updated

Author: ykargeee-bit

.dockerignore

@@ -26,6 +26,7 @@ credentials/
 jest.config*
 tsconfig*.json
 !tsconfig.build.json
+!tsconfig.json
 
 # ── Dependencies (rebuilt inside image) ───────────────────────────────────────
 node_modules/

.github/workflows/security.yml

@@ -34,7 +34,6 @@ jobs:
   dependency-scan:
     name: Dependency Scan
     runs-on: ubuntu-latest
-    if: hashFiles('package.json', 'pnpm-lock.yaml') != ''
 
     steps:
       - name: Checkout code
@@ -55,7 +54,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Audit dependencies (fail only on critical)
-        run: pnpm audit --audit-level=critical
+        run: pnpm audit --audit-level=critical --prod
 
   secrets-scan:
     name: Secrets Scan (Gitleaks)
@@ -67,13 +66,20 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
+            | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
+        run: |
+          gitleaks detect --source=. --exit-code 1 \
+            --log-opts="origin/${{ github.base_ref }}..HEAD"
 
   container-scan:
     name: Container Scan (Trivy)
     runs-on: ubuntu-latest
-    if: hashFiles('Dockerfile') != ''
 
     steps:
       - name: Checkout code

PR_DESCRIPTION.md

@@ -0,0 +1,33 @@
+# PR Title
+
+fix(gdpr): revoke active sessions during user erasure
+
+## Summary
+
+Fixes #821.
+
+GDPR erasure previously anonymized the user profile but left Redis-backed sessions and refresh-token material intact. This allowed an erased user to continue authenticating with previously issued session state.
+
+## What changed
+
+- Added session revocation during GDPR erasure by deleting all Redis sessions belonging to the user.
+- Cleared the user's refresh token during erasure so old refresh-token-based flows are invalidated.
+- Added regression tests covering both:
+  - GDPR erasure invoking session cleanup, and
+  - session service removal of all sessions for a specific user.
+
+## Why
+
+This brings the erasure flow into compliance with GDPR data-erasure expectations by ensuring previously valid session state is invalidated immediately when a user is erased.
+
+## Testing
+
+Verified locally with:
+
+```bash
+cd /home/gift/teachLink_backend && npx jest --runInBand src/modules/gdpr/tests/gdpr.service.spec.ts src/session/session.service.spec.ts
+```
+
+Result:
+- 2/2 test suites passed
+- 17/17 tests passed

pnpm-lock.yaml

@@ -7,3 +7,6 @@ allowBuilds:
   msgpackr-extract: true
   protobufjs: true
   sharp: true
+
+overrides:
+  protobufjs: '>=7.5.5'

pnpm-workspace.yaml

@@ -1,4 +1,4 @@
-import { Module } from '@nestjs/common';
+import { MiddlewareConsumer, Module, NestModule, RequestMethod } from '@nestjs/common';
 import { APP_GUARD, APP_INTERCEPTOR, APP_FILTER } from '@nestjs/core';
 import { ConfigModule } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
@@ -21,6 +21,8 @@ import { IncidentManagementModule } from './incident-management/incident-managem
 import { MonitoringModule } from './monitoring/monitoring.module';
 import { RequestTimeoutInterceptor } from './common/interceptors/request-timeout.interceptor';
 import { GlobalExceptionFilter } from './common/interceptors/global-exception.filter';
+import { RoleVisibilityInterceptor } from './common/interceptors/role-visibility.interceptor';
+import { ApiVersionMiddleware } from './common/middleware/api-version.middleware';
 import { DeepLinkModule } from './deep-link/deep-link.module';
 import { InvoicesModule } from './payments/invoices/invoices.module';
 import { ReportingModule } from './payments/reporting/reporting.module';
@@ -32,6 +34,7 @@ import { CachingModule } from './caching/caching.module';
 import { CoursesModule } from './courses/courses.module';
 import { AuthModule } from './auth/auth.module';
 import { CohortsModule } from './cohorts/cohorts.module';
+import { FeatureFlagAuditModule } from './config/feature-flag-audit.module';
 
 const featureFlags = loadFeatureFlags();
 
@@ -67,12 +70,20 @@ const featureFlags = loadFeatureFlags();
     // ✅ courses module with enrollment and prerequisite enforcement
     CoursesModule,
     CohortsModule,
+
+    // Feature flag audit trail and admin management endpoints
+    FeatureFlagAuditModule,
   ],
   controllers: [AppController],
   providers: [
     ...(featureFlags.ENABLE_RATE_LIMITING ? [{ provide: APP_GUARD, useClass: QuotaGuard }] : []),
     { provide: APP_INTERCEPTOR, useClass: RequestTimeoutInterceptor },
+    { provide: APP_INTERCEPTOR, useClass: RoleVisibilityInterceptor },
     { provide: APP_FILTER, useClass: GlobalExceptionFilter },
   ],
 })
-export class AppModule {}
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer): void {
+    consumer.apply(ApiVersionMiddleware).forRoutes({ path: 'v*', method: RequestMethod.ALL });
+  }
+}

src/app.module.ts

@@ -19,6 +19,9 @@ describe('CachingService', () => {
       clear: jest.fn().mockResolvedValue(undefined),
     };
     metrics = { updateCacheHitRate: jest.fn() };
+    (cacheManager as any).store = {
+      keys: jest.fn().mockResolvedValue(['cache:test:1', 'cache:test:2']),
+    };
     service = new CachingService(
       cacheManager as never,
       metrics as unknown as MetricsCollectionService,
@@ -51,6 +54,15 @@ describe('CachingService', () => {
     });
   });
 
+  describe('deleteByPattern', () => {
+    it('uses store.keys to delete matching keys when client scan is unavailable', async () => {
+      await service.deleteByPattern('cache:test:*');
+      expect((cacheManager as any).store.keys).toHaveBeenCalledWith('cache:test:*');
+      expect(cacheManager.del).toHaveBeenCalledWith('cache:test:1');
+      expect(cacheManager.del).toHaveBeenCalledWith('cache:test:2');
+    });
+  });
+
   describe('hit rate metrics', () => {
     it('calculates hit rate and publishes to metrics', async () => {
       cacheManager.get.mockResolvedValueOnce('cached').mockResolvedValueOnce(undefined);

src/caching/caching.service.spec.ts

@@ -60,6 +60,39 @@ export class CachingService {
     }
   }
 
+  async deleteByPattern(pattern: string): Promise<void> {
+    try {
+      const store = (this.cacheManager as any).store;
+
+      if (store && store.client && typeof store.client.scan === 'function') {
+        let cursor = '0';
+        do {
+          const result = await store.client.scan(cursor, 'MATCH', pattern, 'COUNT', 100);
+          cursor = result[0];
+          const keys = result[1];
+          if (keys && keys.length > 0) {
+            await store.client.del(...keys);
+          }
+        } while (cursor !== '0');
+        return;
+      }
+
+      if (store && typeof store.keys === 'function') {
+        const keys = await store.keys(pattern);
+        if (keys && keys.length > 0) {
+          await this.deleteMany(keys);
+        }
+        return;
+      }
+
+      this.logger.warn(
+        `Pattern deletion not supported by current cache store for pattern: ${pattern}`,
+      );
+    } catch (error: any) {
+      this.logger.error(`Failed to delete by pattern ${pattern}: ${error.message}`, error.stack);
+    }
+  }
+
   getStats(): CacheStats {
     const total = this.hits + this.misses;
     return {

src/caching/caching.service.ts

@@ -0,0 +1,50 @@
+import 'reflect-metadata';
+import { UserRole } from '../../users/entities/user.entity';
+
+/**
+ * Metadata key used to store {@link VisibleTo} role lists on entity properties.
+ * @internal
+ */
+export const VISIBLE_TO_METADATA_KEY = 'visibleTo:roles';
+
+/**
+ * Marks an entity field as visible only to the specified roles.
+ *
+ * When a response is serialised by {@link RoleVisibilityInterceptor}, any
+ * field decorated with `@VisibleTo` that is **not** in the viewer's role list
+ * is deleted from the outgoing object before it reaches the client.
+ *
+ * Placing `@VisibleTo` on a new field is sufficient to enforce visibility —
+ * no additional per-route configuration is needed.
+ *
+ * @example
+ * ```ts
+ * \@VisibleTo(UserRole.ADMIN)
+ * refreshToken?: string;
+ *
+ * \@VisibleTo(UserRole.ADMIN, UserRole.MODERATOR)
+ * sensitiveScore?: number;
+ * ```
+ */
+export function VisibleTo(...roles: UserRole[]): PropertyDecorator {
+  return (target: object, propertyKey: string | symbol): void => {
+    // Accumulate existing metadata so multiple decorators on the same class
+    // don't overwrite each other.
+    const existing: Map<string | symbol, UserRole[]> =
+      Reflect.getOwnMetadata(VISIBLE_TO_METADATA_KEY, target.constructor) ?? new Map();
+    existing.set(propertyKey, roles);
+    Reflect.defineMetadata(VISIBLE_TO_METADATA_KEY, existing, target.constructor);
+  };
+}
+
+/**
+ * Returns the `@VisibleTo` role map for a given constructor, or `null` when
+ * the class has no `@VisibleTo` annotations.
+ *
+ * @internal Used by {@link RoleVisibilityInterceptor}.
+ */
+export function getVisibilityMap(
+  ctor: new (...args: unknown[]) => unknown,
+): Map<string | symbol, UserRole[]> | null {
+  return Reflect.getOwnMetadata(VISIBLE_TO_METADATA_KEY, ctor) ?? null;
+}