quentin_duwa/dinggadingga-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sync): harden the Hiboutik sync, share rate limits across instances, update dependencies #4

Merged
quentin_duwa merged 4 commits from feature/sync-hardening into main 2026-11-08 13:45:08 +00:00
Conversation 0 Commits 4 Files Changed 62 +1546 -639
quentin_duwa commented 2026-11-08 11:21:24 +00:00
Owner
Copy Link
No description provided.
quentin_duwa added 4 commits 2026-11-08 11:21:25 +00:00
chore(deps): add zod, align NestJS on 11.1.29 and force multer 2.5.0 4b0cda1740 
NestJS 11.1.29 fixes the path-to-regexp ReDoS advisories. No NestJS release
ships multer >= 2.5.0 yet, which fixes several DoS advisories: it is forced
through overrides until one does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(sync): validate Hiboutik payloads, read French dates and guard deletions 35a7c27cb7 
- Hiboutik payloads are zod schemas, validated by HiboutikClient (getOne
  added for single resources: null on 404 or empty answer).
- Hiboutik dates are read as Europe/Paris whatever the server time zone.
- Paginated lists driving deletions are walked twice when they span several
  pages (brands, categories, products); categories are sorted by id.
- A customer missing from the list is deleted only once Hiboutik confirms
  it; completed orders that lost their customer are linked back.
- Each product and its versions are written in one transaction.
- An email removed in Hiboutik is erased in database.
- A 429 is retried with backoff, then stops the synchronization.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(security): share rate limits across instances, drain syncs on shutdown 3dd5369175 
- Rate limiting counters live in PostgreSQL (throttler_records), shared by
  every instance, one atomic upsert per request; fails open.
- On shutdown, new syncs are refused (503) and the running one is waited for
  up to SYNC_SHUTDOWN_TIMEOUT; Prisma disconnects last.
- Hiboutik calls never follow redirects and are capped at 50 MB.
- Prisma errors no longer print query arguments (errorFormat minimal).
- In production, DATABASE_URL must require TLS.
- The sync lock connection times out after 10 s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: enable TypeScript strict mode and fail on floating promises 7e7ba66243 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
quentin_duwa merged commit cc3dcd3f0a into main 2026-11-08 13:45:08 +00:00
quentin_duwa deleted branch feature/sync-hardening 2026-11-08 13:45:08 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
quentin_duwa
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: quentin_duwa/dinggadingga-backend#4
No description provided.
Delete Branch "feature/sync-hardening"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?