Security & Permissions

Authentication

Delegated to Supabase Auth. Backend verifies JWTs using SUPABASE_JWT_SECRET.

Role-Based Access Control (RBAC)

• Middleware endpoints check the decoded JWT role.
• Admin: Has full access. Filtered dashboard views.
• Recruiter: Job creation, pipeline viewing. Gated by require_recruiter dependency.
• Candidate: Restricted to own applications.

API Security

• Rate Limiting: Sliding-window rate limit via Redis.
• Idempotency: Critical endpoints support idempotency keys.
• CORS: Strictly bound to FRONTEND_URL.

Cost Controls & Limits

cost_meter.py implements a circuit breaker and strict token metering to prevent runaway LLM API usage.