openhands
7b249a7222
P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite
...
- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety
- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered
- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons
Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.
2026-10-12 17:42:19 +02:00
simoleo89
b1ddda66ff
Revert "Merge pull request 'Complete Housekeeping migration and /ase cutover' ( #52 ) from codex/housekeeping-complete into main"
...
This reverts commit 488b6e57c4b506b4499a
2026-08-30 21:31:34 +02:00
simoleo89
2b8f73a91d
feat(housekeeping): cut over administration to ase
2026-08-30 20:35:22 +02:00
simoleo89
3788ecd9f1
feat(housekeeping): deliver system vertical
2026-08-28 23:31:47 +02:00
simoleo89 and Cursor
725e1cb338
feat(ops): health-fail alerts, optional DB backup, admin UX polish
...
Wire jobs-worker health probes to Discord/email alerts with cooldown, optional mysqldump, rate-limit /api/health, mark-all-read alerts, ConfirmDialog on destructive admin actions, and raise coverage floors.
Co-authored-by: Cursor <[email protected]
2026-08-01 15:25:47 +02:00
simoleo89 and Cursor
0e89d03940
Finish fine-grained ACL across remaining admin pages and actions.
...
Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.
Co-authored-by: Cursor <[email protected]
2026-07-15 20:15:22 +02:00
openhands
df38dccbf1
style: format code biome
2026-07-13 21:57:41 +02:00
openhands
8efd032cc6
style: format code with prettier agian
2026-07-13 21:41:52 +02:00
openhands
e5ae51bff7
Add NFC normalization to all FormData inputs across 41 server actions
...
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
2026-07-13 12:21:37 +02:00
simoleo89
5b4228261a
Reapply "Add missing admin action files and navigation links"
...
This reverts commit 4d515bc400
2026-07-11 20:52:56 +02:00
simoleo89
4d515bc400
Revert "Add missing admin action files and navigation links"
...
This reverts commit 41be6835bf
2026-07-11 20:37:56 +02:00
openhands
41be6835bf
Add missing admin action files and navigation links
...
- Add 11 missing server action files: badges, bulk-users, catalog, catalog-bc, catalog-items, import-badges, import-furni, multi-account-detect, permissions, rooms, soundtracks
- Add missing admin navigation links: tickets, sounds, translations, import, radio sub-pages
- Add translation keys for all new navigation items
2026-07-11 12:01:05 +02:00
simoleo89
486ce51559
Add social login (Discord/Google) + batch-6 pages
...
Auth: NextAuth Discord + Google providers (enabled when env id+secret set);
OAuth signIn allowed only if a hotel account matches the email; jwt binds the
session to that account (id/rank/username). Login page gets social buttons.
Batch 6 (parallel agents): /friends (messenger_friendships), /guilds/[id]/forum
(threads), /admin/navigation (navigator config), /admin/maintenance (toggle
maintenance settings), /admin/alerts (alert_logs + send hotel alert via RCON).
Header (Friends) + admin nav (Alerts/Maintenance/Navigator) extended.
Verified: tsc exit 0, vitest 48/48, next build exit 0 (57 page routes).
2026-06-28 14:13:41 +02:00
openhands