Conversation
Added project description, functional requirements, technologies, team members, and licensing information.
Updated project description, functional requirements, technologies, team members, and code of conduct in README.md.
…afe Discord JSON payloads
Feature docker deployment setup
There was a problem hiding this comment.
Pull request overview
This pull request restores and updates the dev branch with production-ready configuration changes, authentication updates, and project documentation. The changes primarily focus on configuring the application for deployment with proper SSL/HTTPS settings, updating OAuth URLs to use the production API domain, and improving security configurations.
Key Changes
- Production infrastructure setup: Added nginx reverse proxy configuration with SSL/HTTPS support for multiple subdomains (bull-bear.app, api.bull-bear.app, admin.bull-bear.app)
- OAuth authentication updates: Updated Google and Microsoft login URLs to point to the production API domain instead of proxied routes
- Security enhancements: Added CORS credentials support, secure cookie settings, and proper SSL/HTTPS configurations in Django settings
- Project documentation: Added SECURITY.md and CHANGELOG.md files
Reviewed changes
Copilot reviewed 21 out of 39 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/nginx/default.conf | New nginx configuration with HTTP→HTTPS redirect and reverse proxy setup for frontend, API, and admin subdomains |
| src/frontend/vite.config.ts | Updated proxy target to use HTTPS and enabled secure flag |
| src/frontend/src/components/MicrosoftLoginButton.tsx | Changed OAuth URL to production API domain |
| src/frontend/src/components/GoogleLoginButton.tsx | Changed OAuth URL to production API domain |
| src/frontend/src/auth/AuthProtection.tsx | Changed redirect from /login to / for unauthenticated users; removed .tsx extension from import |
| src/frontend/src/auth/Auth.tsx | Updated user authentication endpoint to use full production URL |
| src/frontend/src/api/auth.ts | Changed API base URL from localhost to production domain |
| src/backend/requirements.txt | Replaced deprecated jwt package with PyJWT>=2.8.0 |
| src/backend/core_api/settings/prod.py | Added comprehensive production security settings including SSL, CORS, CSRF, session cookies, and logging |
| src/backend/core_api/settings/base.py | Updated SITE_ID and added django-allauth configuration settings |
| src/backend/api/users/models.py | Modified User model to make email non-unique and auto-generate email/username when missing |
| docker-compose.yml | Updated nginx volume mounts to use read-only mode and switched to Let's Encrypt certificates |
| src/frontend/.dockerignore | New file to exclude unnecessary files from Docker build |
| src/backend/.dockerignore | New file to exclude unnecessary files from Docker build |
| SECURITY.md | New security policy document |
| CHANGELOG.md | New changelog documenting version 0.1.0 |
| assets/*.png | Added new logo image assets (4 PNG files) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if not self.email: | ||
| self.email = ''.join(random.choices(string.ascii_lowercase, k=10)) + '@example.com' | ||
|
|
||
| if not self.username: | ||
| local_part = self.email.split('@')[0] | ||
| base_username = slugify(local_part) |
There was a problem hiding this comment.
The User model generates a random email when self.email is empty, but this happens before the username generation logic. If a user is created without an email, a random email is generated, but then the username generation tries to use self.email.split('@')[0] which will use this random email. This means usernames will be based on random strings like 'abcdefghij' instead of any meaningful identifier. Consider whether this is the intended behavior or if username generation should handle missing emails differently.
| if not self.email: | |
| self.email = ''.join(random.choices(string.ascii_lowercase, k=10)) + '@example.com' | |
| if not self.username: | |
| local_part = self.email.split('@')[0] | |
| base_username = slugify(local_part) | |
| email_was_missing = False | |
| if not self.email: | |
| self.email = ''.join(random.choices(string.ascii_lowercase, k=10)) + '@example.com' | |
| email_was_missing = True | |
| if not self.username: | |
| if email_was_missing: | |
| # Generate a username not based on the random email | |
| base_username = "user" + ''.join(random.choices(string.ascii_lowercase + string.digits, k=6)) | |
| else: | |
| local_part = self.email.split('@')[0] | |
| base_username = slugify(local_part) |
| const GoogleOAuthButton: React.FC = () => { | ||
| const handleLogin = () => { | ||
| window.location.href = "https://bull-bear.app/auth/google/login/?process=login"; | ||
| window.location.href = "https://api.bull-bear.app/auth/google/login"; |
There was a problem hiding this comment.
The OAuth login URLs are inconsistent between Google and Microsoft. Microsoft uses https://api.bull-bear.app/auth/microsoft/login/ (with trailing slash) while Google uses https://api.bull-bear.app/auth/google/login (without trailing slash). For consistency and to avoid potential routing issues, both should follow the same URL pattern.
No description provided.