14 Commits

Include renames

Author	SHA1	Message	Date
Do Siki	5fe36584dd	feat(cms): confirm-before-logout and branded login page ... - logout asks for confirmation, then invalidates the server-side session and navigates to a public /login page (logo, form, error messages) - POST /login validates credentials (timing-safe) and issues an HttpOnly SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth stays valid in parallel for curl/API use - unauthenticated browser navigations redirect to /login; non-browser requests keep the 401 challenge - failed form logins share the auth rate-limit budget with Basic attempts - save/publish redirect to /login when the session expired - refactor: templates and browser script extracted to scripts/cms-pages.js and scripts/cms-editor-client.js, session logic to scripts/cms-session.js (content-editor.js back under the 400-line limit) - user guide updated (login page, confirmation, 8h session) Closes MITHOME-58	2026-08-18 14:01:42 +02:00
Do Siki	1d3abc8cba	feat(cms): add maintained user guide with Súgó menu entry ... - docs/felhasznaloi-utmutato.md: user guide for the website and the CMS (login, editing, arrays, save/validation, publish, security) - /guide endpoint renders the markdown auth-protected via a dependency-free renderer (scripts/markdown-render.js) in the CMS dark theme - new ❓ Súgó entry in the CMS bottom bar - steering rule: the guide must be updated in the same commit as any CMS or website feature change Closes MITHOME-57	2026-08-18 13:20:44 +02:00
Do Siki	1b45ae302c	feat(cms): add logout to Content Editor ... Basic Auth credentials are cached by the browser until it closes, so the editor had no real logout. Add a /logout endpoint (always answers 401 with a challenge; deliberately exempt from the auth rate limiter so logging out never locks the user out) and a Kilépés button that overwrites the cached credentials with an invalid pair via fetch, then reloads into the login prompt. Closes MITHOME-56	2026-08-18 13:14:49 +02:00
Do Siki	713d89b09c	fix(cms): reindex nested array paths correctly in Content Editor ... reindexItems replaced the FIRST [n] index in a data-path, which for nested arrays (e.g. services[1].specs.items) rewrote the OUTER array index instead of the item's own index. Deleting or adding an item scattered paths across services[0..n], produced sparse arrays (null items) and schema errors like '$.details.services[1].specs.items[0]: string érték szükséges'. Rewrite only the index directly following the reindexed array's path prefix; drop the now-redundant str-item special case. Closes MITHOME-30	2026-08-18 12:53:18 +02:00
Do Siki	bd7287aa58	fix: address code review findings from 2026-08-17 ... - scope no-cache headers to non-static routes (restore immutable asset caching) - reset cached rejected MongoDB promise so retries can succeed - use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing) - remove weak Mongo defaults from compose files (fail loudly on missing env) - move staging banner text to common.json content - read APP_PORT from env file in deploy.sh healthcheck - filter network noise from staging smoke console assertions Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54	2026-08-18 12:21:32 +02:00
Do Siki	47179658e5	feat: mark staging CMS interface clearly	2026-08-17 17:34:14 +02:00
Do Siki	278c9a2545	fix: rate limit CMS clients by forwarded address	2026-08-17 17:31:31 +02:00
Do Siki	d355ce38a7	fix: make CMS publish environment explicit	2026-08-17 17:25:51 +02:00
Do Siki	0047e1b441	feat: harden content workflows and staging smoke tests	2026-08-17 16:08:57 +02:00
Do Siki	35e341d5b2	chore: rename Tartalom Szerkesztő to Content Editor	2026-08-17 13:52:29 +02:00
Do Siki	c71c692c6a	feat: add publish button to CMS for automated git push and deployment	2026-04-27 01:19:42 +02:00
Do Siki	649724de11	feat: add basic auth protection to CMS editor	2026-04-27 01:11:51 +02:00
Do Siki	ca56d4e477	feat: add legal pages to CMS editor	2026-04-27 00:01:32 +02:00
Do Siki	a6e626179d	feat: improve content editor and move hero config to JSON	2026-04-26 22:52:28 +02:00