f10334683d
Two audit-pass-#3 prod-readiness gaps. Security headers next.config.ts now emits CSP, X-Frame-Options=DENY, X-Content-Type-Options=nosniff, Referrer-Policy, Permissions-Policy on every response, plus HSTS in production. CSP allows the small set of inline-style/inline-script + unsafe-eval (dev-only) needed by Tailwind, Radix, and Next dev HMR; img-src/connect-src kept reasonably wide for s3.portnimara.com branding + Socket.IO. Verified via curl -I that headers ship and that the dashboard route still serves correctly. website_submissions retention Adds 'website-submissions-retention' case to the maintenance worker with a 180-day window and schedules it at 07:00 daily. Raw inquiry payloads include reCAPTCHA + IP + UA metadata; keeping them indefinitely was a privacy + storage gap that audit-pass-#3 flagged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
81 lines
3.2 KiB
TypeScript
81 lines
3.2 KiB
TypeScript
import { getQueue, type QueueName } from './index';
|
|
import { logger } from '@/lib/logger';
|
|
|
|
interface RecurringJobDef {
|
|
queue: QueueName;
|
|
name: string;
|
|
pattern: string;
|
|
}
|
|
|
|
/**
|
|
* Register all recurring jobs from 11-REALTIME-AND-BACKGROUND-JOBS.md Section 3.2.
|
|
* Called once on server startup.
|
|
*/
|
|
export async function registerRecurringJobs(): Promise<void> {
|
|
const recurring: RecurringJobDef[] = [
|
|
// Documenso signature fallback poll - primary is webhooks, this is safety net
|
|
{ queue: 'documents', name: 'signature-poll', pattern: '0 */6 * * *' },
|
|
|
|
// Reminder checks
|
|
{ queue: 'notifications', name: 'reminder-check', pattern: '0 * * * *' },
|
|
{ queue: 'notifications', name: 'reminder-overdue-check', pattern: '*/15 * * * *' },
|
|
|
|
// Google Calendar background sync
|
|
{ queue: 'maintenance', name: 'calendar-sync', pattern: '*/30 * * * *' },
|
|
|
|
// Daily checks at 08:00
|
|
{ queue: 'notifications', name: 'invoice-overdue-check', pattern: '0 8 * * *' },
|
|
{ queue: 'notifications', name: 'tenure-expiry-check', pattern: '0 8 * * *' },
|
|
|
|
// Exchange rate refresh every 6 hours
|
|
{ queue: 'maintenance', name: 'currency-refresh', pattern: '0 */6 * * *' },
|
|
|
|
// Database backup / cleanup
|
|
{ queue: 'maintenance', name: 'database-backup', pattern: '0 2 * * *' },
|
|
{ queue: 'maintenance', name: 'backup-cleanup', pattern: '0 3 * * 0' }, // Sunday 03:00
|
|
|
|
// Session cleanup
|
|
{ queue: 'maintenance', name: 'session-cleanup', pattern: '0 4 * * *' },
|
|
|
|
// Report scheduler - checks every minute for reports due to run
|
|
{ queue: 'reports', name: 'report-scheduler', pattern: '* * * * *' },
|
|
|
|
// Notification digest - configurable per user; placeholder fires hourly
|
|
// TODO(L2): make per-user schedule configurable (read from user_settings)
|
|
{ queue: 'email', name: 'notification-digest', pattern: '0 * * * *' },
|
|
|
|
// Cleanup jobs
|
|
{ queue: 'maintenance', name: 'temp-file-cleanup', pattern: '0 5 * * *' },
|
|
{ queue: 'maintenance', name: 'form-expiry-check', pattern: '0 * * * *' },
|
|
|
|
// Phase B: alert rule engine sweep
|
|
{ queue: 'maintenance', name: 'alerts-evaluate', pattern: '*/5 * * * *' },
|
|
// Phase B: analytics snapshot warm
|
|
{ queue: 'maintenance', name: 'analytics-refresh', pattern: '*/15 * * * *' },
|
|
|
|
// Phase 3d: GDPR Article 17 - actually delete expired export bundles
|
|
{ queue: 'maintenance', name: 'gdpr-export-cleanup', pattern: '0 4 * * *' },
|
|
// Phase 3b: AI usage ledger retention (90-day rolling window)
|
|
{ queue: 'maintenance', name: 'ai-usage-retention', pattern: '0 5 * * *' },
|
|
// Migration 0040 contract: error_events older than 90 days get pruned.
|
|
{ queue: 'maintenance', name: 'error-events-retention', pattern: '0 6 * * *' },
|
|
// Raw website inquiry payloads — 180-day retention.
|
|
{ queue: 'maintenance', name: 'website-submissions-retention', pattern: '0 7 * * *' },
|
|
];
|
|
|
|
for (const job of recurring) {
|
|
const queue = getQueue(job.queue);
|
|
await queue.upsertJobScheduler(
|
|
job.name,
|
|
{ pattern: job.pattern },
|
|
{ data: {}, name: job.name },
|
|
);
|
|
logger.info(
|
|
{ queue: job.queue, job: job.name, pattern: job.pattern },
|
|
'Registered recurring job',
|
|
);
|
|
}
|
|
|
|
logger.info({ count: recurring.length }, 'All recurring jobs registered');
|
|
}
|