BE-86: Implement Report Issue Intake API

[Ahmedxnn]

Closes #653

---

Summary

Implements a backend Report Issue Intake API to support contributor feedback/report modal surfaces on frontend and mobile. The API stores redacted context and attachment metadata with built-in abuse prevention.

Changes Made

New Module: report-issue

• Created complete module structure with types, DTOs, repository, service, and controller
• Submission schema includes environment fields (platform, version, locale, timezone, screen dimensions) and reproduction steps
• Attachment support via metadata references (actual files stored separately)

Data Privacy & Security

• Integrated existing RedactionService to automatically redact sensitive values (API keys, tokens, passwords, emails, IPs) before persistence
• IP addresses hashed with salt for privacy in abuse detection
• No plaintext sensitive data stored in database

Abuse Prevention

• IP-based rate limiting (configurable: 5 reports/hour, 20 reports/day)
• Configurable via environment variables: REPORT_ISSUE_MAX_PER_HOUR, REPORT_ISSUE_MAX_PER_DAY, REPORT_ISSUE_HASH_SALT
• Repository includes abuse detection methods

API Endpoints

• POST /report-issue - Submit issue report
• GET /report-issue/user/:userId - Get user's reports
• GET /report-issue/admin/all - Get all reports (admin)
• GET /report-issue/:reportId - Get specific report

Database

• Added Supabase migration 20260725000000_create_report_issues_table.sql
• Table includes indexes for user queries, abuse detection, and admin dashboard
• Privacy-safe design with IP hashing and redaction support

Testing

• Unit tests for service logic (submission, redaction, abuse limits, attachments)
• Unit tests for DTO validation

Configuration

• Added report issue config properties to env.schema.ts
• Added getters to app-config.service.ts
• Registered module in app.module.ts

Acceptance Criteria Met

• ✅ Frontend/mobile can submit structured issue reports to the backend
• ✅ Sensitive values are redacted before persistence
• ✅ Abuse limits prevent spammy submissions
• ✅ Admin retrieval support included

Files Changed

• 17 files added, 1,475 insertions
• New module: app/backend/src/report-issue/
• Updated: app/backend/src/config/, app/backend/src/app.module.ts
• Migration: app/backend/supabase/migrations/20260725000000_create_report_issues_table.sql

Testing Instructions

1. Apply database migration: supabase db push
2. Configure environment variables (optional - defaults provided)
3. Test submission endpoint with valid payload
4. Verify redaction by checking stored data
5. Test abuse limits by exceeding hourly/daily limits

[drips-wave]

@Ahmedxnn Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

Kindly fix failed workflow

[Cedarich]

@Ahmedxnn

[Cedarich]

Remove changes from backend.yml file

Thanks!

@Ahmedxnn