOptions());
 
         return res.status(201).json({
             success: true,
-            message: "If this email is not already registered, your account has been created. Please check your email to verify your account before logging in.",
+            message: "Account created successfully.",
+            accessToken,
+            _id: user._id,
+            name: user.name,
+            email: user.email,
+            profileImageUrl: user.profileImageUrl,
         });
     } catch (error) {
         console.error("Register error:", error);
@@ -192,14 +186,6 @@ const loginUser = async (req, res) => {
             return res.status(401).json({ success: false, message: "Invalid email or password provided." });
         }
 
-        // Block login until email is verified
-        if (!user.isEmailVerified) {
-            return res.status(403).json({
-                success: false,
-                message: "Please verify your email before logging in. Check your inbox for the verification link.",
-            });
-        }
-
         const accessToken = generateAccessToken(user._id, user.tokenVersion);
         const refreshToken = generateRefreshToken(user._id);
 
@@ -413,17 +399,8 @@ const getUserProfile = async (req, res) => {
             return res.status(404).json({ success: false, message: "Requested user profile not found" });
         }
 
-        // Reset streak to 0 if one or more calendar days were missed
-        if (user.lastPracticeDate && user.currentStreak > 0) {
-            const now = new Date();
-            const d1 = new Date(user.lastPracticeDate);
-            const utc1 = Date.UTC(d1.getUTCFullYear(), d1.getUTCMonth(), d1.getUTCDate());
-            const utc2 = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
-            const diffDays = Math.floor((utc2 - utc1) / (1000 * 60 * 60 * 24));
-            if (diffDays > 1) {
-                user.currentStreak = 0;
-                await user.save();
-            }
+        if (resetStreakIfMissed(user)) {
+            await user.save();
         }
 
         res.json(user);
@@ -433,6 +410,7 @@ const getUserProfile = async (req, res) => {
     }
 };
 
+
 /**
  * Update the user profile settings.
  * @route PUT /api/auth/profile
@@ -459,13 +437,24 @@ const updateUserProfile = async (req, res) => {
         }
 
         // Update fields if they are sent in request
+       // Update fields if they are sent in request
         if (firstName !== undefined) user.firstName = firstName;
         if (lastName !== undefined) user.lastName = lastName;
         if (bio !== undefined) user.bio = bio;
-        if (country !== undefined) user.country = country;
+
+        if (country !== undefined) {
+            if (country.trim() !== "" && !isValidCountry(country)) {
+                return res.status(400).json({
+                    success: false,
+                    message: "Please enter a valid country name.",
+                });
+            }
+
+            user.country = country.trim();
+        }
+
         if (profileImageUrl !== undefined) user.profileImageUrl = profileImageUrl;
         if (visibility !== undefined) user.visibility = visibility;
-
         // Sync name based on firstName and lastName
         if (firstName !== undefined || lastName !== undefined) {
             const fName = firstName !== undefined ? firstName : user.firstName;
@@ -558,8 +547,8 @@ const changePassword = async (req, res) => {
             return res.status(400).json({ success: false, message: "Incorrect original password" });
         }
 
-        // Hash new password before saving (#757)
-        user.password = await bcrypt.hash(newPassword, PASSWORD_SALT_ROUNDS);
+        // Set new password (User.js pre save hook hashes it automatically)
+        user.password = newPassword;
 
         // Fix #759: Revoke active refresh tokens in database & increment tokenVersion for access tokens
         user.refreshTokenHash = null;