Codebase cleanup - auth hardening, component splits, and infra improvements

[engdotme]

Summary

A broad cleanup pass touching security, code organisation, and developer experience across the full stack.

Security & Auth

• Migrate auth to httpOnly cookies with server-side route protection
• Add rate limiting to API and auth routes
• Apply region/VPN restriction to OAuth sign-in; redirect blocked users to /unavailable
• Prevent X-Forwarded-For spoofing via trust proxy config
• Fix: retry 401 requests only once after token refresh
• Fix: only render user-supplied URLs as links when they are http(s)
• Fix: clear user-scoped localStorage on sign-out; keep registration IP/location out of localStorage

Frontend refactoring

• Split large page components into focused sub-components (application detail, cohort detail, notification bell, profile form)
• Extract avatar upload into its own component
• Rename colocated client views from _name.tsx → name-view.tsx convention
• Create reusable ListPageLayout for admin list pages
• Wrap axios instance in a singleton ApiClient class with interceptors
• Enrich SEO metadata across public and private routes
• Remove unused ProfileSheet component

Backend / infra

• Enable full TypeScript strict mode + no-floating-promises
• Migrate Prisma seed config to prisma.config.ts
• Use Nest Logger for bootstrap logging
• Fix e2e Jest config and add first unit specs

Test plan

• Sign in / sign up flows work (including OAuth)
• Users outside the allowed region / on VPN are redirected to /unavailable
• Auth cookies are set correctly and protected routes require a valid session
• Rate limiting activates under repeated rapid requests
• Admin list pages render correctly with the new ListPageLayout
• Notification bell, cohort detail, application detail, and profile form render and behave as before
• Sign-out clears localStorage correctly
• Run backend unit specs: pnpm test

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
forgeng-frontend	Ready	Preview, Comment	Jun 18, 2026 2:11pm

[github-actions]

Backend coverage

Backend coverage

Lines	Statements	Branches	Functions
	72.65% (1427/1964)	66.69% (847/1270)	75.06% (271/361)

[github-actions]

Frontend coverage

Frontend coverage

Lines	Statements	Branches	Functions
	32.05% (817/2549)	24.88% (390/1567)	25.98% (191/735)

[heyradcode]

Thanks for the PR!
It failed with Lint errors, can you take a look? @engdotme