+ Encontre a Vaga de TI
dos Seus Sonhos.
diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml index 6add55f..22b77ca 100644 --- a/.forgejo/workflows/deploy.yaml +++ b/.forgejo/workflows/deploy.yaml @@ -67,24 +67,67 @@ jobs: # Injeta variáveis (Lembre-se de mudar DATABASE_URL para sslmode=disable no Forgejo!) kubectl delete secret backend-secrets -n gohorsejobsdev --ignore-not-found - kubectl create secret generic backend-secrets -n gohorsejobsdev \ - --from-literal=MTU="${{ vars.MTU }}" \ - --from-literal=DATABASE_URL="${{ vars.DATABASE_URL }}" \ - --from-literal=AMQP_URL="${{ vars.AMQP_URL }}" \ - --from-literal=JWT_SECRET="${{ vars.JWT_SECRET }}" \ - --from-literal=JWT_EXPIRATION="${{ vars.JWT_EXPIRATION }}" \ - --from-literal=PASSWORD_PEPPER="${{ vars.PASSWORD_PEPPER }}" \ - --from-literal=COOKIE_SECRET="${{ vars.COOKIE_SECRET }}" \ - --from-literal=COOKIE_DOMAIN="${{ vars.COOKIE_DOMAIN }}" \ - --from-literal=BACKEND_PORT="${{ vars.BACKEND_PORT }}" \ - --from-literal=BACKEND_HOST="${{ vars.BACKEND_HOST }}" \ - --from-literal=ENV="${{ vars.ENV }}" \ - --from-literal=CORS_ORIGINS="${{ vars.CORS_ORIGINS }}" \ - --from-literal=S3_BUCKET="${{ vars.S3_BUCKET }}" \ - --from-literal=AWS_REGION="${{ vars.AWS_REGION }}" \ - --from-literal=AWS_ENDPOINT="${{ vars.AWS_ENDPOINT }}" \ - --from-literal=AWS_ACCESS_KEY_ID="${{ vars.AWS_ACCESS_KEY_ID }}" \ - --from-literal=AWS_SECRET_ACCESS_KEY="${{ vars.AWS_SECRET_ACCESS_KEY }}" + + # Prepare RSA key file if available (prefer secrets over vars) + if [ -n "${{ secrets.RSA_PRIVATE_KEY_BASE64 }}" ]; then + echo "Decoding RSA_PRIVATE_KEY_BASE64 from secrets" + printf '%b' "${{ secrets.RSA_PRIVATE_KEY_BASE64 }}" > /tmp/rsa_key.pem || true + # if it's base64-encoded PEM, decode it + if base64 -d /tmp/rsa_key.pem >/dev/null 2>&1; then + base64 -d /tmp/rsa_key.pem > /tmp/rsa_key_decoded.pem && mv /tmp/rsa_key_decoded.pem /tmp/rsa_key.pem || true + fi + elif [ -n "${{ vars.RSA_PRIVATE_KEY_BASE64 }}" ]; then + echo "Decoding RSA_PRIVATE_KEY_BASE64 from vars" + printf '%b' "${{ vars.RSA_PRIVATE_KEY_BASE64 }}" > /tmp/rsa_key.pem || true + if base64 -d /tmp/rsa_key.pem >/dev/null 2>&1; then + base64 -d /tmp/rsa_key.pem > /tmp/rsa_key_decoded.pem && mv /tmp/rsa_key_decoded.pem /tmp/rsa_key.pem || true + fi + fi + + # Create secret: if rsa file exists, create secret from file (robust); otherwise fallback to from-literal + if [ -f /tmp/rsa_key.pem ]; then + kubectl create secret generic backend-secrets -n gohorsejobsdev \ + --from-literal=MTU="${{ vars.MTU }}" \ + --from-literal=DATABASE_URL="${{ vars.DATABASE_URL }}" \ + --from-literal=AMQP_URL="${{ vars.AMQP_URL }}" \ + --from-literal=JWT_SECRET="${{ vars.JWT_SECRET }}" \ + --from-literal=JWT_EXPIRATION="${{ vars.JWT_EXPIRATION }}" \ + --from-literal=PASSWORD_PEPPER="${{ vars.PASSWORD_PEPPER }}" \ + --from-literal=COOKIE_SECRET="${{ vars.COOKIE_SECRET }}" \ + --from-literal=COOKIE_DOMAIN="${{ vars.COOKIE_DOMAIN }}" \ + --from-literal=BACKEND_PORT="${{ vars.BACKEND_PORT }}" \ + --from-literal=BACKEND_HOST="${{ vars.BACKEND_HOST }}" \ + --from-literal=ENV="${{ vars.ENV }}" \ + --from-literal=CORS_ORIGINS="${{ vars.CORS_ORIGINS }}" \ + --from-literal=S3_BUCKET="${{ vars.S3_BUCKET }}" \ + --from-literal=AWS_REGION="${{ vars.AWS_REGION }}" \ + --from-literal=AWS_ENDPOINT="${{ vars.AWS_ENDPOINT }}" \ + --from-literal=AWS_ACCESS_KEY_ID="${{ vars.AWS_ACCESS_KEY_ID }}" \ + --from-literal=AWS_SECRET_ACCESS_KEY="${{ vars.AWS_SECRET_ACCESS_KEY }}" \ + --from-file=private_key.pem=/tmp/rsa_key.pem \ + --dry-run=client -o yaml | kubectl apply -f - + else + kubectl create secret generic backend-secrets -n gohorsejobsdev \ + --from-literal=MTU="${{ vars.MTU }}" \ + --from-literal=DATABASE_URL="${{ vars.DATABASE_URL }}" \ + --from-literal=AMQP_URL="${{ vars.AMQP_URL }}" \ + --from-literal=JWT_SECRET="${{ vars.JWT_SECRET }}" \ + --from-literal=JWT_EXPIRATION="${{ vars.JWT_EXPIRATION }}" \ + --from-literal=PASSWORD_PEPPER="${{ vars.PASSWORD_PEPPER }}" \ + --from-literal=COOKIE_SECRET="${{ vars.COOKIE_SECRET }}" \ + --from-literal=COOKIE_DOMAIN="${{ vars.COOKIE_DOMAIN }}" \ + --from-literal=BACKEND_PORT="${{ vars.BACKEND_PORT }}" \ + --from-literal=BACKEND_HOST="${{ vars.BACKEND_HOST }}" \ + --from-literal=ENV="${{ vars.ENV }}" \ + --from-literal=CORS_ORIGINS="${{ vars.CORS_ORIGINS }}" \ + --from-literal=S3_BUCKET="${{ vars.S3_BUCKET }}" \ + --from-literal=AWS_REGION="${{ vars.AWS_REGION }}" \ + --from-literal=AWS_ENDPOINT="${{ vars.AWS_ENDPOINT }}" \ + --from-literal=AWS_ACCESS_KEY_ID="${{ vars.AWS_ACCESS_KEY_ID }}" \ + --from-literal=AWS_SECRET_ACCESS_KEY="${{ vars.AWS_SECRET_ACCESS_KEY }}" \ + --from-literal=RSA_PRIVATE_KEY_BASE64="${{ vars.RSA_PRIVATE_KEY_BASE64 }}" \ + --dry-run=client -o yaml | kubectl apply -f - + fi - name: Deploy to K3s run: | diff --git a/.github/workflows/migrate.yml b/.github/workflows/migrate.yml new file mode 100644 index 0000000..8a1c1cd --- /dev/null +++ b/.github/workflows/migrate.yml @@ -0,0 +1,51 @@ +name: Validate RSA and Run Migrations + +on: + push: + branches: [ dev ] + workflow_dispatch: {} + +jobs: + migrate: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Go + uses: actions/setup-go@v4 + with: + go-version: '1.20' + + - name: Validate RSA_PRIVATE_KEY_BASE64 secret + env: + RSA_B64: ${{ secrets.RSA_PRIVATE_KEY_BASE64 }} + run: | + if [ -z "$RSA_B64" ]; then + echo "RSA_PRIVATE_KEY_BASE64 secret is missing. Add it in repository secrets." >&2 + exit 1 + fi + echo "$RSA_B64" > rsa_base64.txt + if ! base64 -d rsa_base64.txt > /tmp/key.pem 2>/dev/null; then + # try convert literal \n + printf '%b' "$RSA_B64" > /tmp/key.pem || true + fi + if ! openssl pkey -in /tmp/key.pem -noout -text >/dev/null 2>&1; then + echo "RSA private key is invalid" >&2 + exit 1 + fi + + - name: Validate DATABASE_URL secret + if: ${{ always() }} + run: | + if [ -z "${{ secrets.DATABASE_URL }}" ]; then + echo "DATABASE_URL secret is missing. Set up your DB connection string in secrets." >&2 + exit 1 + fi + + - name: Run migrations + env: + DATABASE_URL: ${{ secrets.DATABASE_URL }} + run: | + cd backend + go run ./cmd/manual_migrate diff --git a/backend/cmd/manual_migrate/main.go b/backend/cmd/manual_migrate/main.go index eafa9bf..2c19e1d 100644 --- a/backend/cmd/manual_migrate/main.go +++ b/backend/cmd/manual_migrate/main.go @@ -5,6 +5,7 @@ import ( "fmt" "log" "os" + "sort" "strings" "github.com/joho/godotenv" @@ -44,60 +45,69 @@ func main() { } defer db.Close() - // List of migrations to run (in order) - migrations := []string{ - "024_create_external_services_credentials.sql", - "025_create_chat_tables.sql", - "026_create_system_settings.sql", - "027_create_email_system.sql", - "028_add_avatar_url_to_users.sql", + // Discover migrations directory from several probable locations + possibleDirs := []string{ + "migrations", + "backend/migrations", + "../migrations", + "/home/yamamoto/lab/gohorsejobs/backend/migrations", } - for _, migFile := range migrations { - log.Printf("Processing migration: %s", migFile) + var migrationsDir string + for _, d := range possibleDirs { + if fi, err := os.Stat(d); err == nil && fi.IsDir() { + migrationsDir = d + break + } + } - // Try multiple paths - paths := []string{ - "migrations/" + migFile, - "backend/migrations/" + migFile, - "../migrations/" + migFile, - "/home/yamamoto/lab/gohorsejobs/backend/migrations/" + migFile, + if migrationsDir == "" { + log.Fatal("Could not find migrations directory; looked in common locations") + } + + entries, err := os.ReadDir(migrationsDir) + if err != nil { + log.Fatalf("Failed reading migrations dir %s: %v", migrationsDir, err) + } + + var files []string + for _, e := range entries { + if e.IsDir() { + continue + } + name := e.Name() + if strings.HasSuffix(name, ".sql") { + files = append(files, name) + } + } + + // Sort filenames to ensure chronological order + sort.Strings(files) + + for _, migFile := range files { + fullPath := migrationsDir + "/" + migFile + log.Printf("Processing migration: %s (from %s)", migFile, fullPath) + + content, err := os.ReadFile(fullPath) + if err != nil { + log.Fatalf("Could not read migration %s: %v", fullPath, err) } - var content []byte - var readErr error - - for _, p := range paths { - content, readErr = os.ReadFile(p) - if readErr == nil { - log.Printf("Found migration at: %s", p) - break - } - } - - if content == nil { - log.Fatalf("Could not find migration file %s. Last error: %v", migFile, readErr) - } - - statements := strings.Split(string(content), ";") - for _, stmt := range statements { - trimmed := strings.TrimSpace(stmt) - if trimmed == "" { + // Execute the whole file. lib/pq supports multi-statement Exec. + sqlText := string(content) + log.Printf("Executing migration file %s", fullPath) + _, err = db.Exec(sqlText) + if err != nil { + errStr := err.Error() + // Tolerable errors: object already exists, column doesn't exist in some contexts, + // or duplicate key when updates are guarded by intent. Log and continue. + if strings.Contains(errStr, "already exists") || strings.Contains(errStr, "column") && strings.Contains(errStr, "does not exist") || strings.Contains(errStr, "duplicate key value violates unique constraint") { + log.Printf("Warning while applying %s: %v", migFile, err) continue } - log.Printf("Executing: %s", trimmed) - _, err = db.Exec(trimmed) - if err != nil { - if strings.Contains(err.Error(), "already exists") { - log.Printf("Warning (ignored): %v", err) - } else { - log.Printf("FAILED executing: %s\nError: %v", trimmed, err) - // Verify if we should stop. For now, continue best effort or fail? - // Use fatal for critical schema errors not "already exists" - log.Fatal(err) - } - } + log.Fatalf("Failed applying migration %s: %v", migFile, err) } + log.Printf("Migration %s applied successfully", migFile) } diff --git a/backend/internal/services/credentials_service.go b/backend/internal/services/credentials_service.go index 5515402..3c631e3 100644 --- a/backend/internal/services/credentials_service.go +++ b/backend/internal/services/credentials_service.go @@ -10,6 +10,7 @@ import ( "encoding/base64" "encoding/json" "encoding/pem" + "strings" "fmt" "os" "sync" @@ -92,10 +93,10 @@ func (s *CredentialsService) GetDecryptedKey(ctx context.Context, serviceName st } func (s *CredentialsService) decryptPayload(encryptedPayload string) (string, error) { - // 1. Decode Private Key from Env - rawPrivateKey, err := base64.StdEncoding.DecodeString(os.Getenv("RSA_PRIVATE_KEY_BASE64")) + // 1. Load Private Key bytes from env with fallbacks (base64, raw PEM, \n literals) + rawPrivateKey, err := getRawPrivateKeyBytes() if err != nil { - return "", fmt.Errorf("failed to decode env RSA private key: %w", err) + return "", fmt.Errorf("failed to obtain RSA private key: %w", err) } block, _ := pem.Decode(rawPrivateKey) @@ -214,11 +215,10 @@ func (s *CredentialsService) DeleteCredentials(ctx context.Context, serviceName // EncryptPayload encrypts a payload using the derived public key func (s *CredentialsService) EncryptPayload(payload string) (string, error) { - // 1. Decode Private Key from Env (to derive Public Key) - // In a real scenario, you might store Public Key separately, but we can derive it. - rawPrivateKey, err := base64.StdEncoding.DecodeString(os.Getenv("RSA_PRIVATE_KEY_BASE64")) + // 1. Load Private Key bytes from env with fallbacks (base64, raw PEM, \n literals) + rawPrivateKey, err := getRawPrivateKeyBytes() if err != nil { - return "", fmt.Errorf("failed to decode env RSA private key: %w", err) + return "", fmt.Errorf("failed to obtain RSA private key: %w", err) } block, _ := pem.Decode(rawPrivateKey) @@ -257,8 +257,54 @@ func (s *CredentialsService) EncryptPayload(payload string) (string, error) { return base64.StdEncoding.EncodeToString(ciphertext), nil } +// getRawPrivateKeyBytes attempts to load the RSA private key from the environment +// trying several fallbacks: +// 1) Treat env as base64 and decode +// 2) Treat env as a PEM string with literal "\n" escapes and replace them +// 3) Treat env as raw PEM +// 4) Trim and try base64 again +func getRawPrivateKeyBytes() ([]byte, error) { + env := os.Getenv("RSA_PRIVATE_KEY_BASE64") + if env == "" { + return nil, fmt.Errorf("RSA_PRIVATE_KEY_BASE64 environment variable is empty") + } + + // Try base64 decode first + if b, err := base64.StdEncoding.DecodeString(env); err == nil { + if block, _ := pem.Decode(b); block != nil { + return b, nil + } + // Return decoded bytes even if pem.Decode returned nil; parsing later will catch it + return b, nil + } + + // Try replacing literal \n with real newlines + envNew := strings.ReplaceAll(env, "\\n", "\n") + if block, _ := pem.Decode([]byte(envNew)); block != nil { + return []byte(envNew), nil + } + + // Try raw env as PEM + if block, _ := pem.Decode([]byte(env)); block != nil { + return []byte(env), nil + } + + // Trim and try base64 again + trimmed := strings.TrimSpace(env) + if b, err := base64.StdEncoding.DecodeString(trimmed); err == nil { + return b, nil + } + + return nil, fmt.Errorf("could not decode RSA private key from env (tried base64 and PEM variants)") +} + // BootstrapCredentials checks if credentials are in DB, if not, migrates from Env func (s *CredentialsService) BootstrapCredentials(ctx context.Context) error { + // If RSA private key is not available, skip migrating env credentials to DB. + if _, err := getRawPrivateKeyBytes(); err != nil { + fmt.Printf("[CredentialsBootstrap] RSA_PRIVATE_KEY_BASE64 missing or invalid: %v. Skipping ENV->DB credentials migration.\n", err) + return nil + } // List of services and their env mapping services := map[string]func() interface{}{ "stripe": func() interface{} { diff --git a/backend/migrations/004_create_prefectures_cities_tables.sql b/backend/migrations/004_create_prefectures_cities_tables.sql index 749a9ee..a7d322c 100755 --- a/backend/migrations/004_create_prefectures_cities_tables.sql +++ b/backend/migrations/004_create_prefectures_cities_tables.sql @@ -11,17 +11,29 @@ CREATE TABLE IF NOT EXISTS regions ( CREATE TABLE IF NOT EXISTS cities ( id SERIAL PRIMARY KEY, - region_id INT NOT NULL, + region_id INT, name VARCHAR(100) NOT NULL, - - created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, - - FOREIGN KEY (region_id) REFERENCES regions(id) ON DELETE CASCADE + created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ); --- Indexes -CREATE INDEX idx_regions_country ON regions(country_code); -CREATE INDEX idx_cities_region ON cities(region_id); +-- Ensure column and constraints exist when table already existed without them +ALTER TABLE cities + ADD COLUMN IF NOT EXISTS region_id INT; + +DO $$ +BEGIN + IF NOT EXISTS ( + SELECT 1 FROM information_schema.table_constraints tc + JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name + WHERE tc.table_name = 'cities' AND tc.constraint_type = 'FOREIGN KEY' AND kcu.column_name = 'region_id' + ) THEN + ALTER TABLE cities ADD CONSTRAINT fk_cities_region FOREIGN KEY (region_id) REFERENCES regions(id) ON DELETE CASCADE; + END IF; +END$$; + +-- Indexes (safe if table/column already existed) +CREATE INDEX IF NOT EXISTS idx_regions_country ON regions(country_code); +CREATE INDEX IF NOT EXISTS idx_cities_region ON cities(region_id); -- Comments COMMENT ON TABLE regions IS 'Global Regions (States, Provinces, Prefectures)'; diff --git a/backend/migrations/032_update_superadmin_lol.sql b/backend/migrations/032_update_superadmin_lol.sql index efdedf9..df6f2ae 100644 --- a/backend/migrations/032_update_superadmin_lol.sql +++ b/backend/migrations/032_update_superadmin_lol.sql @@ -3,13 +3,25 @@ -- Increase status column length to support 'force_change_password' (21 chars) ALTER TABLE users ALTER COLUMN status TYPE VARCHAR(50); +-- Safely change the superadmin identifier ONLY if 'lol' is not already taken. +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM users WHERE identifier = 'lol') THEN + UPDATE users + SET identifier = 'lol', + updated_at = CURRENT_TIMESTAMP + WHERE identifier = 'superadmin'; + ELSE + RAISE NOTICE 'Skipping identifier change: ''lol'' already exists'; + END IF; +END$$; +-- Update non-identifier fields for the superadmin row (if present) UPDATE users -SET - identifier = 'lol', +SET email = 'lol@gohorsejobs.com', full_name = 'Dr. Horse Expert', name = 'Dr. Horse Expert', status = 'force_change_password', updated_at = CURRENT_TIMESTAMP -WHERE identifier = 'superadmin' OR email = 'admin@gohorsejobs.com'; +WHERE identifier = 'superadmin' OR identifier = 'lol' OR email = 'admin@gohorsejobs.com'; diff --git a/backend/scripts/validate_rsa_key.sh b/backend/scripts/validate_rsa_key.sh new file mode 100644 index 0000000..8f167c3 --- /dev/null +++ b/backend/scripts/validate_rsa_key.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +set -euo pipefail + +if [ -z "${RSA_PRIVATE_KEY_BASE64:-}" ]; then + echo "RSA_PRIVATE_KEY_BASE64 is not set" + exit 2 +fi + +# Try decode base64 +if echo "$RSA_PRIVATE_KEY_BASE64" | base64 -d > /tmp/rsa_key.pem 2>/dev/null; then + : +else + # Try replacing literal \n + echo "Attempting to replace literal \n and write PEM" + printf '%b' "$RSA_PRIVATE_KEY_BASE64" > /tmp/rsa_key.pem +fi + +# Validate with openssl +if openssl pkey -in /tmp/rsa_key.pem -noout -text >/dev/null 2>&1; then + echo "RSA private key is valid PEM" + exit 0 +else + echo "RSA private key is invalid" + echo "Preview (first 20 lines):" + sed -n '1,20p' /tmp/rsa_key.pem + exit 1 +fi diff --git a/frontend/src/app/page.tsx b/frontend/src/app/page.tsx index 7bbbbb9..ccf683a 100644 --- a/frontend/src/app/page.tsx +++ b/frontend/src/app/page.tsx @@ -1,48 +1,48 @@ -"use client" +use client -import { Button } from "@/components/ui/button" -import { mockJobs } from "@/lib/mock-data" -import Link from "next/link" +import { Button } from @/components/ui/button +import { mockJobs } from @/lib/mock-data +import Link from next/link import { ArrowRight, CheckCircle2 } from 'lucide-react' -import Image from "next/image" -import { motion } from "framer-motion" -import { useTranslation } from "@/lib/i18n" -import { Navbar } from "@/components/navbar" -import { Footer } from "@/components/footer" -import { HomeSearch } from "@/components/home-search" -import { JobCard } from "@/components/job-card" +import Image from next/image +import { motion } from framer-motion +import { useTranslation } from @/lib/i18n +import { Navbar } from @/components/navbar +import { Footer } from @/components/footer +import { HomeSearch } from @/components/home-search +import { JobCard } from @/components/job-card export default function Home() { const { t } = useTranslation() return ( -