Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .env.example
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Backend Port
PORT=3000

# MongoDB Configuration
MONGO_URI=mongodb://mongodb:27017/campus-marketplace

ACCESS_TOKEN_SECRET=your-secure-access-token-secret-here
REFRESH_TOKEN_SECRET=your-secure-refresh-token-secret-here

# CORS Configuration
CORS_ORIGIN=http://localhost:5173

CLOUDINARY_CLOUD_NAME=your-cloudinary-cloud-name
CLOUDINARY_API_KEY=your-cloudinary-api-key
CLOUDINARY_API_SECRET=your-cloudinary-api-secret
Comment on lines +13 to +15
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add missing CLOUDINARY_URL variable.

The docker-compose.yml file (line 39) references CLOUDINARY_URL, but this variable is not included in the .env.example template. Add it to ensure completeness.

Apply this diff:

 CLOUDINARY_CLOUD_NAME=your-cloudinary-cloud-name
 CLOUDINARY_API_KEY=your-cloudinary-api-key
 CLOUDINARY_API_SECRET=your-cloudinary-api-secret
+CLOUDINARY_URL=cloudinary://your-api-key:your-api-secret@your-cloud-name
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
CLOUDINARY_CLOUD_NAME=your-cloudinary-cloud-name
CLOUDINARY_API_KEY=your-cloudinary-api-key
CLOUDINARY_API_SECRET=your-cloudinary-api-secret
CLOUDINARY_CLOUD_NAME=your-cloudinary-cloud-name
CLOUDINARY_API_KEY=your-cloudinary-api-key
CLOUDINARY_API_SECRET=your-cloudinary-api-secret
CLOUDINARY_URL=cloudinary://your-api-key:your-api-secret@your-cloud-name
🧰 Tools
🪛 dotenv-linter (4.0.0)

[warning] 14-14: [UnorderedKey] The CLOUDINARY_API_KEY key should go before the CLOUDINARY_CLOUD_NAME key

(UnorderedKey)


[warning] 15-15: [UnorderedKey] The CLOUDINARY_API_SECRET key should go before the CLOUDINARY_CLOUD_NAME key

(UnorderedKey)

🤖 Prompt for AI Agents
.env.example around lines 13 to 15: the .env.example is missing the
CLOUDINARY_URL variable referenced by docker-compose.yml; add a CLOUDINARY_URL
entry to the file (use the Cloudinary URL format
cloudinary://<API_KEY>:<API_SECRET>@<CLOUD_NAME> or a placeholder like
cloudinary://your-api-key:your-api-secret@your-cloud-name) so the example
matches docker-compose and developers know the expected format.


# Frontend Port
VITE_PORT=5173

# API Base URL for Frontend
VITE_API_BASE_URL=http://localhost:3000/api
53 changes: 34 additions & 19 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,35 +1,28 @@
# File created using '.gitignore Generator' for Visual Studio Code: https://bit.ly/vscode-gig
# Created by https://www.toptal.com/developers/gitignore/api/nextjs,node,react
# Edit at https://www.toptal.com/developers/gitignore?templates=nextjs,node,react
# Created by https://www.toptal.com/developers/gitignore/api/react,node,nextjs
# Edit at https://www.toptal.com/developers/gitignore?templates=react,node,nextjs

# Dependencies
**/node_modules
### NextJS ###
# dependencies
/node_modules
/.pnp
.pnp.js

# Testing
# testing
/coverage

# Next.js
# next.js
/.next/
/out/

# Production builds
**/build
**/dist
# production
/build

# Environment variables
**/.env
**/.env.local
**/.env.development.local
**/.env.test.local
**/.env.production.local

# Misc
# misc
.DS_Store
*.pem

# Debug logs
# debug
npm-debug.log*
yarn-debug.log*
yarn-error.log*
Expand Down Expand Up @@ -193,7 +186,29 @@ psd
thumb
sketch

# End of https://www.toptal.com/developers/gitignore/api/nextjs,node,react
# End of https://www.toptal.com/developers/gitignore/api/react,node,nextjs

# Custom rules (everything added below won't be overriden by 'Generate .gitignore File' if you use 'Update' option)

# Sensitive files
backend/cookies.txt
**/cookies.txt
*.txt.cookies

# Environment files (keep .env files private!)
.env
**/.env
.env.local
.env.*.local

# Markdown documentation folder (contains internal notes)
markdown/
**/markdown/

# Uploads folder (user-generated content)
backend/uploads/
backend/src/uploads/
**/uploads/

# Docker volumes
mongodb_data/
55 changes: 39 additions & 16 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,31 +17,54 @@ Campus-Marketplace/
└── README.md
```

## 🚀 Getting Started
## 🚀 Quick Start

### Backend Setup
### Prerequisites

```bash
cd backend
npm install
cp .env.example .env # Configure your environment variables
npm run dev
```
- Docker Desktop (version 20.10+)
- Docker Compose (version 2.0+)
- Cloudinary account (free tier)

### Frontend Setup
### Setup

```bash
cd frontend
npm install
npm run dev
```
1. **Clone the repository:**

```bash
git clone <repository-url>
cd Campus-Marketplace
```

2. **Create environment file:**

```bash
cp .env.example .env
# Edit .env and add your credentials
```

3. **Start the application:**

```bash
docker-compose up -d
```

4. **Access the application:**
- Frontend: http://localhost:5173
- Backend API: http://localhost:3000/api
- Health Check: http://localhost:3000/api/healthcheck

📚 **For detailed setup instructions, see [SETUP.md](./SETUP.md)**

🔒 **For security information, see [SECURITY.md](./SECURITY.md)**

---

## 📦 Project Status

✅ **Backend**: Core API with authentication, listing management, and RBAC completed
🚧 **Frontend**: Basic layout structure completed, authentication system in progressmunity-first marketplace app for IIT Bhilai students — built _by the students, for the students_.
✅ **Backend**: Core API with authentication, listing management, image upload, and RBAC completed
✅ **Frontend**: Multi-step listing creation, authentication, image upload completed
✅ **Docker**: Full containerization with MongoDB, backend, and frontend
✅ **Security**: Environment-based configuration, no hardcoded credentials
🚧 **In Progress**: Additional features and UI improvementsmunity-first marketplace app for IIT Bhilai students — built _by the students, for the students_.

---

Expand Down
14 changes: 14 additions & 0 deletions backend/.dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
node_modules
npm-debug.log
.env
.git
.gitignore
README.md
.vscode
.idea
*.log
dist
coverage
.DS_Store
Dockerfile
docker-compose.yml
21 changes: 21 additions & 0 deletions backend/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
FROM node:20-alpine

# Install curl for healthcheck
RUN apk add --no-cache curl

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm install

# Copy source code
COPY . .

# Expose port
EXPOSE 3000

# Start the application
CMD ["npm", "run", "dev"]
6 changes: 6 additions & 0 deletions backend/cookies.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_localhost FALSE / TRUE 0 refreshToken eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2OTBiYTU1YmQ0NTg0ZGQyMjE1ZWViNGYiLCJpYXQiOjE3NjIzNzEwMzIsImV4cCI6MTc2Mjk3NTgzMn0.hwJcY8W_9jIbmIzU3P6XRdRKa_iui1zuKuJ8jcpK3B0
#HttpOnly_localhost FALSE / TRUE 0 accessToken eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2OTBiYTU1YmQ0NTg0ZGQyMjE1ZWViNGYiLCJlbWFpbCI6InRlc3RAaWl0YmhpbGFpLmFjLmluIiwidXNlcm5hbWUiOiJ0ZXN0c3R1ZGVudCIsInJvbGVzIjpbInN0dWRlbnQiXSwiaWF0IjoxNzYyMzcxMDMyLCJleHAiOjE3NjIzNzE5MzJ9.uwxgRd6-h4rI3WMOks3e3AxP64sbng3GjHtf1l5rFsA
Comment on lines +1 to +6
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

CRITICAL: Remove real JWT tokens from version control immediately.

This file contains actual JWT tokens that grant authentication access. Committing secrets to version control is a critical security vulnerability that can lead to unauthorized access.

Impact:

  • Anyone with repository access can decode and use these tokens
  • Tokens reveal user IDs and credentials in the payload
  • Compromises test account security

Required actions:

  1. Remove this file immediately using git rm --cached backend/cookies.txt
  2. Add cookies.txt and *.txt containing credentials to .gitignore
  3. Rotate/invalidate the exposed tokens
  4. Use environment variables or secure secret management instead

Apply this to .gitignore:

+# Cookie files with credentials
+backend/cookies.txt
+**/cookies.txt

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Gitleaks (8.28.0)

[high] 5-5: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.

(jwt)


[high] 6-6: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.

(jwt)

🤖 Prompt for AI Agents
In backend/cookies.txt around lines 1 to 6 there are real JWTs committed; remove
the file from the repo and stop tracking it, add an entry to .gitignore to
prevent future commits (e.g., cookies.txt and any pattern matching credential
files), and rotate/invalidate the exposed tokens immediately; replace the
committed secrets with secure handling (use environment variables or a secret
manager) and ensure the removal is done with git rm --cached so history doesn’t
continue tracking the file.

Loading