[eyooTech]

Description

This PR addresses several backend reliability, security, and consistency issues:

Changes

• Referral code security (Referral codes are generated with Math.random: guessable codes enable referral abuse #1091)

  • Replaced Math.random()-based referral code generation with cryptographically secure random generation.
  • Prevents predictable referral codes and reduces the risk of referral abuse.

• Notification authorization errors (NotificationsService throws bare Error: unauthorized markAsRead and delete return 500 instead of 403 #1092)

  • Replaced bare Error throws with the appropriate NestJS forbidden exception.
  • Unauthorized markAsRead and delete operations now correctly return HTTP 403 Forbidden instead of HTTP 500 Internal Server Error.

• Cache monitoring persistence (Cache monitoring counters are process-local: hit/miss metrics reset to zero on every restart #1093)

  • Updated cache monitoring metrics so hit/miss counters are no longer process-local.
  • Metrics now persist across application restarts instead of resetting to zero.

• Search history persistence (Search history is held in a process-local Map: history vanishes on restart and diverges across instances #1094)

  • Replaced the process-local Map used for search history with persistent storage.
  • Search history now survives application restarts and remains consistent across multiple application instances.

Issues

Closes #1091
Closes #1092
Closes #1093
Closes #1094

[drips-wave]

@eyooTech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM