7ed1a340b9
FRE-5353 Home Title: Dashboard widget + tier gating
...
- Add hometitle API routes: properties CRUD, changes, alerts, scan
- Implement Premium tier gating with 402 responses for non-Premium users
- Enforce max 5 properties per Premium subscription (0 for Free/Basic, 3 for Plus)
- Build DashboardPage with PropertyCard, AddPropertyForm, AlertsList components
- Add dashboard CSS styles with responsive design
- Register hometitle routes under /hometitle prefix with auth middleware
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-14 22:51:35 -04:00
0bec3c574a
FRE-5335 Hook waitlist signup to send confirmation email via Resend
...
- Added @shieldai/shared-notifications, bullmq, ioredis deps to API
- POST /api/waitlist/signup now sends waitlist_confirmation email via EmailService
- Schedules welcome sequence (day1 intro, day3 features, day7 launch teaser) via BullMQ delayed jobs
- Added waitlist email worker in @shieldai/jobs to process delayed welcome sequence emails
- Templates already in place: waitlist_confirmation, waitlist_intro, waitlist_features, waitlist_launch_teaser with dark-themed HTML layouts
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-14 07:16:43 -04:00
9d4865306c
ShieldAI waitlist landing page and analytics infrastructure FRE-5274
...
Build waitlist landing page with Solid.js (hero, features, tier comparison,
waitlist signup form, blog preview, footer). Create waitlist signup and blog
API endpoints in Fastify. Add WaitlistEntry and BlogPost models to Prisma
schema. Create analytics hooks for GA4 and Mixpanel tracking. Fix pre-existing
Prisma schema issue (AnalysisJob relation missing User field).
- Landing page: responsive Solid.js app with hero, 6 feature cards, 3-tier
pricing comparison table, blog preview, and full waitlist signup form with
interest tier selection
- API: POST /api/waitlist/signup, GET /api/waitlist/count, GET /api/blog,
GET /api/blog/:slug, CRUD /api/admin/blog
- DB models: WaitlistEntry (with UTM params, conversion tracking, source),
BlogPost (with tags, view count, publish scheduling)
- Analytics: useAnalytics hook with initAnalytics(), trackEvent(),
trackWaitlistSignup(), trackPageView() — GA4 and Mixpanel dual-tracking
- Blog: listing, detail, and admin CRUD routes; seed.ts with 3 starter articles
- Fix: AnalysisJob.analysisJobId missing @unique constraint, missing
analysisJobs[] on User model
Delegated to CMO: FRE-5280 (GA4 config), FRE-5281 (Mixpanel config),
FRE-5282 (email marketing platform)
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-13 23:47:25 -04:00
Security Reviewer
4d30bacc53
Fix VoicePrint auth bypass & audio upload (FRE-5003)
...
P1-2: Add onRequest auth hook to reject anonymous requests on all 7
VoicePrint endpoints. Previously, the auth middleware always attached
a placeholder user (id='anonymous'), so per-route userId checks passed
for unauthenticated clients.
P1-3: Replace JSON body parsing with @fastify/multipart for POST
/endpoints (/enroll, /analyze, /batch). Fastify JSON parser cannot
produce Buffer from request.body; multipart/form-data is required
for audio file uploads. Added 50MB file size limit.
2026-05-10 03:20:31 -04:00
57a206d7b3
Fix type errors in report routes (redundant parseInt, JsonValue cast) (FRE-4575)
...
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-09 22:57:03 -04:00
2521c4e998
Add Protection Report Generator with HTML/PDF output and scheduled delivery (FRE-4575)
...
- Report service: data collection from all three engines, HTML rendering (Handlebars), PDF generation (pdfkit)
- REST API: /reports endpoints for generate, history, view, PDF download, scheduling
- BullMQ workers: queued report generation with retry, monthly/annual scheduler triggers
- DB: SecurityReport model with Prisma schema and type exports
- Email: report_ready template in shared-notifications
- All dependencies wired through existing packages
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-09 22:54:46 -04:00
de0ddac65d
Add ShieldAI browser extension with phishing & spam detection (FRE-4576)
...
- Extension package: Manifest V3, background service worker, content scripts
- Phishing detection engine with heuristic analysis (typosquatting, entropy, TLD, brand impersonation)
- Local URL caching layer (Storage API) for <100ms cached lookups
- Popup UI with protection status, stats, and phishing report button
- Options page for settings management (blocked/allowed domains, feature toggles)
- Server-side extension routes: URL check, phishing report, auth, stats, exposure check
- Tier-aware feature gating (Basic/Plus/Premium)
- 25 passing tests for phishing detection heuristics
- Declarative net request rules for known phishing patterns
- DarkWatch integration for credential exposure checks
- Firefox compatibility layer via build modes
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-09 21:53:29 -04:00
Senior Engineer
91e4985a8e
FRE-4474 Phase 5: Verify and resolve security review findings for SpamShield and Cross-Service Correlation
...
- FRE-4499 (SpamShield): Verified 6 security fixes (2 High, 4 Medium)
- S01: Pre-compiled regex in RuleEngine (ReDoS fix)
- S02: SmsClassifier accepts senderPhoneNumber context
- S03: AlertServer JWT auth + origin validation
- S04: SHA-256 phone hashing (PII protection)
- S05: DecisionEngine timeout enforcement via Promise.race
- S06: CarrierFactory.getAllCarriers properly async/await
- FRE-4500 (Correlation): Verified 7 security fixes (2 Critical, 2 High, 2 Medium, 1 Low)
- C1: Ingest endpoints auth via request.user.id
- C2: IDOR protection on group endpoints (userId filter)
- H3: JWT middleware registered in server.ts
- H4: Fastify schema validation on all routes
- M6: Payload sanitization with depth limit and circular ref detection
- L7: CORS origin restricted to env var
- Resolved liveness incidents FRE-4652 and FRE-4654
- All Phase 5 child issues now complete
2026-05-02 18:36:29 -04:00
24bc9c235f
Consolidate @shieldai/db and @shieldsai/shared-db packages (FRE-4603)
...
- Merged singleton pattern + type exports from shared-db
- Kept FieldEncryptionService from original db package
- Upgraded to Prisma v6.2.0 (newer version)
- Adopted shared-db's complete schema for multi-service platform
- Updated 17 consumer imports across darkwatch, voiceprint, jobs, api
- Standardized on @shieldai/db namespace
Files changed:
- packages/db/package.json (v0.1.0 → v0.2.0)
- packages/db/src/index.ts (consolidated exports)
- packages/db/prisma/schema.prisma (merged schema)
- packages/db/prisma/seed.ts (updated for new schema)
- 17 consumer files updated
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-02 15:06:02 -04:00
bdf8ad30b6
Apply security remediations for FRE-4498 (FRE-4612)
...
Security findings from April 30 review were claimed fixed but never committed.
Applied all remediations:
HIGH:
- WebhookHandler: fail fast when DARKWATCH_WEBHOOK_SECRET missing instead of defaulting to hardcoded secret
- field-encryption.service: require PII_ENCRYPTION_KEY at startup instead of defaulting
MEDIUM:
- WebhookHandler: make signature required (was optional, accepted unsigned events)
- WebhookHandler: reject unknown event types instead of silently defaulting to SCAN_TRIGGER
- scheduler.routes + webhook.routes: add ownership checks on /:userId endpoints (IDOR)
LOW:
- webhook.routes: generic error responses, full error logged server-side
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-02 13:03:28 -04:00
e704a9074a
FRE-4533: Merge apps/{api,web,mobile} and shared-db into ShieldAI repo
...
Merge FrenoCorp apps into ShieldAI packages/:
- packages/api: merged routes (notifications), middleware (auth, rate-limit, error, logging), config, services (darkwatch, spamshield, voiceprint), tests
- packages/web: new SolidJS web app stub
- packages/mobile: new SolidJS mobile app stub
- packages/shared-db: new Prisma DB package (separate from existing packages/db)
- pnpm-workspace.yaml: restored (apps/* removed, already covered by packages/*)
Next: reconcile packages/shared-db with packages/db, and fix server.ts correlationRoutes import
2026-05-02 10:19:11 -04:00
1e42c4a5c2
FRE-4529: Transfer ShieldAI code from FrenoCorp repo
...
Transferred ShieldAI-related files mistakenly placed in ~/code/FrenoCorp:
- Services: spamshield (feature-flags, audit-logger, error-handler), voiceprint (config, service, feature-flags), darkwatch (pipeline, scan, scheduler, watchlist, webhook)
- Packages: shared-analytics, shared-auth, shared-ui, shared-utils (new); shared-billing, jobs supplemented with unique FC files
- Server: alerts (FC version newer), routes (spamshield, darkwatch, voiceprint)
- Config: turbo.json, tsconfig.base.json, vite/vitest configs, drizzle, Dockerfile
- VoicePrint ML service
- Examples
Pending: apps/{api,web,mobile}/ structured merge, shared-db/db mapping
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-02 10:13:13 -04:00
Senior Engineer
03276dde2d
Add cross-service alert correlation system FRE-4500
...
- Unified alert types (AlertSource, AlertCategory, CorrelationStatus, EntityType)
- NormalizedAlert and CorrelationGroup Prisma models
- AlertNormalizer for all 4 services (DarkWatch, SpamShield, VoicePrint, CallAnalysis)
- CorrelationEngine with temporal + entity-based correlation detection
- CorrelationService orchestrator with dashboard API
- Correlation API routes (/api/v1/correlation/*)
- Service emitters wired to DarkWatch, SpamShield, VoicePrint
- pnpm workspace config for monorepo
2026-05-02 01:10:44 -04:00
9fb5379b7a
Add tier-based scan scheduler and webhook triggers (FRE-4498)
...
- ScanScheduler: tier-based scheduling (BASIC=24h, PLUS=6h, PREMIUM=1h)
- WebhookHandler: HMAC-verified webhook ingestion with SCAN_TRIGGER support
- API routes: /scheduler and /webhooks endpoints under /api/v1/darkwatch
- Jobs: scheduled scan checker + webhook retry processor via BullMQ
- Schema: ScanSchedule, WebhookEvent models; ScanJob.scheduledBy field
- Types: ScheduleStatus, WebhookEventType, WebhookTriggerInput
- Tests: scheduler lifecycle + webhook signature/processing tests
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-04-30 10:57:56 -04:00
509259bcf2
for first push
2026-04-29 16:29:03 -04:00
Senior Engineer
218de3b03b
FRE-4471: Scaffold DarkWatch MVP — monorepo, schema, services, API routes, tests
...
- Turborepo monorepo structure (packages: api, db, types, jobs; services: darkwatch)
- Prisma schema: User, WatchListItem, Exposure, Alert, ScanJob models
- WatchListService: CRUD with normalization, dedup, tier-based limits
- HIBPService: API integration with severity scoring
- MatchingEngine: exact-match with content hash dedup
- AlertPipeline: dedup window, email notifications
- ScanService: orchestrates watch list -> HIBP -> match -> alert flow
- BullMQ job workers for scan and alert processing
- Fastify API routes: watchlist, exposures, alerts, scan
- Docker Compose: PostgreSQL 16 + Redis 7
- 15 unit tests passing
- Implementation plan document uploaded
2026-04-29 09:47:45 -04:00
