+
+ {/* Pipeline Overview */}
- AI CV Parsing
+ Pipeline Overview
-
- Upload CVs and automatically extract candidate information — skills, experience, education — using AI parsing.
-
- Go to Candidates →
+ {pipeline.applied + pipeline.screening + pipeline.interview + pipeline.offer + pipeline.hired === 0 ? (
+
+
No candidates in pipeline yet.
+
Add your first candidate →
+
+ {pipelineStages.map(stage => (
+
+
{stage.label}
+
+
{pipeline[stage.key as keyof PipelineSummary]}
+
+ ))}
+
+
+ {/* Recent Activity */}
- Multi-Channel Job Posting
+ Recent Activity
-
- Post jobs to LinkedIn, Indeed, Arbetsförmedlingen, and your company career page with a single click.
-
- Go to Jobs →
+ {activities.length === 0 ? (
+
+
No activity yet. Start by posting a job or adding a candidate.
+
+ {activities.map((activity, i) => (
+
+
+
{activity.title}
+
{activityTypeLabel[activity.type] || activity.type}{activity.subtitle ? ` — ${activity.subtitle}` : ''}
+
+
+ {new Date(activity.timestamp).toLocaleDateString()}
+
+
+ ))}
+
-
-
- Collaborative Scorecards
-
-
-
- Multiple interviewers score candidates using standardized criteria for consistent, unbiased evaluations.
-
- Go to Scorecards →
+
+
+ {/* Quick Actions */}
+
+
+
+
+ 💼
+ Post a Job
+ Publish to LinkedIn, Indeed, and more
+
+
+
+
+
+
+ 👤
+ Add Candidate
+ Upload CV or enter details manually
+
+
+
+
+
+
+ 📋
+ Create Scorecard
+ Evaluate and compare candidates
+
diff --git a/client/src/pages/Login.tsx b/client/src/pages/Login.tsx
new file mode 100644
index 0000000..d8005f8
--- /dev/null
+++ b/client/src/pages/Login.tsx
@@ -0,0 +1,86 @@
+import { useState } from 'react'
+import { useNavigate, Link } from 'react-router-dom'
+import { useAuth } from '@/lib/auth'
+import { Card, CardHeader, CardTitle, CardContent, CardFooter } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+
+export default function LoginPage() {
+ const { login } = useAuth()
+ const navigate = useNavigate()
+ const [email, setEmail] = useState('')
+ const [password, setPassword] = useState('')
+ const [error, setError] = useState('')
+ const [loading, setLoading] = useState(false)
+
+ async function handleSubmit(e: React.FormEvent) {
+ e.preventDefault()
+ setError('')
+ setLoading(true)
+ try {
+ await login(email, password)
+ navigate('/')
+ } catch (err: any) {
+ setError(err.message)
+ } finally {
+ setLoading(false)
+ }
+ }
+
+ return (
+
+
+
+
HireFlow
+
AI Recruitment Platform
+
+
+
+ Sign in to your account
+
+
+
+
+
+ )
+}
diff --git a/client/src/pages/Register.tsx b/client/src/pages/Register.tsx
new file mode 100644
index 0000000..50e08dd
--- /dev/null
+++ b/client/src/pages/Register.tsx
@@ -0,0 +1,89 @@
+import { useState } from 'react'
+import { useNavigate, Link } from 'react-router-dom'
+import { useAuth } from '@/lib/auth'
+import { Card, CardHeader, CardTitle, CardContent, CardFooter } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Label } from '@/components/ui/label'
+
+export default function RegisterPage() {
+ const { register } = useAuth()
+ const navigate = useNavigate()
+ const [email, setEmail] = useState('')
+ const [password, setPassword] = useState('')
+ const [confirmPassword, setConfirmPassword] = useState('')
+ const [role, setRole] = useState('recruiter')
+ const [error, setError] = useState('')
+ const [loading, setLoading] = useState(false)
+
+ async function handleSubmit(e: React.FormEvent) {
+ e.preventDefault()
+ setError('')
+ if (password !== confirmPassword) { setError('Passwords do not match'); return }
+ if (password.length < 8) { setError('Password must be at least 8 characters'); return }
+ setLoading(true)
+ try {
+ await register(email, password, role)
+ navigate('/login?registered=1')
+ } catch (err: any) {
+ setError(err.message)
+ } finally {
+ setLoading(false)
+ }
+ }
+
+ return (
+
+
+
+
HireFlow
+
AI Recruitment Platform
+
+
+
+ Create your account
+
+
+
+
+
+ )
+}
diff --git a/package-lock.json b/package-lock.json
index 9ee6f15..053b8dc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,8 +9,11 @@
"version": "1.0.0",
"hasInstallScript": true,
"dependencies": {
+ "bcryptjs": "^3.0.3",
"cors": "^2.8.5",
"express": "^4.18.2",
+ "jsonwebtoken": "^9.0.3",
+ "multer": "^1.4.5-lts.1",
"pg": "^8.11.3",
"redis": "^4.6.12"
},
@@ -141,6 +144,11 @@
"node": ">= 8"
}
},
+ "node_modules/append-field": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/append-field/-/append-field-1.0.0.tgz",
+ "integrity": "sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw=="
+ },
"node_modules/array-flatten": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
@@ -154,6 +162,14 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/bcryptjs": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/bcryptjs/-/bcryptjs-3.0.3.tgz",
+ "integrity": "sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==",
+ "bin": {
+ "bcrypt": "bin/bcrypt"
+ }
+ },
"node_modules/binary-extensions": {
"version": "2.3.0",
"resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
@@ -215,6 +231,27 @@
"node": ">=8"
}
},
+ "node_modules/buffer-equal-constant-time": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+ "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="
+ },
+ "node_modules/buffer-from": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+ "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
+ },
+ "node_modules/busboy": {
+ "version": "1.6.0",
+ "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
+ "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
+ "dependencies": {
+ "streamsearch": "^1.1.0"
+ },
+ "engines": {
+ "node": ">=10.16.0"
+ }
+ },
"node_modules/bytes": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -359,6 +396,20 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/concat-stream": {
+ "version": "1.6.2",
+ "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
+ "integrity": "sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==",
+ "engines": [
+ "node >= 0.8"
+ ],
+ "dependencies": {
+ "buffer-from": "^1.0.0",
+ "inherits": "^2.0.3",
+ "readable-stream": "^2.2.2",
+ "typedarray": "^0.0.6"
+ }
+ },
"node_modules/concurrently": {
"version": "8.2.2",
"resolved": "https://registry.npmjs.org/concurrently/-/concurrently-8.2.2.tgz",
@@ -423,6 +474,11 @@
"integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
"license": "MIT"
},
+ "node_modules/core-util-is": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+ "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ=="
+ },
"node_modules/cors": {
"version": "2.8.6",
"resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
@@ -499,6 +555,14 @@
"node": ">= 0.4"
}
},
+ "node_modules/ecdsa-sig-formatter": {
+ "version": "1.0.11",
+ "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
+ "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
+ "dependencies": {
+ "safe-buffer": "^5.0.1"
+ }
+ },
"node_modules/ee-first": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -920,6 +984,56 @@
"node": ">=0.12.0"
}
},
+ "node_modules/isarray": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+ "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="
+ },
+ "node_modules/jsonwebtoken": {
+ "version": "9.0.3",
+ "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+ "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+ "dependencies": {
+ "jws": "^4.0.1",
+ "lodash.includes": "^4.3.0",
+ "lodash.isboolean": "^3.0.3",
+ "lodash.isinteger": "^4.0.4",
+ "lodash.isnumber": "^3.0.3",
+ "lodash.isplainobject": "^4.0.6",
+ "lodash.isstring": "^4.0.1",
+ "lodash.once": "^4.0.0",
+ "ms": "^2.1.1",
+ "semver": "^7.5.4"
+ },
+ "engines": {
+ "node": ">=12",
+ "npm": ">=6"
+ }
+ },
+ "node_modules/jsonwebtoken/node_modules/ms": {
+ "version": "2.1.3",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+ },
+ "node_modules/jwa": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+ "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+ "dependencies": {
+ "buffer-equal-constant-time": "^1.0.1",
+ "ecdsa-sig-formatter": "1.0.11",
+ "safe-buffer": "^5.0.1"
+ }
+ },
+ "node_modules/jws": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+ "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+ "dependencies": {
+ "jwa": "^2.0.1",
+ "safe-buffer": "^5.0.1"
+ }
+ },
"node_modules/lodash": {
"version": "4.17.23",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
@@ -927,6 +1041,41 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/lodash.includes": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
+ "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w=="
+ },
+ "node_modules/lodash.isboolean": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
+ "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg=="
+ },
+ "node_modules/lodash.isinteger": {
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
+ "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA=="
+ },
+ "node_modules/lodash.isnumber": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
+ "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw=="
+ },
+ "node_modules/lodash.isplainobject": {
+ "version": "4.0.6",
+ "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+ "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA=="
+ },
+ "node_modules/lodash.isstring": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
+ "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw=="
+ },
+ "node_modules/lodash.once": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+ "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg=="
+ },
"node_modules/math-intrinsics": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -1009,12 +1158,49 @@
"node": "*"
}
},
+ "node_modules/minimist": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+ "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/mkdirp": {
+ "version": "0.5.6",
+ "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+ "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+ "dependencies": {
+ "minimist": "^1.2.6"
+ },
+ "bin": {
+ "mkdirp": "bin/cmd.js"
+ }
+ },
"node_modules/ms": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
"integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
"license": "MIT"
},
+ "node_modules/multer": {
+ "version": "1.4.5-lts.2",
+ "resolved": "https://registry.npmjs.org/multer/-/multer-1.4.5-lts.2.tgz",
+ "integrity": "sha512-VzGiVigcG9zUAoCNU+xShztrlr1auZOlurXynNvO9GiWD1/mTBbUljOKY+qMeazBqXgRnjzeEgJI/wyjJUHg9A==",
+ "deprecated": "Multer 1.x is impacted by a number of vulnerabilities, which have been patched in 2.x. You should upgrade to the latest 2.x version.",
+ "dependencies": {
+ "append-field": "^1.0.0",
+ "busboy": "^1.0.0",
+ "concat-stream": "^1.5.2",
+ "mkdirp": "^0.5.4",
+ "object-assign": "^4.1.1",
+ "type-is": "^1.6.4",
+ "xtend": "^4.0.0"
+ },
+ "engines": {
+ "node": ">= 6.0.0"
+ }
+ },
"node_modules/negotiator": {
"version": "0.6.3",
"resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
@@ -1300,6 +1486,11 @@
"node": ">=0.10.0"
}
},
+ "node_modules/process-nextick-args": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+ "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="
+ },
"node_modules/proxy-addr": {
"version": "2.0.7",
"resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
@@ -1359,6 +1550,25 @@
"node": ">= 0.8"
}
},
+ "node_modules/readable-stream": {
+ "version": "2.3.8",
+ "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+ "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+ "dependencies": {
+ "core-util-is": "~1.0.0",
+ "inherits": "~2.0.3",
+ "isarray": "~1.0.0",
+ "process-nextick-args": "~2.0.0",
+ "safe-buffer": "~5.1.1",
+ "string_decoder": "~1.1.1",
+ "util-deprecate": "~1.0.1"
+ }
+ },
+ "node_modules/readable-stream/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+ },
"node_modules/readdirp": {
"version": "3.6.0",
"resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -1439,7 +1649,6 @@
"version": "7.7.4",
"resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
"integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
- "dev": true,
"license": "ISC",
"bin": {
"semver": "bin/semver.js"
@@ -1621,6 +1830,27 @@
"node": ">= 0.8"
}
},
+ "node_modules/streamsearch": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
+ "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
+ "engines": {
+ "node": ">=10.0.0"
+ }
+ },
+ "node_modules/string_decoder": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+ "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+ "dependencies": {
+ "safe-buffer": "~5.1.0"
+ }
+ },
+ "node_modules/string_decoder/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+ },
"node_modules/string-width": {
"version": "4.2.3",
"resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
@@ -1727,6 +1957,11 @@
"node": ">= 0.6"
}
},
+ "node_modules/typedarray": {
+ "version": "0.0.6",
+ "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
+ "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA=="
+ },
"node_modules/undefsafe": {
"version": "2.0.5",
"resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",
@@ -1743,6 +1978,11 @@
"node": ">= 0.8"
}
},
+ "node_modules/util-deprecate": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+ "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="
+ },
"node_modules/utils-merge": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
diff --git a/package.json b/package.json
index ec43a05..8a71bf7 100644
--- a/package.json
+++ b/package.json
@@ -13,14 +13,16 @@
"dev:client": "cd client && npm run dev"
},
"dependencies": {
- "express": "^4.18.2",
- "pg": "^8.11.3",
- "redis": "^4.6.12",
+ "bcryptjs": "^3.0.3",
"cors": "^2.8.5",
- "multer": "^1.4.5-lts.1"
+ "express": "^4.18.2",
+ "jsonwebtoken": "^9.0.3",
+ "multer": "^1.4.5-lts.1",
+ "pg": "^8.11.3",
+ "redis": "^4.6.12"
},
"devDependencies": {
- "nodemon": "^3.0.2",
- "concurrently": "^8.2.2"
+ "concurrently": "^8.2.2",
+ "nodemon": "^3.0.2"
}
}
diff --git a/server.js b/server.js
index 3942361..2c3804b 100644
--- a/server.js
+++ b/server.js
@@ -4,9 +4,14 @@ const redis = require('redis');
const path = require('path');
const multer = require('multer');
const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } });
+const jwt = require('jsonwebtoken');
+const bcryptjs = require('bcryptjs');
+const bcrypt = bcryptjs;
const app = express();
const PORT = process.env.PORT || 3000;
+const JWT_SECRET = process.env.JWT_SECRET || 'hireflow-secret-key-change-in-production';
+const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'hireflow-refresh-secret-change-in-production';
app.use(express.json());
@@ -83,6 +88,27 @@ async function initDb() {
created_at TIMESTAMP DEFAULT NOW(),
UNIQUE(job_id, candidate_id)
);
+
+ CREATE TABLE IF NOT EXISTS users (
+ id SERIAL PRIMARY KEY,
+ email VARCHAR(255) UNIQUE NOT NULL,
+ password_hash VARCHAR(255) NOT NULL,
+ role VARCHAR(50) NOT NULL DEFAULT 'recruiter',
+ agency_id INTEGER,
+ is_active BOOLEAN DEFAULT true,
+ created_at TIMESTAMP DEFAULT NOW(),
+ updated_at TIMESTAMP DEFAULT NOW(),
+ deleted_at TIMESTAMP
+ );
+
+ CREATE TABLE IF NOT EXISTS refresh_tokens (
+ id SERIAL PRIMARY KEY,
+ user_id INTEGER REFERENCES users(id),
+ token_hash VARCHAR(255) NOT NULL,
+ expires_at TIMESTAMP NOT NULL,
+ revoked_at TIMESTAMP,
+ created_at TIMESTAMP DEFAULT NOW()
+ );
`);
console.log('Database schema initialized');
} catch (err) {
@@ -136,6 +162,187 @@ function parseCV(text) {
};
}
+// Auth middleware
+function authenticateToken(req, res, next) {
+ const authHeader = req.headers['authorization'];
+ const token = authHeader && authHeader.split(' ')[1];
+ if (!token) return res.status(401).json({ error: 'Access token required' });
+ try {
+ const user = jwt.verify(token, JWT_SECRET);
+ req.user = user;
+ next();
+ } catch (err) {
+ return res.status(401).json({ error: 'Invalid or expired token' });
+ }
+}
+
+function requireRole(...roles) {
+ return (req, res, next) => {
+ if (!req.user || !roles.includes(req.user.role)) {
+ return res.status(403).json({ error: 'Insufficient permissions' });
+ }
+ next();
+ };
+}
+
+// POST /auth/register
+app.post('/auth/register', async (req, res) => {
+ try {
+ const { email, password, role } = req.body;
+ if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
+ const allowedRoles = ['admin', 'recruiter', 'hiring_manager'];
+ const userRole = allowedRoles.includes(role) ? role : 'recruiter';
+ const passwordHash = await bcrypt.hash(password, 12);
+ const result = await pool.query(
+ 'INSERT INTO users (email, password_hash, role) VALUES ($1, $2, $3) RETURNING id, email, role, created_at',
+ [email.toLowerCase(), passwordHash, userRole]
+ );
+ res.status(201).json({ success: true, user: result.rows[0] });
+ } catch (err) {
+ if (err.code === '23505') return res.status(409).json({ error: 'Email already registered' });
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// POST /auth/login
+app.post('/auth/login', async (req, res) => {
+ try {
+ const { email, password } = req.body;
+ if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
+ const result = await pool.query('SELECT * FROM users WHERE email = $1 AND deleted_at IS NULL', [email.toLowerCase()]);
+ if (!result.rows.length) return res.status(401).json({ error: 'Invalid credentials' });
+ const user = result.rows[0];
+ if (!user.is_active) return res.status(401).json({ error: 'Account is disabled' });
+ const valid = await bcrypt.compare(password, user.password_hash);
+ if (!valid) return res.status(401).json({ error: 'Invalid credentials' });
+ const accessToken = jwt.sign({ id: user.id, email: user.email, role: user.role }, JWT_SECRET, { expiresIn: '15m' });
+ const refreshToken = jwt.sign({ id: user.id }, JWT_REFRESH_SECRET, { expiresIn: '7d' });
+ const refreshHash = await bcrypt.hash(refreshToken, 10);
+ const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+ await pool.query('INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES ($1, $2, $3)', [user.id, refreshHash, expiresAt]);
+ res.json({ success: true, accessToken, refreshToken, user: { id: user.id, email: user.email, role: user.role } });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// POST /auth/refresh
+app.post('/auth/refresh', async (req, res) => {
+ try {
+ const { refreshToken } = req.body;
+ if (!refreshToken) return res.status(401).json({ error: 'Refresh token required' });
+ let payload;
+ try { payload = jwt.verify(refreshToken, JWT_REFRESH_SECRET); } catch { return res.status(401).json({ error: 'Invalid refresh token' }); }
+ const tokens = await pool.query('SELECT * FROM refresh_tokens WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > NOW()', [payload.id]);
+ let validToken = null;
+ for (const t of tokens.rows) {
+ if (await bcrypt.compare(refreshToken, t.token_hash)) { validToken = t; break; }
+ }
+ if (!validToken) return res.status(401).json({ error: 'Invalid or expired refresh token' });
+ const user = await pool.query('SELECT id, email, role FROM users WHERE id = $1 AND is_active = true AND deleted_at IS NULL', [payload.id]);
+ if (!user.rows.length) return res.status(401).json({ error: 'User not found' });
+ const accessToken = jwt.sign({ id: user.rows[0].id, email: user.rows[0].email, role: user.rows[0].role }, JWT_SECRET, { expiresIn: '15m' });
+ res.json({ success: true, accessToken, user: user.rows[0] });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// POST /auth/logout
+app.post('/auth/logout', authenticateToken, async (req, res) => {
+ try {
+ await pool.query('UPDATE refresh_tokens SET revoked_at = NOW() WHERE user_id = $1 AND revoked_at IS NULL', [req.user.id]);
+ res.json({ success: true });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// GET /auth/me
+app.get('/auth/me', authenticateToken, async (req, res) => {
+ try {
+ const result = await pool.query('SELECT id, email, role, agency_id, is_active, created_at FROM users WHERE id = $1 AND deleted_at IS NULL', [req.user.id]);
+ if (!result.rows.length) return res.status(404).json({ error: 'User not found' });
+ res.json(result.rows[0]);
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// GET /api/users (admin only)
+app.get('/api/users', authenticateToken, requireRole('admin'), async (req, res) => {
+ try {
+ const result = await pool.query('SELECT id, email, role, agency_id, is_active, created_at FROM users WHERE deleted_at IS NULL ORDER BY created_at DESC');
+ res.json({ users: result.rows });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// PATCH /api/users/:id/role (admin only)
+app.patch('/api/users/:id/role', authenticateToken, requireRole('admin'), async (req, res) => {
+ try {
+ const { role } = req.body;
+ const allowedRoles = ['admin', 'recruiter', 'hiring_manager'];
+ if (!allowedRoles.includes(role)) return res.status(400).json({ error: 'Invalid role' });
+ const result = await pool.query('UPDATE users SET role = $1, updated_at = NOW() WHERE id = $2 AND deleted_at IS NULL RETURNING id, email, role', [role, req.params.id]);
+ if (!result.rows.length) return res.status(404).json({ error: 'User not found' });
+ res.json({ success: true, user: result.rows[0] });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+// Add dashboard endpoints
+app.get('/api/dashboard/metrics', authenticateToken, async (req, res) => {
+ try {
+ const [candidates, jobs, applications, interviews] = await Promise.all([
+ pool.query('SELECT COUNT(*) FROM candidates'),
+ pool.query("SELECT COUNT(*) FROM jobs WHERE status = 'posted'"),
+ pool.query('SELECT COUNT(*) FROM job_applications'),
+ pool.query("SELECT COUNT(*) FROM scorecards WHERE created_at >= NOW() - INTERVAL '7 days'"),
+ ]);
+ res.json({
+ totalCandidates: parseInt(candidates.rows[0].count),
+ activeJobs: parseInt(jobs.rows[0].count),
+ totalApplications: parseInt(applications.rows[0].count),
+ interviewsThisWeek: parseInt(interviews.rows[0].count),
+ });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+app.get('/api/dashboard/pipeline-summary', authenticateToken, async (req, res) => {
+ try {
+ const result = await pool.query('SELECT stage, COUNT(*) as count FROM job_applications GROUP BY stage');
+ const stages = { applied: 0, screening: 0, interview: 0, offer: 0, hired: 0 };
+ result.rows.forEach(r => { if (stages.hasOwnProperty(r.stage)) stages[r.stage] = parseInt(r.count); });
+ res.json(stages);
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
+app.get('/api/dashboard/recent-activity', authenticateToken, async (req, res) => {
+ try {
+ const result = await pool.query(`
+ SELECT 'candidate_added' as type, c.name as title, c.email as subtitle, c.created_at as timestamp
+ FROM candidates c
+ UNION ALL
+ SELECT 'job_posted' as type, j.title, j.location as subtitle, j.created_at as timestamp
+ FROM jobs j
+ UNION ALL
+ SELECT 'application' as type, c.name as title, jo.title as subtitle, ja.created_at as timestamp
+ FROM job_applications ja JOIN candidates c ON ja.candidate_id = c.id JOIN jobs jo ON ja.job_id = jo.id
+ ORDER BY timestamp DESC LIMIT 10
+ `);
+ res.json({ activities: result.rows });
+ } catch (err) {
+ res.status(500).json({ error: err.message });
+ }
+});
+
// Health check
app.get('/health', async (req, res) => {
try {