37 Commits

Include renames

Author	SHA1	Message	Date
Do Siki	f65c22987f	feat: partners section on the homepage (logo + URL, CMS upload) ... - home.json gains a partners block (title/subtitle/items: name, url, logo), rendered on the homepage under the services section (next/image logos linking out with rel=noopener) - CMS: partner logos uploadable from the 🎨 Logó page via POST /partner-logo (PNG, 1 MiB cap, filename sanitized to a slug, written to public/partners/) - schema + types extended; guide updated Closes MITHOME-83	2026-08-23 10:22:22 +02:00
Do Siki	8ee5befe10	fix(security): real newlines in alert details for the ntfy body ... The \n in the accumulated alert text was a literal backslash-n, so the details would have rendered as one garbled line. printf -v now appends real newlines; the notification body joins header + details with a real line break.	2026-08-22 14:37:46 +02:00
Do Siki	164b19cdb8	fix(security): filter docker exec errors and include finding details in ntfy body ... - a container stopping mid-scan produced 'cannot exec in a stopped state' as a false-positive finding; such exec errors are now filtered out - the ntfy notification body now carries the actual alert lines, not just a counter	2026-08-22 14:33:06 +02:00
Do Siki	8903ec9562	fix(security): use project-specific ntfy topic st_limidev_security	2026-08-22 14:04:50 +02:00
Do Siki	de0bd2fc07	feat(security): push scan alerts to the local ntfy server ... On findings the scan now POSTs a high-priority notification to topic st_security on the host ntfy (127.0.0.1:2586), authenticated with the si_17t_pro token read from /etc/ntfy/credentials/auth.env (never logged). Topic/cred/URL overridable via env for testing.	2026-08-22 13:43:59 +02:00
Do Siki	28778aef88	feat(security): lightweight cryptominer/backdoor detection script ... Periodic host+container sweep for the exact indicators seen in the staging miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/ init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU containers. Findings are logged and exit 1 for cron MAILTO alerting. Closes MITHOME-82	2026-08-22 13:39:46 +02:00
Do Siki	d908f6b1b4	chore(quality): type-check and lint gates in pre-deploy, clean lint/tsc ... - pre-deploy suite now runs tsc --noEmit and eslint; any failure aborts the release - fix all TypeScript errors (FooterConfig.copyright removed after the CMS move; test guards/casts) - fix all ESLint errors: <a>→<Link> and <img>→<Image> in Header/Footer, remove unused imports and explicit any in src - eslint config relaxes no-explicit-any/no-require-imports/no-unused-vars for test and CommonJS config files (legitimate usage) Closes MITHOME-81	2026-08-22 12:37:22 +02:00
Do Siki	162e5782e9	refactor(cms): split oversized modules below the 400-line limit ... - content-editor.js: extract the /save handler to scripts/cms-save.js - cms-logo-page.js: inline the ~280-line canvas editor script to scripts/cms-logo-client.js (page is now the HTML/CSS shell only) - cms-editor-client.js: move the keyboard-shortcut section to scripts/cms-editor-shortcuts.js, inlined after the main client All modules now under the hard limit; full pre-deploy suite green. Closes MITHOME-80	2026-08-22 12:31:28 +02:00
Do Siki	4c2913e131	feat(cms): add interactive canvas logo editor modal ... Closes MITHOME-76: - Interactive Canvas-based modal for logo editing in CMS - Crop with presets (1:1, 3:1, 4:1, 16:9, free) - Drag-to-pan positioning and wheel/slider zoom - 90 deg rotation and horizontal/vertical flip - Configurable padding/margins around logo - Brightness, contrast, and color invert filters - Direct high-DPI (2x retina) PNG export and atomic save	2026-08-20 11:53:23 +02:00
Do Siki	c5d5198fbf	fix(cms): implement v2 security and stability review findings ... Resolves: - CSRF false positive checked (global POST protection) - Publish mutex to prevent git lock / double deploy - Basic Auth rate limit checked before credential evaluation - Memory leak in rate limiter (added GC interval) - XSS in Toast messages - XSS in data-path attribute - CI healthcheck port mismatch (3000 -> 8080) - Added security headers (X-Frame-Options, X-Content-Type-Options)	2026-08-20 11:35:01 +02:00
Do Siki	6030c48abb	feat(cms): keyboard shortcuts — Ctrl+S save, Ctrl+P publish, ? help ... - Ctrl/Cmd+S saves (native browser save dialog suppressed) - Ctrl/Cmd+P publishes; Ctrl/Cmd+Shift+V opens the Versions panel - '?' toggles a shortcuts overlay (Esc/click closes) - plain typing in inputs never triggers actions (modifiers required; '?' only outside editing targets) - jsdom regression tests run the real client script with dispatched KeyboardEvents; the client is evaluated once per suite because each eval would stack another keydown listener on the shared document Closes MITHOME-75	2026-08-19 22:52:09 +02:00
Do Siki	14a72a3ffe	fix(cms): keep version tag fresh — deploy restarts CMS, editor page no-store ... The version tag is the git SHA read at CMS startup, but the deploy script only rebuilt the website container, leaving the tag stale (v8838304 shown after aa8d926 was live). The local deploy script now restarts the CMS service after the server-side deploy (the CMS publish flow is unaffected — it calls deploy.sh directly and never restarts itself). The editor main page also gains Cache-Control: no-store so browsers stop caching it. Closes MITHOME-71	2026-08-19 14:38:40 +02:00
Do Siki	aa8d92646c	test(cms): run-unique markers so a crashed run cannot poison the next ... The versions integration test asserted against fixed marker strings; if a run crashed before restoring contact.json, the next run read the polluted file as its baseline and its expectations collapsed. Markers now carry a per-run timestamp.	2026-08-19 14:30:58 +02:00
Do Siki	5db71998eb	feat(test): comprehensive pre-deploy test suite as single entry point ... scripts/pre-deploy-tests.sh runs every local test group before a deploy: proto unit (jest), content schema validation, all CMS integration suites (security, serializer, save, optimistic lock, versions, logo, login, logout, guide, bottom bar), publish command/integration and plane sync unit tests. Per-group PASS/FAIL summary; non-zero exit on any failure. deploy_to_stage_on_local.sh now runs the full suite as step 1 — a failing group aborts the release before push. Deploy workflow docs updated. Closes MITHOME-70	2026-08-19 14:15:33 +02:00
Do Siki	88383049d5	fix(cms): stable bottom bar and self-save no longer trips the 409 lock ... MITHOME-68: the optimistic-lock fingerprint was frozen at page load, so the user's own second save 409'd. /save now returns the hash of the written content and the client refreshes CONTENT_HASH on success — 409 only fires for genuine external changes (deploy, other tab, restore). Also: successful logins no longer consume the auth failure budget (only failed attempts do). MITHOME-69: bottom bar items no longer shift while saving/publishing — the status message occupies a constant flex slot (visibility instead of display), the publish button locks its width while running and restores its env-specific label, auto margins removed. Layout guard test added. Test markers are now run-unique so a crashed run can never poison the next one's expectations.	2026-08-19 14:04:49 +02:00
Do Siki	5d2141ec88	fix(cms): capture array container before node removal so reindex runs ... The ❌ delete buttons called wrap.closest('.array-items') AFTER remove(); a detached node has no ancestors, so closest() returned null and reindexItems() silently skipped. Remaining items kept their old indices, collect() produced sparse arrays (null holes) and saves failed schema validation, e.g. '$.details.services[1].specs.items[0]: string érték szükséges'. Capture the container before remove() for both str-item and obj-card delete handlers. Regression test runs the real browser script in jsdom and clicks the actual delete buttons (nested string array + object card reindexing). Closes MITHOME-67	2026-08-19 13:30:53 +02:00
Do Siki	19f2fdfece	refactor(cms): extract /versions and /restore route handling to cms-versions.js ... Companion to the cms-logo.js extraction: keeps content-editor.js under the 400-line hard limit. No behavior change — covered by test-content-editor-versions.js.	2026-08-19 12:47:24 +02:00
Do Siki	d2ee13bb91	feat(cms): logo upload with preview, backup and audit ... - 🎨 Logó page in the CMS bottom bar: replace the website header logo and the CMS login icon with a PNG upload (magic-byte validation, 1 MiB cap) - the replaced logo gets a timestamped backup in .content-backups; every upload is audited (logo_updated) - /logo.png?variant=header serves the header variant for the preview - publish stages proto/public too, so logo changes ride the same commit+deploy pipeline as content - route handling extracted to scripts/cms-logo.js to stay under the 400-line limit - integration test: upload+replace+backup, variant preview, 415/413/400, CSRF, auth Closes MITHOME-65	2026-08-19 12:46:55 +02:00
Do Siki	a55ce53768	feat(cms): version history panel with diff view and one-click restore ... - GET /versions lists the automatic backups of the selected file (timestamp, size); ?show=<backup> renders a line diff against the current content - POST /restore validates the backup against the content schema and restores it atomically; the pre-restore state gets a fresh backup first, so a restore itself is reversible; audited as version_restored - dependency-free LCS line diff (scripts/cms-diff.js) with add/del highlighting and context trimming; backup names validated against a strict pattern (path traversal impossible) - new 🕘 Verziók entry in the CMS bottom bar - refactor: security/infra helpers extracted to scripts/cms-core.js to keep content-editor.js under the 400-line hard limit - integration test: list, diff, restore + reversibility backup, traversal rejection, CSRF enforcement, auth Closes MITHOME-64	2026-08-18 23:45:39 +02:00
Do Siki	3a5a09c361	feat: expose deploy version (git SHA) on CMS and health endpoint ... 'Is the fix live?' becomes a single check instead of an SSH session: - CMS: git short SHA read at startup, shown in the bottom bar (v<sha>), served by the public GET /version endpoint, recorded in a startup audit entry - Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it via build ARG into the runtime env, /api/health reports it as deployVersion, smoke test asserts a non-'unversioned' stamp Closes MITHOME-63	2026-08-18 21:19:43 +02:00
Do Siki	a7b1a2cab2	fix(cms): Safari-compatible authentication ... Safari-specific deviations fixed: 1. Safari shows its native auth dialog on fetch() calls answered with a 401 + WWW-Authenticate challenge (e.g. save with an expired session). All CMS 401 responses now omit WWW-Authenticate; browsers use the styled /login page instead. 2. Safari caches Basic credentials and resends them automatically, which made logout ineffective (a navigation after logout went straight back into the editor). Browser navigations (GET + text/html) now authenticate ONLY via the session cookie; Basic Auth remains valid for non-browser clients (curl, API). 3. /login and redirects send Cache-Control: no-store so Safari does not cache the login page or the 302. Closes MITHOME-62	2026-08-18 21:14:12 +02:00
Do Siki	3818859cc5	feat(cms): optimistic locking against stale-tab overwrites ... A Content Editor tab left open across a deploy (or a save from another tab) held the pre-deploy content; one Save would silently overwrite the newer file. The editor page now embeds a SHA-256 fingerprint of the file content at load time, /save requires it back in X-Content-Hash and compares against the current file: mismatch (or a missing header) answers 409 with an explanatory message and writes nothing. The client offers a reload on 409. Integration test covers: matching hash saves, stale hash rejected with the file untouched, missing hash rejected, retry with the fresh hash succeeds. Closes MITHOME-61	2026-08-18 20:57:08 +02:00
Do Siki	c4c89f644e	fix(cms): deploy only on real changes, abort failed rebases, test publish ... Review follow-up on MITHOME-59: - no-op publish no longer triggers a background deploy (deploy moved behind a deterministic hadChanges flag) - replace output-regex classification ('Already up to date.' also appears on real publishes when the remote did not move, which misclassified them as no_changes) with an explicit __NO_CONTENT_CHANGES__ marker echoed by the shell skip-branch - failed git pull --rebase is aborted immediately so the repo is never left mid-rebase; the error is reported and nothing is pushed or deployed - command + interpretation extracted to scripts/cms-publish.js - CONTENT_EDITOR_CONTENT_DIR / CONTENT_EDITOR_DEPLOY_CMD env overrides enable an integration test against throwaway git repos covering: no-change skip, real publish + deploy, rebase conflict abort - .gitignore: drop patterns already covered by .env.* - user guide: new no-changes message Closes MITHOME-60	2026-08-18 20:25:12 +02:00
Do Siki	84a4527838	fix(cms): robust git publish workflow and untracked env handling ... - add .env.staging and .env.production patterns to .gitignore so local env files are ignored - use robust publish command: git add . && (git diff --cached --quiet || git commit ...) && git pull --rebase origin main && git push origin main - expand no-changes detection in publish response handling Closes MITHOME-59	2026-08-18 20:17:35 +02:00
Do Siki	5fe36584dd	feat(cms): confirm-before-logout and branded login page ... - logout asks for confirmation, then invalidates the server-side session and navigates to a public /login page (logo, form, error messages) - POST /login validates credentials (timing-safe) and issues an HttpOnly SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth stays valid in parallel for curl/API use - unauthenticated browser navigations redirect to /login; non-browser requests keep the 401 challenge - failed form logins share the auth rate-limit budget with Basic attempts - save/publish redirect to /login when the session expired - refactor: templates and browser script extracted to scripts/cms-pages.js and scripts/cms-editor-client.js, session logic to scripts/cms-session.js (content-editor.js back under the 400-line limit) - user guide updated (login page, confirmation, 8h session) Closes MITHOME-58	2026-08-18 14:01:42 +02:00
Do Siki	1d3abc8cba	feat(cms): add maintained user guide with Súgó menu entry ... - docs/felhasznaloi-utmutato.md: user guide for the website and the CMS (login, editing, arrays, save/validation, publish, security) - /guide endpoint renders the markdown auth-protected via a dependency-free renderer (scripts/markdown-render.js) in the CMS dark theme - new ❓ Súgó entry in the CMS bottom bar - steering rule: the guide must be updated in the same commit as any CMS or website feature change Closes MITHOME-57	2026-08-18 13:20:44 +02:00
Do Siki	1b45ae302c	feat(cms): add logout to Content Editor ... Basic Auth credentials are cached by the browser until it closes, so the editor had no real logout. Add a /logout endpoint (always answers 401 with a challenge; deliberately exempt from the auth rate limiter so logging out never locks the user out) and a Kilépés button that overwrites the cached credentials with an invalid pair via fetch, then reloads into the login prompt. Closes MITHOME-56	2026-08-18 13:14:49 +02:00
Do Siki	713d89b09c	fix(cms): reindex nested array paths correctly in Content Editor ... reindexItems replaced the FIRST [n] index in a data-path, which for nested arrays (e.g. services[1].specs.items) rewrote the OUTER array index instead of the item's own index. Deleting or adding an item scattered paths across services[0..n], produced sparse arrays (null items) and schema errors like '$.details.services[1].specs.items[0]: string érték szükséges'. Rewrite only the index directly following the reindexed array's path prefix; drop the now-redundant str-item special case. Closes MITHOME-30	2026-08-18 12:53:18 +02:00
Do Siki	bd7287aa58	fix: address code review findings from 2026-08-17 ... - scope no-cache headers to non-static routes (restore immutable asset caching) - reset cached rejected MongoDB promise so retries can succeed - use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing) - remove weak Mongo defaults from compose files (fail loudly on missing env) - move staging banner text to common.json content - read APP_PORT from env file in deploy.sh healthcheck - filter network noise from staging smoke console assertions Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54	2026-08-18 12:21:32 +02:00
Do Siki	d355ce38a7	fix: make CMS publish environment explicit	2026-08-17 17:25:51 +02:00
Do Siki	6d59dc8f37	feat: add local staging deploy workflow	2026-08-17 16:50:39 +02:00
Do Siki	724baf65b3	docs: add Gitea runner installation	2026-08-17 16:36:35 +02:00
Do Siki	0047e1b441	feat: harden content workflows and staging smoke tests	2026-08-17 16:08:57 +02:00
Do Siki	52f4f524c5	fix(sync): normalize section separators in regenerate() ... A previous run could merge the '---' separator with the next section header (---## ✅ Befejezett), breaking section detection. Prefix/suffix are now trimmed and rejoined with fixed separators. Regression test added; also create Plane issues for local-only completed work (MITHOME-28 Custom CMS, MITHOME-29 Webmail) to avoid ID collisions.	2026-08-17 13:29:25 +02:00
Do Siki	f918e300a6	feat(plane): add Plane-TODO sync script ... Add plane-sync.js one-way (Plane -> TODO.md) synchronization for the MITHOME project. Config reads from .mcp.json with .env override. CLI: --list, --dry-run, --yes, --project, --verbose, --help. Interactive discrepancy resolution (status mismatches, orphans, new issues), backup before write, rate limiting. Pure functions covered by node:test unit tests. Includes PLANE-SYNC-GUIDE.md and TODO.md changelog entry.	2026-08-17 12:18:55 +02:00
Do Siki	e413bab812	refactor: update testing architecture, improve CI/CD workflows, and standardize documentation across the project.	2026-04-26 20:20:53 +02:00
Do Siki	b0df8dd182	feat: enhance README and TODO documentation, implement mobile menu functionality in Header component ... - Updated README.md with project details, quick start instructions, and tech stack. - Expanded TODO.md to reflect current project status and backlog items, including Linear ticket synchronization. - Added mobile menu toggle functionality in Header component with corresponding tests for user interactions. - Configured Next.js for Docker deployment and optimized build settings.	2025-09-05 17:28:52 +02:00