feat: proteger PII de usuários e automatizar migrações

.env.example

@@ -11,6 +11,12 @@ GO_SCRAPER_URL=http://localhost:8081
 # Use uma string longa e secreta em ambientes reais.
 SESSION_SECRET=change-me-with-a-long-random-secret
 
+# Segurança / PII
+# ENCRYPTION_MASTER_KEY deve ter 32 bytes em hex, ou seja, 64 caracteres hex.
+ENCRYPTION_MASTER_KEY=
+ENCRYPTION_KEY_ID=default
+SEARCH_KEY=
+
 # CORS / frontend access
 CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
 

README.md

@@ -56,6 +56,7 @@ Objetivo de produto: fornecer uma base robusta para busca, filtragem e gestão d
 ├─ electron/                # Shell desktop
 ├─ docker-compose.yml       # App stack (frontend + backend + scraper-go)
 ├─ docker-compose.infra.yml # Infra stack (Postgres + Valkey)
+├─ docker-compose.migrate.yml # Migration job do backend
 └─ .github/workflows/ci.yml # CI
 ```
 
@@ -106,25 +107,13 @@ docker network create vagas-net
 
 Se a rede já existir, o Docker vai avisar e você pode seguir para o próximo passo.
 
-4. Suba Postgres e Valkey:
+4. Suba Postgres, Valkey, scraper, backend e frontend:
 
 ```bash
-docker compose -f docker-compose.infra.yml up -d
-```
-
-5. Suba scraper, backend e frontend:
-
-```bash
-docker compose up --build -d
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml up --build -d
 ```
 
-6. Aplique as migrations do backend:
-
-```bash
-docker compose exec backend npm run db:migrate
-```
-
-7. Acesse os serviços:
+5. Acesse os serviços:
 
 - Frontend: http://localhost:5173
 - Backend health: http://localhost:3001/health
@@ -272,31 +261,35 @@ Este projeto separa infraestrutura e aplicação em dois arquivos Compose:
 
 - `docker-compose.infra.yml`: Postgres + Valkey.
 - `docker-compose.yml`: scraper Go + backend + frontend.
+- `docker-compose.migrate.yml`: job de migrations do backend.
 
-Subir infraestrutura:
+Subir infraestrutura, migrations e aplicação:
 
 ```bash
-docker compose -f docker-compose.infra.yml up -d
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml up --build -d
 ```
 
-Subir aplicação:
+O serviço `migrate` executa `npm run db:migrate` e `npm run security:backfill-user-pii -- --write` depois que o Postgres fica saudável. O backend só inicia depois que esse job termina com sucesso.
+
+Se quiser subir apenas a infraestrutura:
 
 ```bash
-docker compose up --build -d
+docker compose -f docker-compose.infra.yml up -d
 ```
 
-Aplicar migrations:
+Se quiser subir a aplicação sem o job de migrations:
 
 ```bash
-docker compose exec backend npm run db:migrate
+docker compose up --build -d
 ```
 
 Ver logs:
 
 ```bash
-docker compose logs -f backend
-docker compose logs -f frontend
-docker compose logs -f scraper-go
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f migrate
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f backend
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f frontend
+docker compose -f docker-compose.infra.yml -f docker-compose.yml -f docker-compose.migrate.yml logs -f scraper-go
 ```
 
 Encerrar:
@@ -314,7 +307,7 @@ Dentro dos containers, serviços devem usar os nomes da rede Docker:
 - Valkey: `valkey:6379`
 - Scraper: `scraper-go:8081`
 
-Por isso o `docker-compose.yml` sobrescreve `DATABASE_URL`, `VALKEY_URL`, `GO_SCRAPER_URL` e `SCRAPER_URL` para os valores internos corretos.
+Por isso o `docker-compose.yml` e o `docker-compose.migrate.yml` sobrescrevem variáveis como `DATABASE_URL`, `VALKEY_URL`, `GO_SCRAPER_URL` e `SCRAPER_URL` para os valores internos corretos.
 
 Serviços padrão:
 

backend/.env.example

@@ -25,18 +25,15 @@ FRONTEND_URL=http://localhost:5173
 # Use uma string longa e secreta em ambientes reais.
 SESSION_SECRET=change-me-with-a-long-random-secret
 
+# Segurança / PII
+# ENCRYPTION_MASTER_KEY deve ter 32 bytes em hex, ou seja, 64 caracteres hex.
+ENCRYPTION_MASTER_KEY=
+ENCRYPTION_KEY_ID=default
+SEARCH_KEY=
+
 # CORS / frontend access
 CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
 
-# Search filters
-SEARCH_LOCATION=Brasil
-SEARCH_GEO_ID=106057199
-SEARCH_LANGUAGE=pt
-REMOTE_ONLY=true
-JOB_TYPES=C,F
-TIME_FILTER=r604800
-SEARCH_KEYWORDS=UX Designer,UI Designer,Product Manager,Product Owner
-
 # Database / cache for backend running locally outside Docker
 DATABASE_URL=postgresql://vagas:vagas@localhost:5432/vagas
 VALKEY_URL=redis://localhost:6379/0

backend/drizzle/0008_bent_thor.sql

@@ -0,0 +1,11 @@
+ALTER TABLE "credentials" ADD COLUMN "email_hash" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "first_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "last_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "display_name_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "email_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "email_hash" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "phone_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "cpf_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "cpf_hash" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "users_email_hash_unique" ON "users" USING btree ("email_hash");--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_email_hash_unique" UNIQUE("email_hash");

backend/drizzle/0009_encrypt_remaining_profile_fields.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "users" ADD COLUMN "avatar_url_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "technologies_encrypted" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "level_encrypted" text;