simoleo89
8abfe352ef
fix(security): authorize site uploads and harden tokens, media and request identity
2026-09-13 19:24:43 +02:00
simoleo89
b1ddda66ff
Revert "Merge pull request 'Complete Housekeeping migration and /ase cutover' ( #52 ) from codex/housekeeping-complete into main"
...
This reverts commit 488b6e57c4b506b4499a
2026-08-30 21:31:34 +02:00
simoleo89
2b8f73a91d
feat(housekeeping): cut over administration to ase
2026-08-30 20:35:22 +02:00
openhands
24bf8eabb9
refactor: remove dead code and unused exports
...
Delete proxy-auth.ts, types/index.ts, staff-user.ts+test, local-imports.ts+test (only used by their own tests). Remove unused foundation exports: sanitizeFilename, canonicalizeFormValue, canonicalizeFormData, ConflictError, getRequestStore, getClientIp, elapsed. Remove stale TODO comments from rank-authority.ts and notice.ts. Fix biome lint warnings in catalog-repair.ts.
2026-08-07 18:55:02 +02:00
simoleo89
b3245a18ea
fix: bootstrap admin CSRF tokens
2026-08-02 11:46:43 +02:00
openhands
17847545dd
Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging
...
- Remove .prettierrc (dead config, Biome replaces Prettier)
- Rename lighthouserc.json to lighthouserc.cjs with module.exports for ESM compat
- Add logger.warn to empty catch blocks in auth, register, site-settings, prisma-cache, redis, security, rate-limit
- Unify ActionResult type: action-helper.ts uses 'ok' consistent with safe-action-shared.ts
- Add noUnusedLocals + noUnusedParameters to tsconfig + fix 25 pre-existing unused vars
- Replace barrel export src/types/index.ts with direct @/types/common imports
- Make trustHost conditional (development only) in auth.ts
- Add pre-flight URL validation to update-Nitrov3.sh to catch image.library.url misconfigurations
- Improve NITRO_IMAGE_LIBRARY_URL content validation in pre-flight & post-compute checks
2026-07-26 20:28:11 +02:00
openhands
d5e3bc7875
refactor: mark dead exports with TODO, deduplicate field sanitization, fix import placement
2026-07-20 14:47:05 +02:00
simoleo89 and Cursor
557138e40b
fix: admin panel resiste a fallimento cookie CSRF
...
Il layout admin non deve crashare se cookies().set() fallisce (__Host-/Secure dietro proxy). Fallback su csrf-token, meta solo con token valido.
Co-authored-by: Cursor <[email protected]
2026-07-18 19:48:30 +02:00
simoleo89 and Cursor
2de3696993
Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.
...
Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.
Co-authored-by: Cursor <[email protected]
2026-07-18 19:38:42 +02:00
openhands
df38dccbf1
style: format code biome
2026-07-13 21:57:41 +02:00
openhands
8efd032cc6
style: format code with prettier agian
2026-07-13 21:41:52 +02:00
openhands
f6ad030c5b
Add EpicNext CMS foundation layer and fix critical security gaps
...
- Create src/lib/foundation/ (860 LOC, 9 files): typed action wrappers,
DbService with health checks, CSRF validation, safe redirects,
AsyncLocalStorage request tracing, branded types, reusable Zod schemas
- Migrate moderation.ts and user-settings.ts to foundation patterns
- Fix abuse-guard.ts: bound in-memory Maps with LRU eviction (was unbounded)
- Fix access-guard.ts: separate try/catch per check, log degradation
instead of blanket fail-open
- Replace raw redirect() calls with safeRedirect() in guard.ts and
permissions.ts to prevent open-redirect attacks
- Add CSRF validation to api-handler.ts for mutating methods
- Add canonicalizeFormData() utility for FormData input sanitization
2026-07-13 12:03:49 +02:00
simoleo89