Noxa_Jewellery

🕘 Morning Session
1. Bug Fix — VendorList Crash (Noxa-Jewellery-fe)
Issue: App crashed on load with ReferenceError: Cannot access 'sort' before initialization
File: src/components/VendorList.tsx (line 232)
Fix: Resolved JavaScript temporal dead zone issue caused by const sort being used before declaration
Status: ✅ Fixed
2. Code Security Review — Production Readiness Audit
Performed full security review of frontend and backend codebase
Generated audit report in table format covering all risk areas
Status: ✅ Completed
3. Sortable Header Color Fix (Noxa-Jewellery-fe)
Issue: Sortable column headers were not showing active/inactive color states correctly
Fix: Active sorted column now shows Noxa gold color; unsorted columns default to gray
Status: ✅ Fixed
4. ActionHistoryTooltip — Creator Name Styling
File: src/components/ActionHistoryTooltip.tsx
Change: "Created by" name now renders in Noxa brand gold color
Status: ✅ Fixed
🕛 Afternoon Session
5. Blog Hero Banner — Mobile Responsive Fix (Noxa_E_Comm_Fe)
Files: app/blogs/page.tsx · app/blogs/[slug]/page.tsx · app/faq/page.tsx
Issue: Banner image was too large in height and width on mobile devices
Fix: Reduced hero banner height and image dimensions for mobile breakpoints
Status: ✅ Fixed
6. Dynamic Metadata / SEO Tags (Noxa_E_Comm_Fe)
Files: app/blogs/layout.tsx · app/blogs/page.tsx · app/blogs/[slug]/page.tsx
Issue: Helmet/metadata tags were static — same title and description on all blog pages
Fix: Made <title>, <meta description> fully dynamic using page-level data (blog title, excerpt, category)
Status: ✅ Fixed
7. Mobile Delivery Location Modal Fix (Noxa_E_Comm_Fe)
File: components/layout/Header.tsx · components/layout/DeliveryLocationModal.tsx
Issue: Modal was appearing off-screen on mobile due to Header having transform: translateY which created a new stacking context
Fix: Implemented createPortal to render modal directly to document.body, added bottom-sheet mobile styling
Status: ✅ Fixed
8. Mobile Navigation — Blogs Added (Noxa_E_Comm_Fe)
File: components/layout/Header.tsx
Change: Added "Blogs" link to mobile nav menu and horizontal category bar
Status: ✅ Fixed
🕓 Evening Session
9. Price Display Fix — Double Currency Symbol (Noxa_E_Comm_Fe)
File: components/home/HomePromoSection.tsx
Issue: Price showed $$236 (double dollar sign) on product promo cards
Root Cause: Manual ${currencySymbol}${price} was prepending symbol to a value that sometimes already contained the currency symbol from the API
Fix: Replaced with Intl.NumberFormat using selectedCurrency — same pattern as HomeShowcase.tsx. Added numeric sanitizer (parseFloat(val.replace(/[^0-9.-]+/g, ''))) to strip any pre-existing symbols
Status: ✅ Fixed
10. Full Security Hardening — Backend (Noxa-Jewellery-be)
10a. Hardcoded Credentials Removed
File: src/blogs/blogs.service.ts
Removed hardcoded Zoho mail password fallback (bn5q9ecgD9dN)
Removed hardcoded admin email (info@suthratech.com) and password (noxa@123) from getOrCreateBlogAdmin()
Removed master password bypass isOriginalMasterPass === 'noxa@123' from login logic
File: src/blogs/schemas/blog-admin.schema.ts
Removed default: 'noxa@123' and default: 'info@suthratech.com' from Mongoose schema
Status: ✅ Fixed
10b. JWT Secret Hardcode Removed
File: src/app.module.ts
Removed || 'your_jwt_secret_key' fallback — now throws error if JWT_SECRET env var missing
Status: ✅ Fixed
10c. CORS Restricted (was origin: true = allow all)
File: src/main.ts
CORS now only allows origins listed in ALLOWED_ORIGINS env var
Requests with no origin (mobile apps, Postman) still allowed
Status: ✅ Fixed
10d. Swagger UI Hidden in Production
File: src/main.ts
Swagger only loads when NODE_ENV !== 'production'
Moved to /api/docs route (was exposed at root /api)
Status: ✅ Fixed
10e. Body Size Limit Reduced
File: src/main.ts
Reduced from 50mb to 10mb to mitigate DoS attack risk
Status: ✅ Fixed
10f. Strong Secrets Generated & .env Updated
File: .env
Generated cryptographically strong JWT_SECRET (96-char hex via crypto.randomBytes)
Generated strong BLOG_ADMIN_DEFAULT_PASS (auto-generated, replaces noxa@123)
Added NODE_ENV, ALLOWED_ORIGINS, BLOG_ADMIN_EMAIL env vars
Added ⚠️ ROTATE comments for Zoho, AWS, Twilio, Gmail credentials
Status: ✅ Done
11. Blog Admin Login Form — Credential Leak Fixed (Noxa-Jewellery-fe)
File: src/components/blog/BlogAdminGate.tsx
Issue: Login form was pre-filling info@suthratech.com and noxa@123 as default values — visible to anyone who opens the page
Changes:
Cleared useState defaults — fields now start empty
Removed all placeholder="(e.g. noxa@123)" hints
Removed info@suthratech.com from OTP toast messages and info text
Removed "Sign In with Original Password (noxa@123)" from button labels
Back to Login no longer pre-fills credentials into fields
Status: ✅ Fixed