207 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
DO Siki	fd5e048c11	content: frissítve a CMS-ből	2026-08-19 15:29:22 +02:00
Do Siki	068e148da1	fix(cms): run publish deploy as direct child — detached spawn died under systemd ... Root-caused with systemd-run repros: under the unit's hardening flags the backgrounded grandchild ('cmd &' / setsid) died silently, so a CMS publish committed+pushed but never rebuilt the site (stale content, no deploy.log, no trace). A direct (non-detached) exec child provably survives the same flags; the response is sent first, output goes to deploy.log, and the callback's audit entry now reports real deploy completion (ok/error). Closes MITHOME-72	2026-08-19 15:27:51 +02:00
DO Siki	09228b6a6d	content: frissítve a CMS-ből	2026-08-19 15:17:00 +02:00
Do Siki	a29a1f461b	fix(cms): detach and audit the publish-triggered deploy (systemd-safe) ... A CMS publish's background deploy silently never ran under systemd (naive 'cmd &' child died with the spawning shell; no log, no trace — the site kept serving stale content). The spawn now uses setsid+nohup+stdin-null so it survives any parent exit, and writes deploy_spawned / deploy_exec_exit audit entries so a failed spawn can never be silent again. Closes MITHOME-72	2026-08-19 15:16:19 +02:00
DO Siki	219f5122bd	content: frissítve a CMS-ből	2026-08-19 15:03:37 +02:00
Do Siki	b0cd270dc5	sync: update TODO.md with MITHOME-71 (fresh version tag)	2026-08-19 14:41:19 +02:00
Do Siki	14a72a3ffe	fix(cms): keep version tag fresh — deploy restarts CMS, editor page no-store ... The version tag is the git SHA read at CMS startup, but the deploy script only rebuilt the website container, leaving the tag stale (v8838304 shown after aa8d926 was live). The local deploy script now restarts the CMS service after the server-side deploy (the CMS publish flow is unaffected — it calls deploy.sh directly and never restarts itself). The editor main page also gains Cache-Control: no-store so browsers stop caching it. Closes MITHOME-71	2026-08-19 14:38:40 +02:00
Do Siki	aa8d92646c	test(cms): run-unique markers so a crashed run cannot poison the next ... The versions integration test asserted against fixed marker strings; if a run crashed before restoring contact.json, the next run read the polluted file as its baseline and its expectations collapsed. Markers now carry a per-run timestamp.	2026-08-19 14:30:58 +02:00
Do Siki	c0579198f8	sync: update TODO.md with MITHOME-70 (pre-deploy test suite)	2026-08-19 14:16:04 +02:00
Do Siki	5db71998eb	feat(test): comprehensive pre-deploy test suite as single entry point ... scripts/pre-deploy-tests.sh runs every local test group before a deploy: proto unit (jest), content schema validation, all CMS integration suites (security, serializer, save, optimistic lock, versions, logo, login, logout, guide, bottom bar), publish command/integration and plane sync unit tests. Per-group PASS/FAIL summary; non-zero exit on any failure. deploy_to_stage_on_local.sh now runs the full suite as step 1 — a failing group aborts the release before push. Deploy workflow docs updated. Closes MITHOME-70	2026-08-19 14:15:33 +02:00
Do Siki	067b15c50e	sync: update TODO.md with MITHOME-68/69 (409 UX + stable bottom bar)	2026-08-19 14:05:54 +02:00
Do Siki	88383049d5	fix(cms): stable bottom bar and self-save no longer trips the 409 lock ... MITHOME-68: the optimistic-lock fingerprint was frozen at page load, so the user's own second save 409'd. /save now returns the hash of the written content and the client refreshes CONTENT_HASH on success — 409 only fires for genuine external changes (deploy, other tab, restore). Also: successful logins no longer consume the auth failure budget (only failed attempts do). MITHOME-69: bottom bar items no longer shift while saving/publishing — the status message occupies a constant flex slot (visibility instead of display), the publish button locks its width while running and restores its env-specific label, auto margins removed. Layout guard test added. Test markers are now run-unique so a crashed run can never poison the next one's expectations.	2026-08-19 14:04:49 +02:00
Do Siki	41a2259ede	sync: update TODO.md with MITHOME-67 (delete/reindex fix)	2026-08-19 13:31:56 +02:00
Do Siki	5d2141ec88	fix(cms): capture array container before node removal so reindex runs ... The ❌ delete buttons called wrap.closest('.array-items') AFTER remove(); a detached node has no ancestors, so closest() returned null and reindexItems() silently skipped. Remaining items kept their old indices, collect() produced sparse arrays (null holes) and saves failed schema validation, e.g. '$.details.services[1].specs.items[0]: string érték szükséges'. Capture the container before remove() for both str-item and obj-card delete handlers. Regression test runs the real browser script in jsdom and clicks the actual delete buttons (nested string array + object card reindexing). Closes MITHOME-67	2026-08-19 13:30:53 +02:00
Do Siki	19f2fdfece	refactor(cms): extract /versions and /restore route handling to cms-versions.js ... Companion to the cms-logo.js extraction: keeps content-editor.js under the 400-line hard limit. No behavior change — covered by test-content-editor-versions.js.	2026-08-19 12:47:24 +02:00
Do Siki	d2ee13bb91	feat(cms): logo upload with preview, backup and audit ... - 🎨 Logó page in the CMS bottom bar: replace the website header logo and the CMS login icon with a PNG upload (magic-byte validation, 1 MiB cap) - the replaced logo gets a timestamped backup in .content-backups; every upload is audited (logo_updated) - /logo.png?variant=header serves the header variant for the preview - publish stages proto/public too, so logo changes ride the same commit+deploy pipeline as content - route handling extracted to scripts/cms-logo.js to stay under the 400-line limit - integration test: upload+replace+backup, variant preview, 415/413/400, CSRF, auth Closes MITHOME-65	2026-08-19 12:46:55 +02:00
Do Siki	fe4a6a1e92	feat(footer): CMS-editable copyright with 2002–current year range ... The copyright text lived in site.ts with a build-time year and was not CMS-editable. It now lives in common.json (footer.copyright, editable via the Közös szövegek tab) with a {year} placeholder that resolves to the current year at render: '© 2002–{year} mozdIT Bt. Minden jog fenntartva.' Schema and types extended; site.ts keeps only the footer links. Closes MITHOME-66	2026-08-19 12:44:48 +02:00
Do Siki	03615d5959	sync: update TODO.md with MITHOME-64 (versions panel)	2026-08-18 23:46:13 +02:00
Do Siki	a55ce53768	feat(cms): version history panel with diff view and one-click restore ... - GET /versions lists the automatic backups of the selected file (timestamp, size); ?show=<backup> renders a line diff against the current content - POST /restore validates the backup against the content schema and restores it atomically; the pre-restore state gets a fresh backup first, so a restore itself is reversible; audited as version_restored - dependency-free LCS line diff (scripts/cms-diff.js) with add/del highlighting and context trimming; backup names validated against a strict pattern (path traversal impossible) - new 🕘 Verziók entry in the CMS bottom bar - refactor: security/infra helpers extracted to scripts/cms-core.js to keep content-editor.js under the 400-line hard limit - integration test: list, diff, restore + reversibility backup, traversal rejection, CSRF enforcement, auth Closes MITHOME-64	2026-08-18 23:45:39 +02:00
Do Siki	d15cc05c36	sync: update TODO.md with MITHOME-63 (deploy versioning)	2026-08-18 21:24:23 +02:00
Do Siki	e2a8ac13eb	fix(deploy): declare DEPLOY_VERSION ARG in the runner stage ... ENV does not carry across build stages: the value set in the builder never reached the running container, so /api/health reported deployVersion: null and SMOKE-01 failed. Re-declare the ARG in the runner stage.	2026-08-18 21:22:40 +02:00
Do Siki	3a5a09c361	feat: expose deploy version (git SHA) on CMS and health endpoint ... 'Is the fix live?' becomes a single check instead of an SSH session: - CMS: git short SHA read at startup, shown in the bottom bar (v<sha>), served by the public GET /version endpoint, recorded in a startup audit entry - Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it via build ARG into the runtime env, /api/health reports it as deployVersion, smoke test asserts a non-'unversioned' stamp Closes MITHOME-63	2026-08-18 21:19:43 +02:00
Do Siki	edd2e46ae3	sync: update TODO.md with MITHOME-62 (Safari-compatible auth)	2026-08-18 21:14:45 +02:00
Do Siki	a7b1a2cab2	fix(cms): Safari-compatible authentication ... Safari-specific deviations fixed: 1. Safari shows its native auth dialog on fetch() calls answered with a 401 + WWW-Authenticate challenge (e.g. save with an expired session). All CMS 401 responses now omit WWW-Authenticate; browsers use the styled /login page instead. 2. Safari caches Basic credentials and resends them automatically, which made logout ineffective (a navigation after logout went straight back into the editor). Browser navigations (GET + text/html) now authenticate ONLY via the session cookie; Basic Auth remains valid for non-browser clients (curl, API). 3. /login and redirects send Cache-Control: no-store so Safari does not cache the login page or the 302. Closes MITHOME-62	2026-08-18 21:14:12 +02:00
Do Siki	27b84cb87c	sync: update TODO.md with MITHOME-61 (optimistic locking)	2026-08-18 20:57:35 +02:00
Do Siki	3818859cc5	feat(cms): optimistic locking against stale-tab overwrites ... A Content Editor tab left open across a deploy (or a save from another tab) held the pre-deploy content; one Save would silently overwrite the newer file. The editor page now embeds a SHA-256 fingerprint of the file content at load time, /save requires it back in X-Content-Hash and compares against the current file: mismatch (or a missing header) answers 409 with an explanatory message and writes nothing. The client offers a reload on 409. Integration test covers: matching hash saves, stale hash rejected with the file untouched, missing hash rejected, retry with the fresh hash succeeds. Closes MITHOME-61	2026-08-18 20:57:08 +02:00
Do Siki	bdf9aac4d0	content: apply copy review — concrete, credible claims and CTAs ... - hero: state the actual offering (hosting, mail, domains) instead of a mission statement - security USP: list concrete measures instead of 'maximális teljesítmény' promise - hosting: replace '99% uptime garancia' with the 99.9% availability goal (excluding planned maintenance) — no absolute guarantee claim without SLA backing - email: encrypted webmail/IMAP access wording; domain: registration, renewal and DNS in one place; SPF/DKIM/DMARC explained by purpose - per-service CTA texts instead of the generic 'További információk' - main CTA: 'Kérjen személyre szabott konzultációt' (smoke test updated to match) - bottom CTA asks the visitor to describe their need briefly	2026-08-18 20:39:24 +02:00
DO Siki	e03662b620	content: frissítve a CMS-ből	2026-08-18 20:31:39 +02:00
Do Siki	fff834a48a	sync: update TODO.md with MITHOME-60 (publish hardening)	2026-08-18 20:25:45 +02:00
Do Siki	c4c89f644e	fix(cms): deploy only on real changes, abort failed rebases, test publish ... Review follow-up on MITHOME-59: - no-op publish no longer triggers a background deploy (deploy moved behind a deterministic hadChanges flag) - replace output-regex classification ('Already up to date.' also appears on real publishes when the remote did not move, which misclassified them as no_changes) with an explicit __NO_CONTENT_CHANGES__ marker echoed by the shell skip-branch - failed git pull --rebase is aborted immediately so the repo is never left mid-rebase; the error is reported and nothing is pushed or deployed - command + interpretation extracted to scripts/cms-publish.js - CONTENT_EDITOR_CONTENT_DIR / CONTENT_EDITOR_DEPLOY_CMD env overrides enable an integration test against throwaway git repos covering: no-change skip, real publish + deploy, rebase conflict abort - .gitignore: drop patterns already covered by .env.* - user guide: new no-changes message Closes MITHOME-60	2026-08-18 20:25:12 +02:00
Do Siki	8afc4e6899	sync: update TODO.md with MITHOME-59 (CMS publish fix)	2026-08-18 20:17:46 +02:00
Do Siki	84a4527838	fix(cms): robust git publish workflow and untracked env handling ... - add .env.staging and .env.production patterns to .gitignore so local env files are ignored - use robust publish command: git add . && (git diff --cached --quiet || git commit ...) && git pull --rebase origin main && git push origin main - expand no-changes detection in publish response handling Closes MITHOME-59	2026-08-18 20:17:35 +02:00
DO Siki	c2cc701032	content: frissítve a CMS-ből	2026-08-18 20:16:08 +02:00
Do Siki	e6a18630f2	sync: update TODO.md with MITHOME-58 (CMS login page)	2026-08-18 14:02:11 +02:00
Do Siki	5fe36584dd	feat(cms): confirm-before-logout and branded login page ... - logout asks for confirmation, then invalidates the server-side session and navigates to a public /login page (logo, form, error messages) - POST /login validates credentials (timing-safe) and issues an HttpOnly SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth stays valid in parallel for curl/API use - unauthenticated browser navigations redirect to /login; non-browser requests keep the 401 challenge - failed form logins share the auth rate-limit budget with Basic attempts - save/publish redirect to /login when the session expired - refactor: templates and browser script extracted to scripts/cms-pages.js and scripts/cms-editor-client.js, session logic to scripts/cms-session.js (content-editor.js back under the 400-line limit) - user guide updated (login page, confirmation, 8h session) Closes MITHOME-58	2026-08-18 14:01:42 +02:00
Do Siki	9880b5b1d5	docs: add /cms-feature workflow for CMS development ... Procedural companion to the steering rule: implementation constraints (no node_modules, CSRF, secret handling), mandatory guide update in the same commit, the CMS test suite to run, and staging restart + verification steps.	2026-08-18 13:29:56 +02:00
Do Siki	1d3abc8cba	feat(cms): add maintained user guide with Súgó menu entry ... - docs/felhasznaloi-utmutato.md: user guide for the website and the CMS (login, editing, arrays, save/validation, publish, security) - /guide endpoint renders the markdown auth-protected via a dependency-free renderer (scripts/markdown-render.js) in the CMS dark theme - new ❓ Súgó entry in the CMS bottom bar - steering rule: the guide must be updated in the same commit as any CMS or website feature change Closes MITHOME-57	2026-08-18 13:20:44 +02:00
Do Siki	8be8c2b552	sync: update TODO.md with MITHOME-56 (CMS logout)	2026-08-18 13:15:20 +02:00
Do Siki	1b45ae302c	feat(cms): add logout to Content Editor ... Basic Auth credentials are cached by the browser until it closes, so the editor had no real logout. Add a /logout endpoint (always answers 401 with a challenge; deliberately exempt from the auth rate limiter so logging out never locks the user out) and a Kilépés button that overwrites the cached credentials with an invalid pair via fetch, then reloads into the login prompt. Closes MITHOME-56	2026-08-18 13:14:49 +02:00
Do Siki	d1cf36bc48	docs: add mandatory secret-handling rule to steering documents ... Secrets must never be displayed in the conversation — communicate only their storage location; mask values when reading configs; verify auth via status codes instead of echoing credentials.	2026-08-18 13:08:03 +02:00
Do Siki	713d89b09c	fix(cms): reindex nested array paths correctly in Content Editor ... reindexItems replaced the FIRST [n] index in a data-path, which for nested arrays (e.g. services[1].specs.items) rewrote the OUTER array index instead of the item's own index. Deleting or adding an item scattered paths across services[0..n], produced sparse arrays (null items) and schema errors like '$.details.services[1].specs.items[0]: string érték szükséges'. Rewrite only the index directly following the reindexed array's path prefix; drop the now-redundant str-item special case. Closes MITHOME-30	2026-08-18 12:53:18 +02:00
Do Siki	afcbdc26bf	docs: update deploy workflow to current staging pipeline ... - document one-command local staging release (deploy_to_stage_on_local.sh) - add deploy.sh steps: mandatory env file, force-recreate, healthcheck - add CMS publish flow with explicit CMS_DEPLOY_ENV - note Gitea Actions is paused until a dedicated runner host exists - fix dev stack ports in local Docker section	2026-08-18 12:26:20 +02:00
Do Siki	50129d4b92	chore: ignore local PLATFM-1 plan document	2026-08-18 12:21:32 +02:00
Do Siki	bd7287aa58	fix: address code review findings from 2026-08-17 ... - scope no-cache headers to non-static routes (restore immutable asset caching) - reset cached rejected MongoDB promise so retries can succeed - use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing) - remove weak Mongo defaults from compose files (fail loudly on missing env) - move staging banner text to common.json content - read APP_PORT from env file in deploy.sh healthcheck - filter network noise from staging smoke console assertions Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54	2026-08-18 12:21:32 +02:00
DO Siki	93aaa10a36	content: frissítve a CMS-ből	2026-08-17 22:07:38 +02:00
Do Siki	a380bf2b5b	fix: keep browser chrome neutral on staging	2026-08-17 17:56:39 +02:00
Do Siki	148618b880	fix: keep staging marker in CMS only	2026-08-17 17:53:41 +02:00
Do Siki	f821b35b35	feat: mark staging website clearly	2026-08-17 17:48:05 +02:00
Do Siki	9ce420ef71	fix: limit cache bypass to browser revalidation	2026-08-17 17:42:37 +02:00
Do Siki	29b10c6770	feat: disable website caching	2026-08-17 17:37:36 +02:00