73 Commits

Include renames

Author	SHA1	Message	Date
Do SikiandClaude Sonnet 5	8407b45367	feat(cms): Users access control + lockout policy (MITHOME-90) ... Explicit, documented decisions instead of relying on implicit Payload defaults: - auth.maxLoginAttempts: 5, lockTime: 10 min — codifies the lockout policy rather than leaving it as an unstated library default. - auth.cookies: { secure: NODE_ENV === 'production', sameSite: 'Lax' } — secure cookies once behind HTTPS (MITHOME-15), harmless over plain HTTP in local dev. - access.{create,read,update,delete,unlock}: explicit requireAuthenticatedUser (== Payload's defaultAccess, Boolean(user)). Investigated the known open advisory flagged in MITHOME-86 (GHSA-jg8r-5jh2-v2xj — any authenticated user can unlock any other account) by reading Payload's unlock operation source: the gap only matters when a less-privileged authenticated identity exists that needs protecting from a more-privileged one. This project's single "admin" role model (no role hierarchy — MITHOME-85 epic decision) has no such identity, so the default is accepted as-is, with the reasoning and a MITHOME-46 (central IDM/SSO) revisit trigger written into the code comment rather than left implicit. - Added an optional `name` field for a nicer admin identity than a bare email (audit trail, header display). Verified live: existing dev@mozdit.hu user unaffected (name column shows "<No Name>", backward compatible). Reproduced the lockout for real — 5 wrong POST /api/users/login attempts, 6th attempt with the *correct* password still rejected ("locked due to too many failed login attempts"), unlocked via Local API (overrideAccess), then the correct password logged in successfully. build/lint/tsc/test (58 passed) all clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 13:26:41 +02:00
Do SikiandClaude Sonnet 5	fb11eff18b	docs(cms): note the manual pre-processing workflow on the Partners logo field ... Following the MITHOME-118 scope decision (cancelled — see Plane comment): partner logos are prepared with a free external tool (e.g. remove.bg) before upload, not edited inside Payload admin. Surface that expectation right on the field so an editor isn't looking for a crop/transparency tool that doesn't exist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 13:16:14 +02:00
Do SikiandClaude Sonnet 5	6589289878	feat(cms): enable Payload localization — hu default + en (MITHOME-110) ... payload.config.ts: localization: { locales: ['hu','en'], defaultLocale: 'hu', fallback: true }. URL/routing side is separate (MITHOME-114). Proved the mechanism on a real field rather than a throwaway one: Common.buttons.* (contact/learnMore/webmail/sendMessage) marked localized: true — these are genuinely translatable UI labels, so this doubles as a first, correct slice of the full MITHOME-111 retrofit instead of being disposable test scaffolding. Gotcha discovered and documented in the migration script: marking an existing field `localized: true` after data was already written non- localized makes that value unreadable via `locale: defaultLocale` (the storage shape changed) — the migration script must be re-run so it gets rewritten under the localized shape. This will matter again for the full MITHOME-111/112 retrofit. Verified: Local API round-trip (set en, defaultLocale/hu re-seeded via re-running the migration script) — hu reads "Kapcsolatfelvétel", en reads "Contact". Real browser: admin UI locale switcher (hu/en) in the top bar, fields show "— hu"/"— en" per-locale labels, switching locale swaps the visible value correctly on the Common global editor. build/lint/tsc/test (58 passed) all clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 13:07:36 +02:00
Do SikiandClaude Sonnet 5	776fa66bc8	feat(cms): Partners + Media collection MVP (MITHOME-89) ... Payload built-in upload collection (Media) + a Partners collection (name, url, logo -> Media relationship) mirroring home.json's partners.items. Scope decision (see Plane MITHOME-89/118): the old logo editor (crop/rotate/transparent-background — MITHOME-76/84) is entirely client-side canvas logic (scripts/cms-logo-client.js, 345 lines), not server-side processing. Porting that UX into the Payload admin is a real custom React field component, split into its own ticket (MITHOME-118) rather than bundled here. This ticket covers plain upload only. - src/collections/Media.ts, src/collections/Partners.ts, registered in payload.config.ts. - migrate-content-to-payload.ts: upsertPartner() uploads the existing processed logo file (filePath) into Media (idempotent — matched by `alt` == partner name) and upserts the Partner document (matched by `name`). - .gitignore: Payload's default local upload storage lands at proto/media/ (not proto/public/) — runtime data, not source, needs a persistent volume in staging/production (flagged for MITHOME-97). Also ignored the generated src/payload-types.ts. Verified: migration run twice against the real dev MongoDB produced exactly 1 Media doc + 1 Partner doc (no duplicates, confirmed via mongosh) with the correct file size (12289 bytes, matching the source PNG). Real browser: logged into /admin, Partners list shows the migrated entry, and the document editor renders the logo thumbnail (270x80, 12KB) correctly. build/lint/tsc/test (58 passed) all clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 12:33:34 +02:00
Do SikiandClaude Sonnet 5	17c6d63ae3	feat(cms): LegalPages collection + migration (MITHOME-88) ... Slug-based collection mirroring LegalPageContent (proto/src/content/ types.ts) for the two legal pages (adatvedelem, hasznalati-feltetelek). - src/collections/LegalPages.ts: slug (unique), title, lastUpdated, sections[] (id/title/content). `content` stays a plain textarea, not lexical richText — the current frontend (src/app/(frontend)/adatvedelem/page.tsx) renders it through a hand-rolled "•"/"**bold**" regex converter, not a real Markdown/ richText parser, matching the same bootstrap-scope call made for Contact.gdpr.label in MITHOME-87. - Registered in payload.config.ts. - migrate-content-to-payload.ts: added an idempotent upsertLegalPage helper (find-by-slug, then update or create — Collections don't have Globals' fixed-slug updateGlobal) and seeded both legal pages from their existing JSON. Verified: migration run twice against the real dev MongoDB produced exactly 2 documents (no duplicates) — confirmed via mongosh. Real browser: logged into /admin, Legal Pages list shows both entries with correct titles/slugs, opened the adatvedelem document and the slug/ title/body fields all show the migrated content correctly. build/lint/ tsc/test (58 passed) all clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 12:16:09 +02:00
Do SikiandClaude Sonnet 5	a3d7e9ce75	chore(cms): disable Payload's anonymous telemetry ... Payload sends anonymous usage telemetry to its own servers by default. The site is self-hosted specifically so the client's data never leaves our own infrastructure (see the legal/GDPR discussion in chat) — that reasoning extends to Payload's own runtime telemetry too, so opt out via telemetry: false in payload.config.ts. Verified: build and dev server produce no telemetry notice, and the admin dashboard's network requests (checked in a real browser) are all to localhost — no outbound telemetry calls. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 10:52:54 +02:00
Do SikiandClaude Sonnet 5	3132fcb8eb	feat(cms): Home/About/Services/Contact/Common Globals + JSON migration (MITHOME-87) ... Payload Global configs mirroring proto/src/content/types.ts: - src/globals/{Home,About,Services,Contact,Common}.ts - src/globals/fields/stringArray.ts — shared helper: Payload has no native string[] field, so every plain string array from the old content types (trustBullets, paragraphs, features, spec items, …) becomes an array of one-field { value } objects. - home.partners is intentionally NOT included — that becomes its own Partners collection (logo -> Media upload) in MITHOME-89, to avoid two disagreeing sources for the same data. - contact.form.fields.gdpr.label stays a plain textarea (not lexical richText): the JSON source is a hand-written HTML string with an <a> tag; richText's node-tree serialization would need its own migration/render logic, out of scope for this bootstrap pass. scripts/migrate-content-to-payload.ts: one-shot, idempotent Local API migration reading the existing JSON files and calling updateGlobal — does not touch or delete the JSON files. Run via the new `npm run migrate:content` script. Registered the five Globals in payload.config.ts. Also included here (belongs with the previous "resolve double-root- layout conflict" commit but didn't actually get staged there — verified only now by diffing HEAD against the working tree): (frontend)/layout.tsx's relative imports corrected to ../../ instead of ../ (one directory deeper than the original src/app/layout.tsx). Verified: - npm run build / lint, tsc --noEmit, npm test (58 passed) all clean - npm run migrate:content against the real dev MongoDB container, then read back via payload.findGlobal() — hero.title, trustBullets, services.items[0].features, footer.address, faq.items.length all match the JSON source - Real browser: logged into /admin, opened the Home global editor — Hero/Trust bullets group renders and shows the migrated Hungarian content correctly (see screenshot shared in chat) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:41:03 +02:00
Do SikiandClaude Sonnet 5	a661739844	fix(cms): resolve double-root-layout conflict between the site and Payload admin ... Next.js 16 requires either one shared root layout for every route, or each top-level route group to be fully self-contained (no ancestor layout.tsx above it). MITHOME-86 added (payload)/layout.tsx — which itself renders Payload's own <html>/<body> via <RootLayout> — while src/app/layout.tsx still existed as a shared ancestor and did the same. The result was two React trees fighting over <html>/<body>/<head>, surfacing in the browser as hydration failures and "You are mounting a new html component" errors on /admin (invisible to curl-based checks in the MITHOME-86 verification, since they only exercise SSR, not client hydration — that verification's "confirmed live" claim was therefore incomplete; caught now with an actual browser). Fix, per Payload's documented multi-root pattern: move every existing site route (page.tsx, globals.css, kapcsolat/szolgaltatasok/rolunk/ adatvedelem/felhasznalasi-feltetelek) into a new (frontend) route group with its own layout.tsx (renamed from src/app/layout.tsx, with relative imports adjusted one level deeper), as a sibling of (payload). No shared layout.tsx remains directly under src/app/. Verified in a real browser (not just curl): /admin/login and the dashboard now render and hydrate cleanly, and all site routes (/, /rolunk, /szolgaltatasok, /kapcsolat, /adatvedelem, /felhasznalasi-feltetelek) are unaffected — same output, just moved. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:40:00 +02:00
Do SikiandClaude Sonnet 5	1600d99c5d	feat(cms): Payload CMS bootstrap — config, MongoDB adapter, admin routes (MITHOME-86) ... Alapinstalláció a Payload CMS-re való áttéréshez (EPIC MITHOME-85): - payload@3.88.0, @payloadcms/next, @payloadcms/db-mongodb, @payloadcms/richtext-lexical, graphql, sharp telepítve - src/payload.config.ts: mongooseAdapter a meglévő MONGODB_URI-ra (ugyanaz az adatbázis, mint a Mongoose/mongodb rétegnek), lexical editor, PAYLOAD_SECRET env-ből - src/collections/Users.ts: minimális auth collection — Payload nem tud admin felületet renderelni auth collection nélkül. Ez csak a bootstraphez kell; a valódi access control/jelszó-politika MITHOME-90 feladata. - App Router route group (src/app/(payload)/): admin UI ([[...segments]]), REST (api/[...slug]), GraphQL + playground route-ok, root layout — a szokásos Payload v3 Next.js integrációs minta szerint - next.config.ts: withPayload() wrapper a route handler bundling-hoz - tsconfig.json: @payload-config path alias -> src/payload.config.ts (ez oldja fel a webpack/turbopack importot is, nem csak a type-checket) - PAYLOAD_SECRET env var: generált dev érték a .env.local-ban (gitignore-olt), changeme placeholder + generálási megjegyzés a staging/production .env példafájlokban, dokumentálva a CLAUDE.md env-lista részében Ismert, még nem javított biztonsági advisory a felvett payload@3.88.0-ban (GHSA-jg8r-5jh2-v2xj, moderate, CWE-307: az admin account-unlock alapból más fiókok lockoutját is felold hitelesített usernek) — nincs újabb patch-elt verzió jelenleg, nyomon követve MITHOME-90 alatt. Ellenőrizve ezen a commiton: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) — mind zöld. Az admin bejelentkezés/DB-kapcsolat élő tesztje MongoDB-t igényel (jelen környezetben Docker daemon nem fut, ez lokálisan `docker compose -f docker-compose.dev.yml up -d mongodb` után `npm run dev` + http://localhost:3000/admin-mal ellenőrizhető). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:14:51 +02:00
Do SikiandClaude Sonnet 5	6cb99f603a	chore(deps): upgrade Next.js to 16.3.4 for Payload CMS compatibility ... Payload 3.88.0's peer range for `next` is >=15.2.9 <15.3.0 || >=15.3.9 <15.4.0 || >=15.4.11 <15.5.0 || >=16.2.6 <17.0.0 — the project's previous 15.5.23 fell in the unsupported gap between the 15.4.x and 16.2.x ranges. Upgrading to 16.3.4 (React 19.1.0 stays compatible) unblocks MITHOME-86. - next.config.ts: drop the removed `eslint.ignoreDuringBuilds` option (Next 16 no longer runs ESLint during `next build`) - eslint.config.mjs: import eslint-config-next's native flat-config arrays directly instead of bridging through FlatCompat, which threw "Converting circular structure to JSON" under ESLint 9 with the upgraded config - tsconfig.json: Next 16's own migration set `jsx: react-jsx` and added `.next/dev/types/**/*.ts` to `include` - ThemeProvider.tsx: suppress two react-hooks/set-state-in-effect false positives (new rule shipped with eslint-config-next 16) — these effects intentionally sync state from localStorage/DOM on mount, there is no subscription to move the setState into Verified: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) all clean on this change alone, before installing Payload. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:04:54 +02:00
Do Siki	4b48f27302	content: add Angele Pihenőház partner (logo + URL)	2026-08-23 11:41:13 +02:00
Do Siki	f65c22987f	feat: partners section on the homepage (logo + URL, CMS upload) ... - home.json gains a partners block (title/subtitle/items: name, url, logo), rendered on the homepage under the services section (next/image logos linking out with rel=noopener) - CMS: partner logos uploadable from the 🎨 Logó page via POST /partner-logo (PNG, 1 MiB cap, filename sanitized to a slug, written to public/partners/) - schema + types extended; guide updated Closes MITHOME-83	2026-08-23 10:22:22 +02:00
DO Siki	46db2622d3	content: frissítve a CMS-ből	2026-08-22 13:39:29 +02:00
DO Siki	e715a3aa8b	content: frissítve a CMS-ből	2026-08-22 13:38:43 +02:00
Do Siki	d908f6b1b4	chore(quality): type-check and lint gates in pre-deploy, clean lint/tsc ... - pre-deploy suite now runs tsc --noEmit and eslint; any failure aborts the release - fix all TypeScript errors (FooterConfig.copyright removed after the CMS move; test guards/casts) - fix all ESLint errors: <a>→<Link> and <img>→<Image> in Header/Footer, remove unused imports and explicit any in src - eslint config relaxes no-explicit-any/no-require-imports/no-unused-vars for test and CommonJS config files (legitimate usage) Closes MITHOME-81	2026-08-22 12:37:22 +02:00
Do Siki	162e5782e9	refactor(cms): split oversized modules below the 400-line limit ... - content-editor.js: extract the /save handler to scripts/cms-save.js - cms-logo-page.js: inline the ~280-line canvas editor script to scripts/cms-logo-client.js (page is now the HTML/CSS shell only) - cms-editor-client.js: move the keyboard-shortcut section to scripts/cms-editor-shortcuts.js, inlined after the main client All modules now under the hard limit; full pre-deploy suite green. Closes MITHOME-80	2026-08-22 12:31:28 +02:00
Do Siki	15529c7705	fix: contact length limits + logger/next.config nitpicks + dep updates ... - /api/contact enforces per-field length caps (name/email/subject/message) before sanitization/persistence; over-long message returns 400 without touching Mongo (test added) - logger: crypto-based request id (randomUUID) instead of Math.random().substr; defaultMeta.version prefers DEPLOY_VERSION over npm_package_version - next.config: move Turbopack svg rule from deprecated experimental.turbo to top-level turbopack - deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are transitive sharp/libvips DoS advisories, not exploitable for static images) Closes MITHOME-78, MITHOME-79	2026-08-22 12:22:27 +02:00
Do Siki	9f1fb349c2	fix(web): hygiene — OG image/metadataBase, Header a11y text + nav flag, dead code ... - siteConfig.ogImage pointed to an existing asset; metadataBase added so relative OG/Twitter URLs resolve against the real origin instead of localhost - Header sr-only menu label moved to common.json (a11y.openMenu/closeMenu); navigation primary styling driven by a NavigationItem.primary flag instead of brittle 'Kapcsolat' string comparisons - remove dead code: lib/site-config.ts (unused hybrid config) and the unused, schema-divergent siteConfig.contact.form - ContactConfig type cleaned up (address/form removed) Closes MITHOME-77	2026-08-22 12:12:48 +02:00
Do Siki	6030c48abb	feat(cms): keyboard shortcuts — Ctrl+S save, Ctrl+P publish, ? help ... - Ctrl/Cmd+S saves (native browser save dialog suppressed) - Ctrl/Cmd+P publishes; Ctrl/Cmd+Shift+V opens the Versions panel - '?' toggles a shortcuts overlay (Esc/click closes) - plain typing in inputs never triggers actions (modifiers required; '?' only outside editing targets) - jsdom regression tests run the real client script with dispatched KeyboardEvents; the client is evaluated once per suite because each eval would stack another keydown listener on the shared document Closes MITHOME-75	2026-08-19 22:52:09 +02:00
DO Siki	8f72b91fb1	content: frissítve a CMS-ből	2026-08-19 22:33:59 +02:00
DO Siki	2846edfa6e	content: frissítve a CMS-ből	2026-08-19 17:39:30 +02:00
Do Siki	02d6755874	test(footer): assert address from common.json instead of hardcoded city ... The footer address is CMS-editable now; the test must follow the single source instead of a fixed city.	2026-08-19 17:37:36 +02:00
DO Siki	d0270547cc	content: frissítve a CMS-ből	2026-08-19 17:12:37 +02:00
DO Siki	7b3bd2b78b	content: frissítve a CMS-ből	2026-08-19 17:12:35 +02:00
DO Siki	cb1084c0c7	content: frissítve a CMS-ből	2026-08-19 17:11:51 +02:00
DO Siki	3ba453d0a1	content: frissítve a CMS-ből	2026-08-19 17:11:49 +02:00
DO Siki	2ae5247cc6	content: frissítve a CMS-ből	2026-08-19 17:10:27 +02:00
DO Siki	7f4efbde98	content: frissítve a CMS-ből	2026-08-19 17:10:25 +02:00
DO Siki	ce14b6716b	content: frissítve a CMS-ből	2026-08-19 17:08:12 +02:00
DO Siki	6019b8b459	content: frissítve a CMS-ből	2026-08-19 17:08:10 +02:00
DO Siki	5ab3abba2a	content: frissítve a CMS-ből	2026-08-19 17:01:11 +02:00
Do Siki	9365c0f1ee	feat(footer): CMS-editable company address (common.json footer.address) ... 'Budapest, Magyarország' lived hardcoded in site.ts. It now lives in common.json (footer.address), editable via the Közös szövegek tab, and both consumers (Footer, Kapcsolat page) read it from there — single source. Schema and types extended; site.ts keeps only the email. Closes MITHOME-73	2026-08-19 16:53:16 +02:00
DO Siki	bbe0ff4c0a	content: frissítve a CMS-ből	2026-08-19 15:31:13 +02:00
DO Siki	d5e2023a1e	content: frissítve a CMS-ből	2026-08-19 15:31:12 +02:00
DO Siki	4a51585bb0	content: frissítve a CMS-ből	2026-08-19 15:29:24 +02:00
DO Siki	fd5e048c11	content: frissítve a CMS-ből	2026-08-19 15:29:22 +02:00
DO Siki	09228b6a6d	content: frissítve a CMS-ből	2026-08-19 15:17:00 +02:00
DO Siki	219f5122bd	content: frissítve a CMS-ből	2026-08-19 15:03:37 +02:00
Do Siki	5d2141ec88	fix(cms): capture array container before node removal so reindex runs ... The ❌ delete buttons called wrap.closest('.array-items') AFTER remove(); a detached node has no ancestors, so closest() returned null and reindexItems() silently skipped. Remaining items kept their old indices, collect() produced sparse arrays (null holes) and saves failed schema validation, e.g. '$.details.services[1].specs.items[0]: string érték szükséges'. Capture the container before remove() for both str-item and obj-card delete handlers. Regression test runs the real browser script in jsdom and clicks the actual delete buttons (nested string array + object card reindexing). Closes MITHOME-67	2026-08-19 13:30:53 +02:00
Do Siki	fe4a6a1e92	feat(footer): CMS-editable copyright with 2002–current year range ... The copyright text lived in site.ts with a build-time year and was not CMS-editable. It now lives in common.json (footer.copyright, editable via the Közös szövegek tab) with a {year} placeholder that resolves to the current year at render: '© 2002–{year} mozdIT Bt. Minden jog fenntartva.' Schema and types extended; site.ts keeps only the footer links. Closes MITHOME-66	2026-08-19 12:44:48 +02:00
Do Siki	3a5a09c361	feat: expose deploy version (git SHA) on CMS and health endpoint ... 'Is the fix live?' becomes a single check instead of an SSH session: - CMS: git short SHA read at startup, shown in the bottom bar (v<sha>), served by the public GET /version endpoint, recorded in a startup audit entry - Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it via build ARG into the runtime env, /api/health reports it as deployVersion, smoke test asserts a non-'unversioned' stamp Closes MITHOME-63	2026-08-18 21:19:43 +02:00
Do Siki	bdf9aac4d0	content: apply copy review — concrete, credible claims and CTAs ... - hero: state the actual offering (hosting, mail, domains) instead of a mission statement - security USP: list concrete measures instead of 'maximális teljesítmény' promise - hosting: replace '99% uptime garancia' with the 99.9% availability goal (excluding planned maintenance) — no absolute guarantee claim without SLA backing - email: encrypted webmail/IMAP access wording; domain: registration, renewal and DNS in one place; SPF/DKIM/DMARC explained by purpose - per-service CTA texts instead of the generic 'További információk' - main CTA: 'Kérjen személyre szabott konzultációt' (smoke test updated to match) - bottom CTA asks the visitor to describe their need briefly	2026-08-18 20:39:24 +02:00
DO Siki	e03662b620	content: frissítve a CMS-ből	2026-08-18 20:31:39 +02:00
DO Siki	c2cc701032	content: frissítve a CMS-ből	2026-08-18 20:16:08 +02:00
Do Siki	bd7287aa58	fix: address code review findings from 2026-08-17 ... - scope no-cache headers to non-static routes (restore immutable asset caching) - reset cached rejected MongoDB promise so retries can succeed - use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing) - remove weak Mongo defaults from compose files (fail loudly on missing env) - move staging banner text to common.json content - read APP_PORT from env file in deploy.sh healthcheck - filter network noise from staging smoke console assertions Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54	2026-08-18 12:21:32 +02:00
DO Siki	93aaa10a36	content: frissítve a CMS-ből	2026-08-17 22:07:38 +02:00
Do Siki	a380bf2b5b	fix: keep browser chrome neutral on staging	2026-08-17 17:56:39 +02:00
Do Siki	148618b880	fix: keep staging marker in CMS only	2026-08-17 17:53:41 +02:00
Do Siki	f821b35b35	feat: mark staging website clearly	2026-08-17 17:48:05 +02:00
Do Siki	9ce420ef71	fix: limit cache bypass to browser revalidation	2026-08-17 17:42:37 +02:00