209 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Do SikiandClaude Sonnet 5	2a4f33172b	sync: mark MITHOME-86 done in TODO.md ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:21:32 +02:00
Do SikiandClaude Sonnet 5	849acf4c34	fix(config): disable Next.js 16 auto-generated agent-rules files ... \`next dev\` (Next.js 16) writes proto/AGENTS.md and proto/CLAUDE.md on every run to brief AI agents on framework changes. This project already has its own agent instruction system (root CLAUDE.md -> .agent/) — a second, unrelated proto/CLAUDE.md stub would conflict with/shadow it for anyone working inside proto/. Disabled via agentRules: false. Verified live: MITHOME-86's admin route renders end-to-end against a real MongoDB (docker-compose.dev.yml mongodb service) — GET /admin 200 with the create-first-user flow, GET /api/users correctly 403s for an anonymous request, /api/health unaffected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:19:25 +02:00
Do SikiandClaude Sonnet 5	1600d99c5d	feat(cms): Payload CMS bootstrap — config, MongoDB adapter, admin routes (MITHOME-86) ... Alapinstalláció a Payload CMS-re való áttéréshez (EPIC MITHOME-85): - payload@3.88.0, @payloadcms/next, @payloadcms/db-mongodb, @payloadcms/richtext-lexical, graphql, sharp telepítve - src/payload.config.ts: mongooseAdapter a meglévő MONGODB_URI-ra (ugyanaz az adatbázis, mint a Mongoose/mongodb rétegnek), lexical editor, PAYLOAD_SECRET env-ből - src/collections/Users.ts: minimális auth collection — Payload nem tud admin felületet renderelni auth collection nélkül. Ez csak a bootstraphez kell; a valódi access control/jelszó-politika MITHOME-90 feladata. - App Router route group (src/app/(payload)/): admin UI ([[...segments]]), REST (api/[...slug]), GraphQL + playground route-ok, root layout — a szokásos Payload v3 Next.js integrációs minta szerint - next.config.ts: withPayload() wrapper a route handler bundling-hoz - tsconfig.json: @payload-config path alias -> src/payload.config.ts (ez oldja fel a webpack/turbopack importot is, nem csak a type-checket) - PAYLOAD_SECRET env var: generált dev érték a .env.local-ban (gitignore-olt), changeme placeholder + generálási megjegyzés a staging/production .env példafájlokban, dokumentálva a CLAUDE.md env-lista részében Ismert, még nem javított biztonsági advisory a felvett payload@3.88.0-ban (GHSA-jg8r-5jh2-v2xj, moderate, CWE-307: az admin account-unlock alapból más fiókok lockoutját is felold hitelesített usernek) — nincs újabb patch-elt verzió jelenleg, nyomon követve MITHOME-90 alatt. Ellenőrizve ezen a commiton: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) — mind zöld. Az admin bejelentkezés/DB-kapcsolat élő tesztje MongoDB-t igényel (jelen környezetben Docker daemon nem fut, ez lokálisan `docker compose -f docker-compose.dev.yml up -d mongodb` után `npm run dev` + http://localhost:3000/admin-mal ellenőrizhető). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:14:51 +02:00
Do SikiandClaude Sonnet 5	30364fcab7	sync: update TODO.md with Payload CMS epic (MITHOME-85..97) ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:14:31 +02:00
Do SikiandClaude Sonnet 5	6cb99f603a	chore(deps): upgrade Next.js to 16.3.4 for Payload CMS compatibility ... Payload 3.88.0's peer range for `next` is >=15.2.9 <15.3.0 || >=15.3.9 <15.4.0 || >=15.4.11 <15.5.0 || >=16.2.6 <17.0.0 — the project's previous 15.5.23 fell in the unsupported gap between the 15.4.x and 16.2.x ranges. Upgrading to 16.3.4 (React 19.1.0 stays compatible) unblocks MITHOME-86. - next.config.ts: drop the removed `eslint.ignoreDuringBuilds` option (Next 16 no longer runs ESLint during `next build`) - eslint.config.mjs: import eslint-config-next's native flat-config arrays directly instead of bridging through FlatCompat, which threw "Converting circular structure to JSON" under ESLint 9 with the upgraded config - tsconfig.json: Next 16's own migration set `jsx: react-jsx` and added `.next/dev/types/**/*.ts` to `include` - ThemeProvider.tsx: suppress two react-hooks/set-state-in-effect false positives (new rule shipped with eslint-config-next 16) — these effects intentionally sync state from localStorage/DOM on mount, there is no subscription to move the setState into Verified: npm run build, npm run lint, tsc --noEmit, npm test (58 passed) all clean on this change alone, before installing Payload. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-10 03:04:54 +02:00
DO Siki	e9cb17ed67	content: frissítve a CMS-ből	2026-08-23 12:11:59 +02:00
Do Siki	38be6c0450	sync: update TODO.md with MITHOME-84 (make-transparent)	2026-08-23 11:47:25 +02:00
Do Siki	b56b81b2ba	feat(cms): make-transparent (remove white background) in the logo editor ... Adds a ⚪ Háttér átlátszóvá (fehér) button to the canvas editor. Pixels above a luminance threshold become fully transparent; a soft ramp just below keeps edges smooth. Lets white-background partner/site logos sit on any page background. Closes MITHOME-84	2026-08-23 11:46:29 +02:00
Do Siki	f6846ad217	test(cms): partner-logo test uses unique names and only cleans its own files ... The previous cleanup emptied proto/public/partners/ entirely, deleting real committed partner logos during the pre-deploy run. Now the test uploads to unique run-specific filenames and removes only those.	2026-08-23 11:42:24 +02:00
Do Siki	4b48f27302	content: add Angele Pihenőház partner (logo + URL)	2026-08-23 11:41:13 +02:00
Do Siki	1b565af4d5	sync: update TODO.md with MITHOME-83 (partners section)	2026-08-23 10:24:52 +02:00
Do Siki	611e229af9	test(cms): clean up all partner-logo test artifacts	2026-08-23 10:23:00 +02:00
Do Siki	f65c22987f	feat: partners section on the homepage (logo + URL, CMS upload) ... - home.json gains a partners block (title/subtitle/items: name, url, logo), rendered on the homepage under the services section (next/image logos linking out with rel=noopener) - CMS: partner logos uploadable from the 🎨 Logó page via POST /partner-logo (PNG, 1 MiB cap, filename sanitized to a slug, written to public/partners/) - schema + types extended; guide updated Closes MITHOME-83	2026-08-23 10:22:22 +02:00
Do Siki	410b4a2e2f	docs: refresh all documentation to the current state ... - agent docs: Linear (ZEE-*) → Plane (MITHOME-*) everywhere (task tracking, commit examples, workflows, env vars) - testing steering: replace the obsolete Gherkin/Linear reporting with the pre-deploy suite and the CMS test scripts - README: rewrite to Next.js 15, local deploy, Plane, CMS, security monitoring - DOCKER/proto docs: correct dev-stack ports (app 8080, mongo 27018) and Next.js 15 - content-editor-recovery: mark the old 'next steps' as done - mark clearly-obsolete Linear/GitHub-era guides as deprecated (banner) — LINEAR-SYNC, GITHUB-CICD/INTEGRATION, TEST-MANAGEMENT/REPORTING, traceability, sync-status analysis, requirements docs	2026-08-22 19:41:50 +02:00
Do Siki	8ee5befe10	fix(security): real newlines in alert details for the ntfy body ... The \n in the accumulated alert text was a literal backslash-n, so the details would have rendered as one garbled line. printf -v now appends real newlines; the notification body joins header + details with a real line break.	2026-08-22 14:37:46 +02:00
Do Siki	164b19cdb8	fix(security): filter docker exec errors and include finding details in ntfy body ... - a container stopping mid-scan produced 'cannot exec in a stopped state' as a false-positive finding; such exec errors are now filtered out - the ntfy notification body now carries the actual alert lines, not just a counter	2026-08-22 14:33:06 +02:00
Do Siki	8903ec9562	fix(security): use project-specific ntfy topic st_limidev_security	2026-08-22 14:04:50 +02:00
Do Siki	de0bd2fc07	feat(security): push scan alerts to the local ntfy server ... On findings the scan now POSTs a high-priority notification to topic st_security on the host ntfy (127.0.0.1:2586), authenticated with the si_17t_pro token read from /etc/ntfy/credentials/auth.env (never logged). Topic/cred/URL overridable via env for testing.	2026-08-22 13:43:59 +02:00
Do Siki	00d6cf9786	sync: update TODO.md with MITHOME-82 (security scan)	2026-08-22 13:40:26 +02:00
Do Siki	28778aef88	feat(security): lightweight cryptominer/backdoor detection script ... Periodic host+container sweep for the exact indicators seen in the staging miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/ init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU containers. Findings are logged and exit 1 for cron MAILTO alerting. Closes MITHOME-82	2026-08-22 13:39:46 +02:00
DO Siki	46db2622d3	content: frissítve a CMS-ből	2026-08-22 13:39:29 +02:00
DO Siki	e715a3aa8b	content: frissítve a CMS-ből	2026-08-22 13:38:43 +02:00
Do Siki	c73cdd3b2f	sync: update TODO.md with MITHOME-78/79/80/81 (review fixes)	2026-08-22 12:39:20 +02:00
Do Siki	d908f6b1b4	chore(quality): type-check and lint gates in pre-deploy, clean lint/tsc ... - pre-deploy suite now runs tsc --noEmit and eslint; any failure aborts the release - fix all TypeScript errors (FooterConfig.copyright removed after the CMS move; test guards/casts) - fix all ESLint errors: <a>→<Link> and <img>→<Image> in Header/Footer, remove unused imports and explicit any in src - eslint config relaxes no-explicit-any/no-require-imports/no-unused-vars for test and CommonJS config files (legitimate usage) Closes MITHOME-81	2026-08-22 12:37:22 +02:00
Do Siki	162e5782e9	refactor(cms): split oversized modules below the 400-line limit ... - content-editor.js: extract the /save handler to scripts/cms-save.js - cms-logo-page.js: inline the ~280-line canvas editor script to scripts/cms-logo-client.js (page is now the HTML/CSS shell only) - cms-editor-client.js: move the keyboard-shortcut section to scripts/cms-editor-shortcuts.js, inlined after the main client All modules now under the hard limit; full pre-deploy suite green. Closes MITHOME-80	2026-08-22 12:31:28 +02:00
Do Siki	15529c7705	fix: contact length limits + logger/next.config nitpicks + dep updates ... - /api/contact enforces per-field length caps (name/email/subject/message) before sanitization/persistence; over-long message returns 400 without touching Mongo (test added) - logger: crypto-based request id (randomUUID) instead of Math.random().substr; defaultMeta.version prefers DEPLOY_VERSION over npm_package_version - next.config: move Turbopack svg rule from deprecated experimental.turbo to top-level turbopack - deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are transitive sharp/libvips DoS advisories, not exploitable for static images) Closes MITHOME-78, MITHOME-79	2026-08-22 12:22:27 +02:00
Do Siki	b8f9e8cfdf	sync: update TODO.md with MITHOME-77 (web hygiene)	2026-08-22 12:14:42 +02:00
Do Siki	9f1fb349c2	fix(web): hygiene — OG image/metadataBase, Header a11y text + nav flag, dead code ... - siteConfig.ogImage pointed to an existing asset; metadataBase added so relative OG/Twitter URLs resolve against the real origin instead of localhost - Header sr-only menu label moved to common.json (a11y.openMenu/closeMenu); navigation primary styling driven by a NavigationItem.primary flag instead of brittle 'Kapcsolat' string comparisons - remove dead code: lib/site-config.ts (unused hybrid config) and the unused, schema-divergent siteConfig.contact.form - ContactConfig type cleaned up (address/form removed) Closes MITHOME-77	2026-08-22 12:12:48 +02:00
Do Siki	4c2913e131	feat(cms): add interactive canvas logo editor modal ... Closes MITHOME-76: - Interactive Canvas-based modal for logo editing in CMS - Crop with presets (1:1, 3:1, 4:1, 16:9, free) - Drag-to-pan positioning and wheel/slider zoom - 90 deg rotation and horizontal/vertical flip - Configurable padding/margins around logo - Brightness, contrast, and color invert filters - Direct high-DPI (2x retina) PNG export and atomic save	2026-08-20 11:53:23 +02:00
Do Siki	c5d5198fbf	fix(cms): implement v2 security and stability review findings ... Resolves: - CSRF false positive checked (global POST protection) - Publish mutex to prevent git lock / double deploy - Basic Auth rate limit checked before credential evaluation - Memory leak in rate limiter (added GC interval) - XSS in Toast messages - XSS in data-path attribute - CI healthcheck port mismatch (3000 -> 8080) - Added security headers (X-Frame-Options, X-Content-Type-Options)	2026-08-20 11:35:01 +02:00
Do Siki	768297031d	sync: update TODO.md with MITHOME-75 (keyboard shortcuts)	2026-08-19 22:53:54 +02:00
Do Siki	6030c48abb	feat(cms): keyboard shortcuts — Ctrl+S save, Ctrl+P publish, ? help ... - Ctrl/Cmd+S saves (native browser save dialog suppressed) - Ctrl/Cmd+P publishes; Ctrl/Cmd+Shift+V opens the Versions panel - '?' toggles a shortcuts overlay (Esc/click closes) - plain typing in inputs never triggers actions (modifiers required; '?' only outside editing targets) - jsdom regression tests run the real client script with dispatched KeyboardEvents; the client is evaluated once per suite because each eval would stack another keydown listener on the shared document Closes MITHOME-75	2026-08-19 22:52:09 +02:00
DO Siki	8f72b91fb1	content: frissítve a CMS-ből	2026-08-19 22:33:59 +02:00
Do Siki	db0e898ac4	sync: update TODO.md with MITHOME-74 (publish deploy cwd fix)	2026-08-19 17:41:52 +02:00
DO Siki	2846edfa6e	content: frissítve a CMS-ből	2026-08-19 17:39:30 +02:00
Do Siki	02d6755874	test(footer): assert address from common.json instead of hardcoded city ... The footer address is CMS-editable now; the test must follow the single source instead of a fixed city.	2026-08-19 17:37:36 +02:00
Do Siki	42533ec0aa	fix(cms): deploy exec was missing cwd — landed on / and never ran ... Root cause of publishes not rebuilding the site: the deploy exec child started in the process working directory (repo root), so 'cd ../../../' resolved to the filesystem root, where creating deploy.log failed with Permission denied. The git publish command already used cwd: CONTENT_DIR; the deploy child now does too (caught via live cwd/touch diagnostics in the service context). Closes MITHOME-74	2026-08-19 17:14:02 +02:00
DO Siki	d0270547cc	content: frissítve a CMS-ből	2026-08-19 17:12:37 +02:00
DO Siki	7b3bd2b78b	content: frissítve a CMS-ből	2026-08-19 17:12:35 +02:00
DO Siki	cb1084c0c7	content: frissítve a CMS-ből	2026-08-19 17:11:51 +02:00
DO Siki	3ba453d0a1	content: frissítve a CMS-ből	2026-08-19 17:11:49 +02:00
DO Siki	2ae5247cc6	content: frissítve a CMS-ből	2026-08-19 17:10:27 +02:00
DO Siki	7f4efbde98	content: frissítve a CMS-ből	2026-08-19 17:10:25 +02:00
DO Siki	ce14b6716b	content: frissítve a CMS-ből	2026-08-19 17:08:12 +02:00
DO Siki	6019b8b459	content: frissítve a CMS-ből	2026-08-19 17:08:10 +02:00
DO Siki	5ab3abba2a	content: frissítve a CMS-ből	2026-08-19 17:01:11 +02:00
Do Siki	1fb787413f	sync: update TODO.md with MITHOME-73 (CMS-editable address)	2026-08-19 16:56:19 +02:00
Do Siki	9365c0f1ee	feat(footer): CMS-editable company address (common.json footer.address) ... 'Budapest, Magyarország' lived hardcoded in site.ts. It now lives in common.json (footer.address), editable via the Közös szövegek tab, and both consumers (Footer, Kapcsolat page) read it from there — single source. Schema and types extended; site.ts keeps only the email. Closes MITHOME-73	2026-08-19 16:53:16 +02:00
Do Siki	9c7dc1d35e	sync: update TODO.md with MITHOME-72 (publish deploy reliability)	2026-08-19 15:34:55 +02:00
DO Siki	bbe0ff4c0a	content: frissítve a CMS-ből	2026-08-19 15:31:13 +02:00