feat(cms): version history panel with diff view and one-click restore

- GET /versions lists the automatic backups of the selected file (timestamp,
  size); ?show=<backup> renders a line diff against the current content
- POST /restore validates the backup against the content schema and restores
  it atomically; the pre-restore state gets a fresh backup first, so a
  restore itself is reversible; audited as version_restored
- dependency-free LCS line diff (scripts/cms-diff.js) with add/del
  highlighting and context trimming; backup names validated against a strict
  pattern (path traversal impossible)
- new 🕘 Verziók entry in the CMS bottom bar
- refactor: security/infra helpers extracted to scripts/cms-core.js to keep
  content-editor.js under the 400-line hard limit
- integration test: list, diff, restore + reversibility backup, traversal
  rejection, CSRF enforcement, auth

Closes MITHOME-64

scripts/test-content-editor-versions.js

@@ -0,0 +1,173 @@
+#!/usr/bin/env node
+
+/**
+ * Integration test for the CMS Versions panel (MITHOME-64):
+ *   1. GET /versions lists the backups of the file (auth required)
+ *   2. GET /versions?show=<backup> renders a diff vs the current content
+ *   3. POST /restore restores an older backup; the pre-restore state gets a
+ *      fresh backup too (restore is reversible)
+ *   4. path traversal backup names are rejected (400)
+ *   5. restore without CSRF is rejected (403)
+ */
+const assert = require('assert/strict');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const ROOT = path.join(__dirname, '..');
+const PORT = 4131;
+const BASE = `http://127.0.0.1:${PORT}`;
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-versions-'));
+const auditFile = path.join(tmp, 'audit.jsonl');
+
+const child = spawn('node', ['content-editor.js'], {
+  cwd: ROOT,
+  env: {
+    ...process.env,
+    CONTENT_EDITOR_PORT: String(PORT),
+    CONTENT_EDITOR_AUDIT_FILE: auditFile,
+    CMS_USER: 'versions-test-user',
+    CMS_PASS: 'versions-test-pass',
+    CMS_DEPLOY_ENV: 'staging',
+  },
+  stdio: 'ignore',
+});
+
+async function waitForServer(timeoutMs = 10000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      await fetch(`${BASE}/version`);
+      return;
+    } catch {
+      await new Promise(r => setTimeout(r, 200));
+    }
+  }
+  throw new Error('server did not start');
+}
+
+async function session() {
+  const login = await fetch(`${BASE}/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ user: 'versions-test-user', pass: 'versions-test-pass' }),
+  });
+  return (login.headers.get('set-cookie') || '').split(';')[0];
+}
+
+async function csrfOf(cookie) {
+  const page = await (await fetch(`${BASE}/?file=contact`, { headers: { Cookie: cookie } })).text();
+  return page.match(/CSRF_TOKEN = "([a-f0-9]+)"/)[1];
+}
+
+const hashOf = s => crypto.createHash('sha256').update(s.trim()).digest('hex');
+
+async function main() {
+  await waitForServer();
+  const cookie = await session();
+  const csrf = await csrfOf(cookie);
+  const contentFile = path.join(ROOT, 'proto', 'src', 'content', 'pages', 'contact.json');
+  const original = fs.readFileSync(contentFile, 'utf8');
+  const backupDir = path.join(ROOT, '.content-backups');
+  const testStartedAt = Date.now();
+
+  try {
+    // Create two saves → two backups of intermediate states
+    const v1 = JSON.parse(original);
+    v1.hero.subtitle = 'Verzió teszt #1';
+    const v2 = JSON.parse(original);
+    v2.hero.subtitle = 'Verzió teszt #2';
+
+    for (const variant of [v1, v2]) {
+      const res = await fetch(`${BASE}/save?file=contact`, {
+        method: 'POST',
+        headers: {
+          Cookie: cookie,
+          'Content-Type': 'application/json',
+          'X-CSRF-Token': csrf,
+          'X-Content-Hash': hashOf(fs.readFileSync(contentFile, 'utf8')),
+        },
+        body: JSON.stringify(variant, null, 2),
+      });
+      assert.equal(res.status, 200, 'seed save must succeed');
+    }
+    // restore the pristine original as the "current" state for the diff assertion
+    const third = await fetch(`${BASE}/save?file=contact`, {
+      method: 'POST',
+      headers: {
+        Cookie: cookie,
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': csrf,
+        'X-Content-Hash': hashOf(fs.readFileSync(contentFile, 'utf8')),
+      },
+      body: original,
+    });
+    assert.equal(third.status, 200);
+
+    // 1. versions page lists backups (names appear in the show= comparison links)
+    const versionsPage = await (await fetch(`${BASE}/versions?file=contact`, { headers: { Cookie: cookie } })).text();
+    assert.match(versionsPage, /Verziók/);
+    assert.match(versionsPage, /Visszaállítás/);
+    const names = [...versionsPage.matchAll(/restore\('([^']+)'\)/g)].map(m => m[1]);
+    assert.ok(names.length >= 3, `expected at least 3 backups, got ${names.length}`);
+    // backups of v1 (the oldest seeded state) — pick the one that contains subtitle #1
+    // (backups hold the state BEFORE each save: original, v1, v2)
+
+    // 2. diff view: pick the backup that holds "Verzió teszt #1" (created during
+    // this run) and compare it with the current (original) content
+    const backupHoldingV1 = fs.readdirSync(backupDir)
+      .filter(name => name.startsWith('contact.'))
+      .filter(name => fs.statSync(path.join(backupDir, name)).mtimeMs >= testStartedAt)
+      .find(name => fs.readFileSync(path.join(backupDir, name), 'utf8').includes('Verzió teszt #1'));
+    assert.ok(backupHoldingV1, 'seeded backup holding v1 must exist');
+
+    const diffPage = await (await fetch(`${BASE}/versions?file=contact&show=${backupHoldingV1}`, { headers: { Cookie: cookie } })).text();
+    assert.match(diffPage, /diff-del/, 'diff must contain removed lines (backup side)');
+    assert.match(diffPage, /diff-add/, 'diff must contain added lines (current side)');
+    assert.match(diffPage, /Verzió teszt #1/);
+
+    // 3. restore the v1 backup → file content becomes v1
+    const restore = await fetch(`${BASE}/restore?file=contact&backup=${backupHoldingV1}`, {
+      method: 'POST',
+      headers: { Cookie: cookie, 'X-CSRF-Token': csrf },
+    });
+    assert.equal(restore.status, 200);
+    assert.ok(fs.readFileSync(contentFile, 'utf8').includes('Verzió teszt #1'));
+
+    // restore created a new backup of the pre-restore state (reversibility)
+    const afterPage = await (await fetch(`${BASE}/versions?file=contact`, { headers: { Cookie: cookie } })).text();
+    const namesAfter = [...afterPage.matchAll(/restore\('([^']+)'\)/g)].map(m => m[1]);
+    assert.equal(namesAfter.length, names.length + 1, 'restore must back up the current state first');
+
+    // 4. traversal is rejected
+    const evil = await fetch(`${BASE}/restore?file=contact&backup=${encodeURIComponent('../../package.json')}`, {
+      method: 'POST',
+      headers: { Cookie: cookie, 'X-CSRF-Token': csrf },
+    });
+    assert.equal(evil.status, 400);
+
+    // 5. no CSRF → 403
+    const noCsrf = await fetch(`${BASE}/restore?file=contact&backup=${backupHoldingV1}`, {
+      method: 'POST',
+      headers: { Cookie: cookie },
+    });
+    assert.equal(noCsrf.status, 403);
+
+    // unauthenticated listing is redirected for browsers / 401 otherwise
+    const anon = await fetch(`${BASE}/versions?file=contact`);
+    assert.equal(anon.status, 401);
+
+    console.log('Content Editor versions panel test: OK');
+  } finally {
+    fs.writeFileSync(contentFile, original); // leave the repo pristine
+  }
+}
+
+main()
+  .catch(err => { console.error('❌', err.message); process.exitCode = 1; })
+  .finally(() => {
+    child.kill('SIGTERM');
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* best effort */ }
+  });