Skip to main content

🔒 Security, Testing, and Monitoring

Hey, Inner Journey guardians! This document outlines the essential principles guiding Inner Journey’s security, testing, and monitoring. These practices are crucial for maintaining a secure, reliable, and high-quality self-development platform, fostering trust among our users and coaches. Let’s keep the system robust! 💪

🛡️ Security Principles​

Ensuring the confidentiality, integrity, and availability of user data and platform services is paramount.

Authentication​

  • Firebase Auth: Secure user login via Firebase Authentication (email/password).
  • API Security: API endpoints require Authorization: Bearer <id_token>, verified server-side via Firebase Admin SDK to protect resources.

Data Protection​

  • Encryption: 🔒 Data encrypted at rest (Firestore) and in transit (HTTPS) to prevent unauthorized access.
  • Secrets Management: 🔑 Sensitive API keys (e.g., Firebase, Gemini AI) are managed securely using Google Cloud Secret Manager.

GDPR Compliance​

  • Consents: 📜 User consents are logged in the consents collection, including timestamps and specific policy versions agreed upon.
  • Data Deletion: 🗑️ Users have the right to request data deletion, which removes their information from relevant Firestore collections and other storage.
  • Data Retention: ⏱️ Audio/video interaction logs are automatically deleted after 90 days unless explicit consent for retention is renewed.

Access Control​

  • Firestore Security Rules: 🔐 Granular rules ensure users can only access their own data, while coaches can access data only for clients assigned to them.
  • Role-Based Access Control (RBAC): 👥 Coaches are granted specific permissions (e.g., managing programs, client activations) based on their role.

🧪 Testing Strategy​

A comprehensive testing approach ensures platform stability and functionality.

Test Types​

  • Unit Tests: Isolate and test individual code components (e.g., React UI components, FastAPI utility functions).
  • Integration Tests: Verify interactions between different parts of the system (e.g., API endpoint calls interacting with Firestore database).
  • Manual Testing: Validate end-to-end user flows and usability (e.g., user onboarding, journal entry creation, coach feedback features).

Tools​

  • ⚙️ Frontend: Jest and React Testing Library for unit and component testing.
  • ⚙️ Backend: Pytest for unit and integration testing of FastAPI endpoints and services.
  • ⚙️ CI/CD: GitHub Actions automatically runs the full test suite on every push to main branches.

Testing Process​

  • 🔄 Development: Developers write tests concurrently with feature code implementation.
  • 🔄 CI/CD Pipeline: Automated tests run on code commits, preventing deployment if tests fail.
  • 🔄 Pre-Release Validation: Key user flows and new features undergo manual testing before major releases.

📊 Monitoring and Error Handling​

Continuous monitoring and robust error handling help maintain platform health and user experience.

Monitoring​

  • 📈 Backend Performance: Google Cloud Monitoring tracks Cloud Run resource usage (CPU, memory), latency, and error rates.
  • 📈 Logging: Google Cloud Logging aggregates logs from API requests, backend services, errors, and system events for debugging and auditing.
  • 📈 Frontend Monitoring: (Planned) Integration with a service like Sentry for real-time frontend error tracking and performance monitoring.

Error Handling​

  • ⚠️ Backend: FastAPI endpoints return standard HTTP status codes (e.g., 400 Bad Request, 401 Unauthorized, 500 Internal Server Error) with descriptive JSON error messages. Graceful fallbacks are implemented for external dependencies like AI services (e.g., providing mock responses if Gemini AI fails).
  • ⚠️ Frontend: User-friendly error messages are displayed in the UI when operations fail (e.g., failed API calls show a notification with a retry option).
  • ⚠️ Logging: Critical errors on both frontend (planned) and backend are logged with sufficient context (e.g., stack traces, request IDs via Python logging module) to facilitate rapid troubleshooting.

For detailed implementations and code examples, please refer to the project repositories, particularly the backend services: GitHub: backend/services/.