166 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Do SikiandClaude Sonnet 5	a3d7e9ce75	chore(cms): disable Payload's anonymous telemetry ... Payload sends anonymous usage telemetry to its own servers by default. The site is self-hosted specifically so the client's data never leaves our own infrastructure (see the legal/GDPR discussion in chat) — that reasoning extends to Payload's own runtime telemetry too, so opt out via telemetry: false in payload.config.ts. Verified: build and dev server produce no telemetry notice, and the admin dashboard's network requests (checked in a real browser) are all to localhost — no outbound telemetry calls. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 10:52:54 +02:00
Do SikiandClaude Sonnet 5	db2f38743f	sync: mark MITHOME-98 done in TODO.md ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 10:39:58 +02:00
Do SikiandClaude Sonnet 5	4c54c639e5	fix(docker): authenticate the dev app's MongoDB URI (MITHOME-98) ... docker-compose.dev.yml's mongodb service sets MONGO_INITDB_ROOT_USERNAME/ PASSWORD, which makes the official mongo image enable --auth — but the app service's MONGODB_URI was unauthenticated (mongodb://mongodb:27017/mozdit). Same bug class as MITHOME-32 (staging/production), but that ticket covers docker-compose.staging.yml /docker-compose.prod.yml specifically, not this dev file — hence the separate MITHOME-98. Why /api/health never caught it: that route is a pure liveness check and never touches MongoDB. Only an endpoint that actually performs a DB operation exercises the bug. Verified live (docker compose -f docker-compose.dev.yml up --build): - Reproduced the failure first: inside the running app container, a plain `mongodb://mongodb:27017/mozdit` connection's findOne() throws "Command find requires authentication" — confirms the hypothesis that the app fails only on a real query, not at startup. - With the fix in place: POST /api/contact returns 200 with a submissionId, and the document is actually present in contact_submissions (checked via mongosh) — a real, previously- broken write path now works end to end. - npm test: 58/58 passed (unaffected, as expected for a docker-compose/doc-only change). Also fixed the same stale unauthenticated example in DOCKER.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 10:39:29 +02:00
Do SikiandClaude Sonnet 5	018a1f2767	sync: mark MITHOME-87 done in TODO.md ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:42:12 +02:00
Do SikiandClaude Sonnet 5	3132fcb8eb	feat(cms): Home/About/Services/Contact/Common Globals + JSON migration (MITHOME-87) ... Payload Global configs mirroring proto/src/content/types.ts: - src/globals/{Home,About,Services,Contact,Common}.ts - src/globals/fields/stringArray.ts — shared helper: Payload has no native string[] field, so every plain string array from the old content types (trustBullets, paragraphs, features, spec items, …) becomes an array of one-field { value } objects. - home.partners is intentionally NOT included — that becomes its own Partners collection (logo -> Media upload) in MITHOME-89, to avoid two disagreeing sources for the same data. - contact.form.fields.gdpr.label stays a plain textarea (not lexical richText): the JSON source is a hand-written HTML string with an <a> tag; richText's node-tree serialization would need its own migration/render logic, out of scope for this bootstrap pass. scripts/migrate-content-to-payload.ts: one-shot, idempotent Local API migration reading the existing JSON files and calling updateGlobal — does not touch or delete the JSON files. Run via the new `npm run migrate:content` script. Registered the five Globals in payload.config.ts. Also included here (belongs with the previous "resolve double-root- layout conflict" commit but didn't actually get staged there — verified only now by diffing HEAD against the working tree): (frontend)/layout.tsx's relative imports corrected to ../../ instead of ../ (one directory deeper than the original src/app/layout.tsx). Verified: - npm run build / lint, tsc --noEmit, npm test (58 passed) all clean - npm run migrate:content against the real dev MongoDB container, then read back via payload.findGlobal() — hero.title, trustBullets, services.items[0].features, footer.address, faq.items.length all match the JSON source - Real browser: logged into /admin, opened the Home global editor — Hero/Trust bullets group renders and shows the migrated Hungarian content correctly (see screenshot shared in chat) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:41:03 +02:00
Do SikiandClaude Sonnet 5	3183098926	chore(deps): pin tsx 4.23.13 and add migrate:content script ... tsx 4.22.4 (the version resolved before this was an explicit dependency) fails on Node v25.6.1 with "T.registerHooks is not a function" — its CommonJS-require hook feature-detection finds node:module's registerHooks but calls it with a shape that version of Node no longer accepts. This broke both the `payload` CLI (needed for `generate:importmap`, see next commit) and would have broken `npm run migrate:content` (MITHOME-87) the same way. 4.23.13 fixes it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:40:24 +02:00
Do SikiandClaude Sonnet 5	a661739844	fix(cms): resolve double-root-layout conflict between the site and Payload admin ... Next.js 16 requires either one shared root layout for every route, or each top-level route group to be fully self-contained (no ancestor layout.tsx above it). MITHOME-86 added (payload)/layout.tsx — which itself renders Payload's own <html>/<body> via <RootLayout> — while src/app/layout.tsx still existed as a shared ancestor and did the same. The result was two React trees fighting over <html>/<body>/<head>, surfacing in the browser as hydration failures and "You are mounting a new html component" errors on /admin (invisible to curl-based checks in the MITHOME-86 verification, since they only exercise SSR, not client hydration — that verification's "confirmed live" claim was therefore incomplete; caught now with an actual browser). Fix, per Payload's documented multi-root pattern: move every existing site route (page.tsx, globals.css, kapcsolat/szolgaltatasok/rolunk/ adatvedelem/felhasznalasi-feltetelek) into a new (frontend) route group with its own layout.tsx (renamed from src/app/layout.tsx, with relative imports adjusted one level deeper), as a sibling of (payload). No shared layout.tsx remains directly under src/app/. Verified in a real browser (not just curl): /admin/login and the dashboard now render and hydrate cleanly, and all site routes (/, /rolunk, /szolgaltatasok, /kapcsolat, /adatvedelem, /felhasznalasi-feltetelek) are unaffected — same output, just moved. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:40:00 +02:00
Do SikiandClaude Sonnet 5	2a4f33172b	sync: mark MITHOME-86 done in TODO.md ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:21:32 +02:00
Do SikiandClaude Sonnet 5	849acf4c34	fix(config): disable Next.js 16 auto-generated agent-rules files ... \`next dev\` (Next.js 16) writes proto/AGENTS.md and proto/CLAUDE.md on every run to brief AI agents on framework changes. This project already has its own agent instruction system (root CLAUDE.md -> .agent/) — a second, unrelated proto/CLAUDE.md stub would conflict with/shadow it for anyone working inside proto/. Disabled via agentRules: false. Verified live: MITHOME-86's admin route renders end-to-end against a real MongoDB (docker-compose.dev.yml mongodb service) — GET /admin 200 with the create-first-user flow, GET /api/users correctly 403s for an anonymous request, /api/health unaffected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:19:25 +02:00
Do SikiandClaude Sonnet 5	1600d99c5d	feat(cms): Payload CMS bootstrap — config, MongoDB adapter, admin routes (MITHOME-86) ... Alapinstalláció a Payload CMS-re való áttéréshez (EPIC MITHOME-85): - payload@3.88.0, @payloadcms/next, @payloadcms/db-mongodb, @payloadcms/richtext-lexical, graphql, sharp telepítve - src/payload.config.ts: mongooseAdapter a meglévő MONGODB_URI-ra (ugyanaz az adatbázis, mint a Mongoose/mongodb rétegnek), lexical editor, PAYLOAD_SECRET env-ből - src/collections/Users.ts: minimális auth collection — Payload nem tud admin felületet renderelni auth collection nélkül. Ez csak a bootstraphez kell; a valódi access control/jelszó-politika MITHOME-90 feladata. - App Router route group (src/app/(payload)/): admin UI ([[...segments]]), REST (api/[...slug]), GraphQL + playground route-ok, root layout — a szokásos Payload v3 Next.js integrációs minta szerint - next.config.ts: withPayload() wrapper a route handler bundling-hoz - tsconfig.json: @payload-config path alias -> src/payload.config.ts (ez oldja fel a webpack/turbopack importot is, nem csak a type-checket) - PAYLOAD_SECRET env var: generált dev érték a .env.local-ban (gitignore-olt), changeme placeholder + generálási megjegyzés a staging/production .env példafájlokban, dokumentálva a CLAUDE.md env-lista részében Ismert, még nem javított biztonsági advisory a felvett payload@3.88.0-ban (GHSA-jg8r-5jh2-v2xj, moderate, CWE-307: az admin account-unlock alapból más fiókok lockoutját is felold hitelesített usernek) — nincs újabb patch-elt verzió jelenleg, nyomon követve MITHOME-90 alatt. Ellenőrizve ezen a commiton: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) — mind zöld. Az admin bejelentkezés/DB-kapcsolat élő tesztje MongoDB-t igényel (jelen környezetben Docker daemon nem fut, ez lokálisan `docker compose -f docker-compose.dev.yml up -d mongodb` után `npm run dev` + http://localhost:3000/admin-mal ellenőrizhető). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:14:51 +02:00
Do SikiandClaude Sonnet 5	30364fcab7	sync: update TODO.md with Payload CMS epic (MITHOME-85..97) ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:14:31 +02:00
Do SikiandClaude Sonnet 5	6cb99f603a	chore(deps): upgrade Next.js to 16.3.4 for Payload CMS compatibility ... Payload 3.88.0's peer range for `next` is >=15.2.9 <15.3.0 || >=15.3.9 <15.4.0 || >=15.4.11 <15.5.0 || >=16.2.6 <17.0.0 — the project's previous 15.5.23 fell in the unsupported gap between the 15.4.x and 16.2.x ranges. Upgrading to 16.3.4 (React 19.1.0 stays compatible) unblocks MITHOME-86. - next.config.ts: drop the removed `eslint.ignoreDuringBuilds` option (Next 16 no longer runs ESLint during `next build`) - eslint.config.mjs: import eslint-config-next's native flat-config arrays directly instead of bridging through FlatCompat, which threw "Converting circular structure to JSON" under ESLint 9 with the upgraded config - tsconfig.json: Next 16's own migration set `jsx: react-jsx` and added `.next/dev/types/**/*.ts` to `include` - ThemeProvider.tsx: suppress two react-hooks/set-state-in-effect false positives (new rule shipped with eslint-config-next 16) — these effects intentionally sync state from localStorage/DOM on mount, there is no subscription to move the setState into Verified: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) all clean on this change alone, before installing Payload. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:04:54 +02:00
DO Siki	e9cb17ed67	content: frissítve a CMS-ből	2026-08-23 12:11:59 +02:00
Do Siki	38be6c0450	sync: update TODO.md with MITHOME-84 (make-transparent)	2026-08-23 11:47:25 +02:00
Do Siki	b56b81b2ba	feat(cms): make-transparent (remove white background) in the logo editor ... Adds a ⚪ Háttér átlátszóvá (fehér) button to the canvas editor. Pixels above a luminance threshold become fully transparent; a soft ramp just below keeps edges smooth. Lets white-background partner/site logos sit on any page background. Closes MITHOME-84	2026-08-23 11:46:29 +02:00
Do Siki	f6846ad217	test(cms): partner-logo test uses unique names and only cleans its own files ... The previous cleanup emptied proto/public/partners/ entirely, deleting real committed partner logos during the pre-deploy run. Now the test uploads to unique run-specific filenames and removes only those.	2026-08-23 11:42:24 +02:00
Do Siki	4b48f27302	content: add Angele Pihenőház partner (logo + URL)	2026-08-23 11:41:13 +02:00
Do Siki	1b565af4d5	sync: update TODO.md with MITHOME-83 (partners section)	2026-08-23 10:24:52 +02:00
Do Siki	611e229af9	test(cms): clean up all partner-logo test artifacts	2026-08-23 10:23:00 +02:00
Do Siki	f65c22987f	feat: partners section on the homepage (logo + URL, CMS upload) ... - home.json gains a partners block (title/subtitle/items: name, url, logo), rendered on the homepage under the services section (next/image logos linking out with rel=noopener) - CMS: partner logos uploadable from the 🎨 Logó page via POST /partner-logo (PNG, 1 MiB cap, filename sanitized to a slug, written to public/partners/) - schema + types extended; guide updated Closes MITHOME-83	2026-08-23 10:22:22 +02:00
Do Siki	410b4a2e2f	docs: refresh all documentation to the current state ... - agent docs: Linear (ZEE-*) → Plane (MITHOME-*) everywhere (task tracking, commit examples, workflows, env vars) - testing steering: replace the obsolete Gherkin/Linear reporting with the pre-deploy suite and the CMS test scripts - README: rewrite to Next.js 15, local deploy, Plane, CMS, security monitoring - DOCKER/proto docs: correct dev-stack ports (app 8080, mongo 27018) and Next.js 15 - content-editor-recovery: mark the old 'next steps' as done - mark clearly-obsolete Linear/GitHub-era guides as deprecated (banner) — LINEAR-SYNC, GITHUB-CICD/INTEGRATION, TEST-MANAGEMENT/REPORTING, traceability, sync-status analysis, requirements docs	2026-08-22 19:41:50 +02:00
Do Siki	8ee5befe10	fix(security): real newlines in alert details for the ntfy body ... The \n in the accumulated alert text was a literal backslash-n, so the details would have rendered as one garbled line. printf -v now appends real newlines; the notification body joins header + details with a real line break.	2026-08-22 14:37:46 +02:00
Do Siki	164b19cdb8	fix(security): filter docker exec errors and include finding details in ntfy body ... - a container stopping mid-scan produced 'cannot exec in a stopped state' as a false-positive finding; such exec errors are now filtered out - the ntfy notification body now carries the actual alert lines, not just a counter	2026-08-22 14:33:06 +02:00
Do Siki	8903ec9562	fix(security): use project-specific ntfy topic st_limidev_security	2026-08-22 14:04:50 +02:00
Do Siki	de0bd2fc07	feat(security): push scan alerts to the local ntfy server ... On findings the scan now POSTs a high-priority notification to topic st_security on the host ntfy (127.0.0.1:2586), authenticated with the si_17t_pro token read from /etc/ntfy/credentials/auth.env (never logged). Topic/cred/URL overridable via env for testing.	2026-08-22 13:43:59 +02:00
Do Siki	00d6cf9786	sync: update TODO.md with MITHOME-82 (security scan)	2026-08-22 13:40:26 +02:00
Do Siki	28778aef88	feat(security): lightweight cryptominer/backdoor detection script ... Periodic host+container sweep for the exact indicators seen in the staging miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/ init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU containers. Findings are logged and exit 1 for cron MAILTO alerting. Closes MITHOME-82	2026-08-22 13:39:46 +02:00
DO Siki	46db2622d3	content: frissítve a CMS-ből	2026-08-22 13:39:29 +02:00
DO Siki	e715a3aa8b	content: frissítve a CMS-ből	2026-08-22 13:38:43 +02:00
Do Siki	c73cdd3b2f	sync: update TODO.md with MITHOME-78/79/80/81 (review fixes)	2026-08-22 12:39:20 +02:00
Do Siki	d908f6b1b4	chore(quality): type-check and lint gates in pre-deploy, clean lint/tsc ... - pre-deploy suite now runs tsc --noEmit and eslint; any failure aborts the release - fix all TypeScript errors (FooterConfig.copyright removed after the CMS move; test guards/casts) - fix all ESLint errors: <a>→<Link> and <img>→<Image> in Header/Footer, remove unused imports and explicit any in src - eslint config relaxes no-explicit-any/no-require-imports/no-unused-vars for test and CommonJS config files (legitimate usage) Closes MITHOME-81	2026-08-22 12:37:22 +02:00
Do Siki	162e5782e9	refactor(cms): split oversized modules below the 400-line limit ... - content-editor.js: extract the /save handler to scripts/cms-save.js - cms-logo-page.js: inline the ~280-line canvas editor script to scripts/cms-logo-client.js (page is now the HTML/CSS shell only) - cms-editor-client.js: move the keyboard-shortcut section to scripts/cms-editor-shortcuts.js, inlined after the main client All modules now under the hard limit; full pre-deploy suite green. Closes MITHOME-80	2026-08-22 12:31:28 +02:00
Do Siki	15529c7705	fix: contact length limits + logger/next.config nitpicks + dep updates ... - /api/contact enforces per-field length caps (name/email/subject/message) before sanitization/persistence; over-long message returns 400 without touching Mongo (test added) - logger: crypto-based request id (randomUUID) instead of Math.random().substr; defaultMeta.version prefers DEPLOY_VERSION over npm_package_version - next.config: move Turbopack svg rule from deprecated experimental.turbo to top-level turbopack - deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are transitive sharp/libvips DoS advisories, not exploitable for static images) Closes MITHOME-78, MITHOME-79	2026-08-22 12:22:27 +02:00
Do Siki	b8f9e8cfdf	sync: update TODO.md with MITHOME-77 (web hygiene)	2026-08-22 12:14:42 +02:00
Do Siki	9f1fb349c2	fix(web): hygiene — OG image/metadataBase, Header a11y text + nav flag, dead code ... - siteConfig.ogImage pointed to an existing asset; metadataBase added so relative OG/Twitter URLs resolve against the real origin instead of localhost - Header sr-only menu label moved to common.json (a11y.openMenu/closeMenu); navigation primary styling driven by a NavigationItem.primary flag instead of brittle 'Kapcsolat' string comparisons - remove dead code: lib/site-config.ts (unused hybrid config) and the unused, schema-divergent siteConfig.contact.form - ContactConfig type cleaned up (address/form removed) Closes MITHOME-77	2026-08-22 12:12:48 +02:00
Do Siki	4c2913e131	feat(cms): add interactive canvas logo editor modal ... Closes MITHOME-76: - Interactive Canvas-based modal for logo editing in CMS - Crop with presets (1:1, 3:1, 4:1, 16:9, free) - Drag-to-pan positioning and wheel/slider zoom - 90 deg rotation and horizontal/vertical flip - Configurable padding/margins around logo - Brightness, contrast, and color invert filters - Direct high-DPI (2x retina) PNG export and atomic save	2026-08-20 11:53:23 +02:00
Do Siki	c5d5198fbf	fix(cms): implement v2 security and stability review findings ... Resolves: - CSRF false positive checked (global POST protection) - Publish mutex to prevent git lock / double deploy - Basic Auth rate limit checked before credential evaluation - Memory leak in rate limiter (added GC interval) - XSS in Toast messages - XSS in data-path attribute - CI healthcheck port mismatch (3000 -> 8080) - Added security headers (X-Frame-Options, X-Content-Type-Options)	2026-08-20 11:35:01 +02:00
Do Siki	768297031d	sync: update TODO.md with MITHOME-75 (keyboard shortcuts)	2026-08-19 22:53:54 +02:00
Do Siki	6030c48abb	feat(cms): keyboard shortcuts — Ctrl+S save, Ctrl+P publish, ? help ... - Ctrl/Cmd+S saves (native browser save dialog suppressed) - Ctrl/Cmd+P publishes; Ctrl/Cmd+Shift+V opens the Versions panel - '?' toggles a shortcuts overlay (Esc/click closes) - plain typing in inputs never triggers actions (modifiers required; '?' only outside editing targets) - jsdom regression tests run the real client script with dispatched KeyboardEvents; the client is evaluated once per suite because each eval would stack another keydown listener on the shared document Closes MITHOME-75	2026-08-19 22:52:09 +02:00
DO Siki	8f72b91fb1	content: frissítve a CMS-ből	2026-08-19 22:33:59 +02:00
Do Siki	db0e898ac4	sync: update TODO.md with MITHOME-74 (publish deploy cwd fix)	2026-08-19 17:41:52 +02:00
DO Siki	2846edfa6e	content: frissítve a CMS-ből	2026-08-19 17:39:30 +02:00
Do Siki	02d6755874	test(footer): assert address from common.json instead of hardcoded city ... The footer address is CMS-editable now; the test must follow the single source instead of a fixed city.	2026-08-19 17:37:36 +02:00
Do Siki	42533ec0aa	fix(cms): deploy exec was missing cwd — landed on / and never ran ... Root cause of publishes not rebuilding the site: the deploy exec child started in the process working directory (repo root), so 'cd ../../../' resolved to the filesystem root, where creating deploy.log failed with Permission denied. The git publish command already used cwd: CONTENT_DIR; the deploy child now does too (caught via live cwd/touch diagnostics in the service context). Closes MITHOME-74	2026-08-19 17:14:02 +02:00
DO Siki	d0270547cc	content: frissítve a CMS-ből	2026-08-19 17:12:37 +02:00
DO Siki	7b3bd2b78b	content: frissítve a CMS-ből	2026-08-19 17:12:35 +02:00
DO Siki	cb1084c0c7	content: frissítve a CMS-ből	2026-08-19 17:11:51 +02:00
DO Siki	3ba453d0a1	content: frissítve a CMS-ből	2026-08-19 17:11:49 +02:00
DO Siki	2ae5247cc6	content: frissítve a CMS-ből	2026-08-19 17:10:27 +02:00
DO Siki	7f4efbde98	content: frissítve a CMS-ből	2026-08-19 17:10:25 +02:00