91 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Do Siki	fe4a6a1e92	feat(footer): CMS-editable copyright with 2002–current year range ... The copyright text lived in site.ts with a build-time year and was not CMS-editable. It now lives in common.json (footer.copyright, editable via the Közös szövegek tab) with a {year} placeholder that resolves to the current year at render: '© 2002–{year} mozdIT Bt. Minden jog fenntartva.' Schema and types extended; site.ts keeps only the footer links. Closes MITHOME-66	2026-08-19 12:44:48 +02:00
Do Siki	03615d5959	sync: update TODO.md with MITHOME-64 (versions panel)	2026-08-18 23:46:13 +02:00
Do Siki	a55ce53768	feat(cms): version history panel with diff view and one-click restore ... - GET /versions lists the automatic backups of the selected file (timestamp, size); ?show=<backup> renders a line diff against the current content - POST /restore validates the backup against the content schema and restores it atomically; the pre-restore state gets a fresh backup first, so a restore itself is reversible; audited as version_restored - dependency-free LCS line diff (scripts/cms-diff.js) with add/del highlighting and context trimming; backup names validated against a strict pattern (path traversal impossible) - new 🕘 Verziók entry in the CMS bottom bar - refactor: security/infra helpers extracted to scripts/cms-core.js to keep content-editor.js under the 400-line hard limit - integration test: list, diff, restore + reversibility backup, traversal rejection, CSRF enforcement, auth Closes MITHOME-64	2026-08-18 23:45:39 +02:00
Do Siki	d15cc05c36	sync: update TODO.md with MITHOME-63 (deploy versioning)	2026-08-18 21:24:23 +02:00
Do Siki	e2a8ac13eb	fix(deploy): declare DEPLOY_VERSION ARG in the runner stage ... ENV does not carry across build stages: the value set in the builder never reached the running container, so /api/health reported deployVersion: null and SMOKE-01 failed. Re-declare the ARG in the runner stage.	2026-08-18 21:22:40 +02:00
Do Siki	3a5a09c361	feat: expose deploy version (git SHA) on CMS and health endpoint ... 'Is the fix live?' becomes a single check instead of an SSH session: - CMS: git short SHA read at startup, shown in the bottom bar (v<sha>), served by the public GET /version endpoint, recorded in a startup audit entry - Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it via build ARG into the runtime env, /api/health reports it as deployVersion, smoke test asserts a non-'unversioned' stamp Closes MITHOME-63	2026-08-18 21:19:43 +02:00
Do Siki	edd2e46ae3	sync: update TODO.md with MITHOME-62 (Safari-compatible auth)	2026-08-18 21:14:45 +02:00
Do Siki	a7b1a2cab2	fix(cms): Safari-compatible authentication ... Safari-specific deviations fixed: 1. Safari shows its native auth dialog on fetch() calls answered with a 401 + WWW-Authenticate challenge (e.g. save with an expired session). All CMS 401 responses now omit WWW-Authenticate; browsers use the styled /login page instead. 2. Safari caches Basic credentials and resends them automatically, which made logout ineffective (a navigation after logout went straight back into the editor). Browser navigations (GET + text/html) now authenticate ONLY via the session cookie; Basic Auth remains valid for non-browser clients (curl, API). 3. /login and redirects send Cache-Control: no-store so Safari does not cache the login page or the 302. Closes MITHOME-62	2026-08-18 21:14:12 +02:00
Do Siki	27b84cb87c	sync: update TODO.md with MITHOME-61 (optimistic locking)	2026-08-18 20:57:35 +02:00
Do Siki	3818859cc5	feat(cms): optimistic locking against stale-tab overwrites ... A Content Editor tab left open across a deploy (or a save from another tab) held the pre-deploy content; one Save would silently overwrite the newer file. The editor page now embeds a SHA-256 fingerprint of the file content at load time, /save requires it back in X-Content-Hash and compares against the current file: mismatch (or a missing header) answers 409 with an explanatory message and writes nothing. The client offers a reload on 409. Integration test covers: matching hash saves, stale hash rejected with the file untouched, missing hash rejected, retry with the fresh hash succeeds. Closes MITHOME-61	2026-08-18 20:57:08 +02:00
Do Siki	bdf9aac4d0	content: apply copy review — concrete, credible claims and CTAs ... - hero: state the actual offering (hosting, mail, domains) instead of a mission statement - security USP: list concrete measures instead of 'maximális teljesítmény' promise - hosting: replace '99% uptime garancia' with the 99.9% availability goal (excluding planned maintenance) — no absolute guarantee claim without SLA backing - email: encrypted webmail/IMAP access wording; domain: registration, renewal and DNS in one place; SPF/DKIM/DMARC explained by purpose - per-service CTA texts instead of the generic 'További információk' - main CTA: 'Kérjen személyre szabott konzultációt' (smoke test updated to match) - bottom CTA asks the visitor to describe their need briefly	2026-08-18 20:39:24 +02:00
DO Siki	e03662b620	content: frissítve a CMS-ből	2026-08-18 20:31:39 +02:00
Do Siki	fff834a48a	sync: update TODO.md with MITHOME-60 (publish hardening)	2026-08-18 20:25:45 +02:00
Do Siki	c4c89f644e	fix(cms): deploy only on real changes, abort failed rebases, test publish ... Review follow-up on MITHOME-59: - no-op publish no longer triggers a background deploy (deploy moved behind a deterministic hadChanges flag) - replace output-regex classification ('Already up to date.' also appears on real publishes when the remote did not move, which misclassified them as no_changes) with an explicit __NO_CONTENT_CHANGES__ marker echoed by the shell skip-branch - failed git pull --rebase is aborted immediately so the repo is never left mid-rebase; the error is reported and nothing is pushed or deployed - command + interpretation extracted to scripts/cms-publish.js - CONTENT_EDITOR_CONTENT_DIR / CONTENT_EDITOR_DEPLOY_CMD env overrides enable an integration test against throwaway git repos covering: no-change skip, real publish + deploy, rebase conflict abort - .gitignore: drop patterns already covered by .env.* - user guide: new no-changes message Closes MITHOME-60	2026-08-18 20:25:12 +02:00
Do Siki	8afc4e6899	sync: update TODO.md with MITHOME-59 (CMS publish fix)	2026-08-18 20:17:46 +02:00
Do Siki	84a4527838	fix(cms): robust git publish workflow and untracked env handling ... - add .env.staging and .env.production patterns to .gitignore so local env files are ignored - use robust publish command: git add . && (git diff --cached --quiet || git commit ...) && git pull --rebase origin main && git push origin main - expand no-changes detection in publish response handling Closes MITHOME-59	2026-08-18 20:17:35 +02:00
DO Siki	c2cc701032	content: frissítve a CMS-ből	2026-08-18 20:16:08 +02:00
Do Siki	e6a18630f2	sync: update TODO.md with MITHOME-58 (CMS login page)	2026-08-18 14:02:11 +02:00
Do Siki	5fe36584dd	feat(cms): confirm-before-logout and branded login page ... - logout asks for confirmation, then invalidates the server-side session and navigates to a public /login page (logo, form, error messages) - POST /login validates credentials (timing-safe) and issues an HttpOnly SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth stays valid in parallel for curl/API use - unauthenticated browser navigations redirect to /login; non-browser requests keep the 401 challenge - failed form logins share the auth rate-limit budget with Basic attempts - save/publish redirect to /login when the session expired - refactor: templates and browser script extracted to scripts/cms-pages.js and scripts/cms-editor-client.js, session logic to scripts/cms-session.js (content-editor.js back under the 400-line limit) - user guide updated (login page, confirmation, 8h session) Closes MITHOME-58	2026-08-18 14:01:42 +02:00
Do Siki	9880b5b1d5	docs: add /cms-feature workflow for CMS development ... Procedural companion to the steering rule: implementation constraints (no node_modules, CSRF, secret handling), mandatory guide update in the same commit, the CMS test suite to run, and staging restart + verification steps.	2026-08-18 13:29:56 +02:00
Do Siki	1d3abc8cba	feat(cms): add maintained user guide with Súgó menu entry ... - docs/felhasznaloi-utmutato.md: user guide for the website and the CMS (login, editing, arrays, save/validation, publish, security) - /guide endpoint renders the markdown auth-protected via a dependency-free renderer (scripts/markdown-render.js) in the CMS dark theme - new ❓ Súgó entry in the CMS bottom bar - steering rule: the guide must be updated in the same commit as any CMS or website feature change Closes MITHOME-57	2026-08-18 13:20:44 +02:00
Do Siki	8be8c2b552	sync: update TODO.md with MITHOME-56 (CMS logout)	2026-08-18 13:15:20 +02:00
Do Siki	1b45ae302c	feat(cms): add logout to Content Editor ... Basic Auth credentials are cached by the browser until it closes, so the editor had no real logout. Add a /logout endpoint (always answers 401 with a challenge; deliberately exempt from the auth rate limiter so logging out never locks the user out) and a Kilépés button that overwrites the cached credentials with an invalid pair via fetch, then reloads into the login prompt. Closes MITHOME-56	2026-08-18 13:14:49 +02:00
Do Siki	d1cf36bc48	docs: add mandatory secret-handling rule to steering documents ... Secrets must never be displayed in the conversation — communicate only their storage location; mask values when reading configs; verify auth via status codes instead of echoing credentials.	2026-08-18 13:08:03 +02:00
Do Siki	713d89b09c	fix(cms): reindex nested array paths correctly in Content Editor ... reindexItems replaced the FIRST [n] index in a data-path, which for nested arrays (e.g. services[1].specs.items) rewrote the OUTER array index instead of the item's own index. Deleting or adding an item scattered paths across services[0..n], produced sparse arrays (null items) and schema errors like '$.details.services[1].specs.items[0]: string érték szükséges'. Rewrite only the index directly following the reindexed array's path prefix; drop the now-redundant str-item special case. Closes MITHOME-30	2026-08-18 12:53:18 +02:00
Do Siki	afcbdc26bf	docs: update deploy workflow to current staging pipeline ... - document one-command local staging release (deploy_to_stage_on_local.sh) - add deploy.sh steps: mandatory env file, force-recreate, healthcheck - add CMS publish flow with explicit CMS_DEPLOY_ENV - note Gitea Actions is paused until a dedicated runner host exists - fix dev stack ports in local Docker section	2026-08-18 12:26:20 +02:00
Do Siki	50129d4b92	chore: ignore local PLATFM-1 plan document	2026-08-18 12:21:32 +02:00
Do Siki	bd7287aa58	fix: address code review findings from 2026-08-17 ... - scope no-cache headers to non-static routes (restore immutable asset caching) - reset cached rejected MongoDB promise so retries can succeed - use last X-Forwarded-For entry in Content Editor rate limiter (anti-spoofing) - remove weak Mongo defaults from compose files (fail loudly on missing env) - move staging banner text to common.json content - read APP_PORT from env file in deploy.sh healthcheck - filter network noise from staging smoke console assertions Closes MITHOME-48, MITHOME-49, MITHOME-50, MITHOME-51, MITHOME-52, MITHOME-53, MITHOME-54	2026-08-18 12:21:32 +02:00
DO Siki	93aaa10a36	content: frissítve a CMS-ből	2026-08-17 22:07:38 +02:00
Do Siki	a380bf2b5b	fix: keep browser chrome neutral on staging	2026-08-17 17:56:39 +02:00
Do Siki	148618b880	fix: keep staging marker in CMS only	2026-08-17 17:53:41 +02:00
Do Siki	f821b35b35	feat: mark staging website clearly	2026-08-17 17:48:05 +02:00
Do Siki	9ce420ef71	fix: limit cache bypass to browser revalidation	2026-08-17 17:42:37 +02:00
Do Siki	29b10c6770	feat: disable website caching	2026-08-17 17:37:36 +02:00
DO Siki	0d7d0b51a5	content: frissítve a CMS-ből	2026-08-17 17:35:24 +02:00
DO Siki	db5728958c	content: frissítve a CMS-ből	2026-08-17 17:35:07 +02:00
Do Siki	47179658e5	feat: mark staging CMS interface clearly	2026-08-17 17:34:14 +02:00
Do Siki	278c9a2545	fix: rate limit CMS clients by forwarded address	2026-08-17 17:31:31 +02:00
Do Siki	d355ce38a7	fix: make CMS publish environment explicit	2026-08-17 17:25:51 +02:00
Do Siki	ea00a136ac	fix: bind Next server to all container interfaces	2026-08-17 17:03:41 +02:00
Do Siki	2c9d3d01f1	fix: defer MongoDB connection until runtime	2026-08-17 17:00:41 +02:00
Do Siki	82124f3d2b	fix: force staging container recreation	2026-08-17 16:57:17 +02:00
Do Siki	e01ce22d1e	fix: use IPv4 staging healthcheck	2026-08-17 16:53:21 +02:00
Do Siki	6d59dc8f37	feat: add local staging deploy workflow	2026-08-17 16:50:39 +02:00
Do Siki	724baf65b3	docs: add Gitea runner installation	2026-08-17 16:36:35 +02:00
Do Siki	0047e1b441	feat: harden content workflows and staging smoke tests	2026-08-17 16:08:57 +02:00
Do Siki	35e341d5b2	chore: rename Tartalom Szerkesztő to Content Editor	2026-08-17 13:52:29 +02:00
Do Siki	52f4f524c5	fix(sync): normalize section separators in regenerate() ... A previous run could merge the '---' separator with the next section header (---## ✅ Befejezett), breaking section detection. Prefix/suffix are now trimmed and rejoined with fixed separators. Regression test added; also create Plane issues for local-only completed work (MITHOME-28 Custom CMS, MITHOME-29 Webmail) to avoid ID collisions.	2026-08-17 13:29:25 +02:00
Do Siki	35bf43798d	feat(deploy): add staging environment with dedicated docker compose ... - Add docker-compose.staging.yml (app on 127.0.0.1:8081, separate MongoDB on 127.0.0.1:27019, dedicated volume/network) - deploy.sh: select compose file and port per environment (staging 8081, production 8080) - Dockerfile: accept NEXT_PUBLIC_SITE_URL as build arg (inlined at build time for NEXT_PUBLIC_ vars); pass it in both compose files - Add .env.staging.example and .env.production.example	2026-08-17 13:07:51 +02:00
Do Siki	c37787251b	chore(deploy): remove Dokploy, switch to native docker compose + Gitea Actions ... - Remove Dokploy deploy jobs from GitHub CI workflow (test + build only) - Add .gitea/workflows/ci.yml (Gitea Actions: lint, tests, docker build verify) - Rewrite deploy.sh: set -euo pipefail, mandatory .env.<env>, --env-file, healthcheck on /api/health with log dump on failure - Delete Dokploy-specific docs (3 files), update references in README, TODO.md, architecture.md, guides, dev plan - Remove DOKPLOY_* env vars from proto/.env.local	2026-08-17 12:19:02 +02:00