Devs

.env.example

@@ -0,0 +1,19 @@
+# ==========================================
+# payNEXT Environment Variables Template
+# ==========================================
+# COPY THIS FILE AND RENAME IT TO .env
+# Command: cp .env.example .env
+
+# Remote Shared Database
+DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/paynext_db?sslmode=require
+
+# Optional split variables if your backend uses them
+DB_HOST=your-db-host.supabase.com
+DB_PORT=5432
+DB_USER=postgres
+DB_PASSWORD=change_me
+DB_NAME=postgres
+DB_SSL=true
+
+# API Secrets
+JWT_SECRET=choose_your_own_local_jwt_secret

.github/workflows/deploy.yml

@@ -2,14 +2,9 @@ name: payNEXT CI/CD
 
 on:
   push:
-    branches:
-      - devs
-      - release
-      - main
+    branches: [devs, release, main]
   pull_request:
-    branches:
-      - release
-      - main
+    branches: [release, main]
   workflow_dispatch:
 
 concurrency:
@@ -20,59 +15,41 @@ jobs:
   validate:
     name: Validate Project
     runs-on: ubuntu-latest
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
       - name: Check required files
         run: |
-          echo "Checking required payNEXT files..."
           test -f docker-compose.yml
-          test -f client/Dockerfile
-          test -f client/nginx.conf
-          test -f client/public/index.html
-          echo "All required files exist."
+          test -f web/Dockerfile
+          test -f web/nginx.conf
+          test -f web/public/index.html
+          test -f db/init.sql
 
       - name: Create dummy .env file
         run: echo "JWT_SECRET=super_secret_test_key" > .env
 
       - name: Validate Docker Compose file
-        run: |
-          docker compose -f docker-compose.yml config > /dev/null
-          echo "Docker Compose file is valid."
-
-      - name: Boot up API for Testing
-        run: docker compose up -d --build
-
-      - name: Wait for API to be healthy
-        run: |
-          echo "Waiting for API and Database to start..."
-          sleep 15
-          docker ps -a
-          docker logs paynext-api
+        run: docker compose -f docker-compose.yml config > /dev/null
 
-      - name: Run Automated API Tests
-        run: node test_api.js
   deploy-production:
     name: Deploy to Production
     runs-on: ubuntu-latest
-
     needs: validate
-
     if: github.ref == 'refs/heads/main'
-
     environment:
       name: production
-
-    env:
+      env:
       SERVER_IP: ${{ secrets.SERVER_IP }}
       SSH_USER: ${{ secrets.SSH_USER }}
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-
+      DB_HOST: ${{ secrets.DB_HOST }}
+      DB_USER: ${{ secrets.DB_USER }}
+      DB_NAME: ${{ secrets.DB_NAME }}
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
       - name: Setup SSH
         run: |
@@ -83,37 +60,36 @@ jobs:
           ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts
 
       - name: Create deployment folder on server
-        run: |
-          ssh "$SSH_USER@$SERVER_IP" "mkdir -p /opt/paynext"
+        run: ssh "$SSH_USER@$SERVER_IP" "mkdir -p /opt/paynext"
 
-      - name: Package application files
+      - name: Build server .env on the runner
         run: |
-          tar --exclude='./.git' --exclude='./.github' -czf paynext.tgz docker-compose.yml client server db
-
-      - name: Copy package to server
+          {
+            echo "DB_HOST=$DB_HOST"
+            echo "DB_PORT=5432"
+            echo "DB_USER=$DB_USER"
+            echo "DB_PASSWORD=$DB_PASSWORD"
+            echo "DB_NAME=$DB_NAME"
+            echo "DB_SSL=true"
+            echo "JWT_SECRET=$JWT_SECRET"
+          } > server.env
+
+      - name: Copy app and .env to server
         run: |
+          tar --exclude='./.git' --exclude='./.github' -czf paynext.tgz docker-compose.yml web db
           scp paynext.tgz "$SSH_USER@$SERVER_IP":/tmp/paynext.tgz
+          scp server.env "$SSH_USER@$SERVER_IP":/opt/paynext/.env
+          rm -f server.env paynext.tgz
 
       - name: Deploy using Docker
         run: |
           ssh "$SSH_USER@$SERVER_IP" << 'EOF'
           set -e
-
           cd /opt/paynext
-
-          echo "Generating production .env file..."
-          echo "JWT_SECRET=super_secret_production_key" > .env
-          echo "NODE_ENV=production" >> .env
-
           docker compose down --remove-orphans || true
-
-          rm -rf web docker-compose.yml
-
+          rm -rf web db docker-compose.yml
           tar -xzf /tmp/paynext.tgz
-
-          rm /tmp/paynext.tgz
-
+          rm -f /tmp/paynext.tgz
           docker compose up -d --build
-
           docker image prune -f
           EOF

.gitignore

@@ -5,4 +5,10 @@ node_modules/
 *.log
 .DS_Store
 dist/
-build/
+build/get-docker.sh
+
+# Block all .env files everywhere
+**/.env
+.env
+.agents
+skills-lock.json

Caddyfile

@@ -1,13 +1,13 @@
-paynextt.me, www.paynextt.me, localhost {
+paynextt.me, www.paynextt.me {
 
     encode zstd gzip
 
     handle /api/* {
-        reverse_proxy api:3000
+    	reverse_proxy api:3000
     }
 
     handle {
-        reverse_proxy web:80
+    	reverse_proxy web:80
     }
 
 }

README.md

@@ -111,40 +111,4 @@ docker compose down -v
 
 Use the `-v` option only when you want to remove the stored local database data.
 
-## 🔐 Authentication & Authorization (Lab 05)
-
-### Registration (`POST /api/v1/auth/register`)
-Request:
-```json
-{ "email": "user@test.com", "password": "password123", "fullName": "Test User" }
-```
-Response (`201 Created`):
-```json
-{ "success": true, "message": "Registered successfully", "data": { "token": "jwt_string..." } }
-```
-
-### Login (`POST /api/v1/auth/login`)
-Request:
-```json
-{ "email": "user@test.com", "password": "password123" }
-```
-Response (`200 OK`):
-```json
-{ "success": true, "message": "Login successful", "data": { "token": "jwt_string..." } }
-```
-
-### Admin Restricted Endpoint (`GET /api/v1/auth/users`)
-Requires: `Authorization: Bearer <ADMIN_TOKEN>`
-Response (`200 OK`):
-```json
-{
-  "success": true,
-  "data": [
-    { "id": 1, "email": "admin@test.com", "role": "admin" },
-    { "id": 2, "email": "user@test.com", "role": "user" }
-  ]
-}
-```
-If accessed with a standard user token, returns `403 Forbidden`.
-
 payNEXT - Powering Your Next Move. Next Generation Digital Wallet.

SECURITY.md

@@ -0,0 +1,27 @@
+# 🔐 Security Measures in payNEXT
+
+This document outlines the security implementations in the payNEXT architecture.
+
+## 1. Transport Layer Security
+
+- **HTTPS Enforcement:** Caddy automatically provisions Let's Encrypt SSL certificates and redirects all HTTP traffic to HTTPS.
+- **Security Headers:** `helmet.js` is configured globally to set secure HTTP headers (HSTS, X-Frame-Options, etc.).
+
+## 2. Access Control & Rate Limiting
+
+- **Rate Limiting:** Authentication endpoints (`/api/v1/auth/login`, `/register`) are restricted to 5 requests per 15 minutes per IP to prevent brute-force attacks.
+- **CORS:** Strict origin whitelisting is enforced. Only `https://paynextt.me` and `http://localhost:8080` are permitted.
+
+## 3. Input Validation & Injection Prevention
+
+- **SQL Injection:** All PostgreSQL queries use parameterized inputs via the `pg` library.
+- **XSS & Data Sanitization:** `express-validator` is used to trim, escape, and validate all incoming user inputs before processing.
+
+## 4. Infrastructure & Load Balancing
+
+- **Reverse Proxy:** Caddy acts as the single entry point, routing `/api/*` to the backend and `/` to the Nginx frontend.
+- **Load Balancing:** The API service can be scaled horizontally (`docker-compose up --scale api=2`). Caddy distributes traffic across instances using a `round_robin` policy.
+
+## 5. How to Test
+
+See the repository wiki or run the provided `curl` commands in `TESTING.md` to verify rate limiting, CORS, and header configurations.

docker-compose.yml

@@ -1,12 +1,10 @@
-version: '3.8'
+version: "3.8"
 
 services:
   api:
     build: ./server
     container_name: paynext-api
     restart: unless-stopped
-    ports:
-      - "3000:3000"
     env_file:
       - .env
     environment:
@@ -22,8 +20,6 @@ services:
     image: postgres:16-alpine
     container_name: paynext-db
     restart: unless-stopped
-    ports:
-      - "5432:5432"
     environment:
       POSTGRES_USER: ${DB_USER:-postgres}
       POSTGRES_PASSWORD: ${DB_PASSWORD:-postgres}
@@ -32,7 +28,11 @@ services:
       - postgres_data:/var/lib/postgresql/data
       - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-paynext_db}"]
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-paynext_db}",
+        ]
       interval: 5s
       timeout: 5s
       retries: 20