Merge remote-tracking branch 'origin/develop' into fix/move-signup-link

Author: nayarakarinesilva

.cspell/custom-dictionary-workspace.txt

@@ -11,6 +11,12 @@ GO_SCRAPER_URL=http://localhost:8081
 # Use uma string longa e secreta em ambientes reais.
 SESSION_SECRET=change-me-with-a-long-random-secret
 
+# Segurança / PII
+# ENCRYPTION_MASTER_KEY deve ter 32 bytes em hex, ou seja, 64 caracteres hex.
+ENCRYPTION_MASTER_KEY=
+ENCRYPTION_KEY_ID=default
+SEARCH_KEY=
+
 # CORS / frontend access
 CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
 

.env.example

@@ -56,6 +56,7 @@ Objetivo de produto: fornecer uma base robusta para busca, filtragem e gestão d
 ├─ electron/                # Shell desktop
 ├─ docker-compose.yml       # App stack (frontend + backend + scraper-go)
 ├─ docker-compose.infra.yml # Infra stack (Postgres + Valkey)
+├─ docker-compose.migrate.yml # Migration job do backend
 └─ .github/workflows/ci.yml # CI
 ```
 
@@ -106,25 +107,13 @@ docker network create vagas-net
 
 Se a rede já existir, o Docker vai avisar e você pode seguir para o próximo passo.
 
-4. Suba Postgres e Valkey:
+4. Suba Postgres, Valkey, scraper, backend e frontend:
 
 ```bash
-docker compose -f docker-compose.infra.yml up -d
-```
-
-5. Suba scraper, backend e frontend:
-
-```bash
-docker compose up --build -d
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml up --build -d
 ```
 
-6. Aplique as migrations do backend:
-
-```bash
-docker compose exec backend npm run db:migrate
-```
-
-7. Acesse os serviços:
+5. Acesse os serviços:
 
 - Frontend: http://localhost:5173
 - Backend health: http://localhost:3001/health
@@ -272,31 +261,35 @@ Este projeto separa infraestrutura e aplicação em dois arquivos Compose:
 
 - `docker-compose.infra.yml`: Postgres + Valkey.
 - `docker-compose.yml`: scraper Go + backend + frontend.
+- `docker-compose.migrate.yml`: job de migrations do backend.
 
-Subir infraestrutura:
+Subir infraestrutura, migrations e aplicação:
 
 ```bash
-docker compose -f docker-compose.infra.yml up -d
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml up --build -d
 ```
 
-Subir aplicação:
+O serviço `migrate` executa `npm run db:migrate` e `npm run security:backfill-user-pii -- --write` depois que o Postgres fica saudável. O backend só inicia depois que esse job termina com sucesso.
+
+Se quiser subir apenas a infraestrutura:
 
 ```bash
-docker compose up --build -d
+docker compose -f docker-compose.infra.yml up -d
 ```
 
-Aplicar migrations:
+Se quiser subir a aplicação sem o job de migrations:
 
 ```bash
-docker compose exec backend npm run db:migrate
+docker compose up --build -d
 ```
 
 Ver logs:
 
 ```bash
-docker compose logs -f backend
-docker compose logs -f frontend
-docker compose logs -f scraper-go
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f migrate
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f backend
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f frontend
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f scraper-go
 ```
 
 Encerrar:
@@ -314,7 +307,7 @@ Dentro dos containers, serviços devem usar os nomes da rede Docker:
 - Valkey: `valkey:6379`
 - Scraper: `scraper-go:8081`
 
-Por isso o `docker-compose.yml` sobrescreve `DATABASE_URL`, `VALKEY_URL`, `GO_SCRAPER_URL` e `SCRAPER_URL` para os valores internos corretos.
+Por isso o `docker-compose.yml` e o `docker-compose.migrate.yml` sobrescrevem variáveis como `DATABASE_URL`, `VALKEY_URL`, `GO_SCRAPER_URL` e `SCRAPER_URL` para os valores internos corretos.
 
 Serviços padrão:
 

README.md

@@ -25,18 +25,15 @@ FRONTEND_URL=http://localhost:5173
 # Use uma string longa e secreta em ambientes reais.
 SESSION_SECRET=change-me-with-a-long-random-secret
 
+# Segurança / PII
+# ENCRYPTION_MASTER_KEY deve ter 32 bytes em hex, ou seja, 64 caracteres hex.
+ENCRYPTION_MASTER_KEY=
+ENCRYPTION_KEY_ID=default
+SEARCH_KEY=
+
 # CORS / frontend access
 CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
 
-# Search filters
-SEARCH_LOCATION=Brasil
-SEARCH_GEO_ID=106057199
-SEARCH_LANGUAGE=pt
-REMOTE_ONLY=true
-JOB_TYPES=C,F
-TIME_FILTER=r604800
-SEARCH_KEYWORDS=UX Designer,UI Designer,Product Manager,Product Owner
-
 # Database / cache for backend running locally outside Docker
 DATABASE_URL=postgresql://vagas:vagas@localhost:5432/vagas
 VALKEY_URL=redis://localhost:6379/0

backend/.env.example

@@ -12,10 +12,13 @@ post {
 
 body:json {
   {
-    "email":"hudson60@gmail.com",
-    "password": "tavares10", 
-    "name": "Hudson Tavares", 
-    "role":"banana"
+    "email": "teste.criptografia.001@example.com",
+    "password": "SenhaForte123",
+    "name": "Teste Criptografia",
+    "phone": "+5534999999999",
+    "cpf": "12345678901",
+    "technologies": ["TypeScript", "Node.js", "React"],
+    "level": "pleno"
   }
 }
 

backend/bruno/Auth/Register.bru

@@ -5,12 +5,13 @@ meta {
 }
 
 get {
-  url: {{base_url}}/jobs/search?keywords=node.js
+  url: {{base_url}}/jobs/search?location=&keywords=node.js
   body: none
   auth: inherit
 }
 
 params:query {
+  location: 
   keywords: node.js
 }
 

backend/bruno/Jobs/SearchJobs.bru

@@ -0,0 +1,11 @@
+ALTER TABLE "credentials" ADD COLUMN "email_hash" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "first_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "last_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "display_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "email_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "email_hash" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "phone_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "cpf_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "cpf_hash" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "users_email_hash_unique" ON "users" USING btree ("email_hash");--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_email_hash_unique" UNIQUE("email_hash");

backend/drizzle/0008_bent_thor.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "users" ADD COLUMN "avatar_url_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "technologies_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "level_encrypted" text;