- GET /versions lists the automatic backups of the selected file (timestamp,
size); ?show=<backup> renders a line diff against the current content
- POST /restore validates the backup against the content schema and restores
it atomically; the pre-restore state gets a fresh backup first, so a
restore itself is reversible; audited as version_restored
- dependency-free LCS line diff (scripts/cms-diff.js) with add/del
highlighting and context trimming; backup names validated against a strict
pattern (path traversal impossible)
- new 🕘 Verziók entry in the CMS bottom bar
- refactor: security/infra helpers extracted to scripts/cms-core.js to keep
content-editor.js under the 400-line hard limit
- integration test: list, diff, restore + reversibility backup, traversal
rejection, CSRF enforcement, auth
Closes MITHOME-64
'Is the fix live?' becomes a single check instead of an SSH session:
- CMS: git short SHA read at startup, shown in the bottom bar (v<sha>),
served by the public GET /version endpoint, recorded in a startup audit
entry
- Website: deploy.sh exports DEPLOY_VERSION (git SHA), Dockerfile bakes it
via build ARG into the runtime env, /api/health reports it as
deployVersion, smoke test asserts a non-'unversioned' stamp
Closes MITHOME-63
A Content Editor tab left open across a deploy (or a save from another tab)
held the pre-deploy content; one Save would silently overwrite the newer
file. The editor page now embeds a SHA-256 fingerprint of the file content
at load time, /save requires it back in X-Content-Hash and compares against
the current file: mismatch (or a missing header) answers 409 with an
explanatory message and writes nothing. The client offers a reload on 409.
Integration test covers: matching hash saves, stale hash rejected with the
file untouched, missing hash rejected, retry with the fresh hash succeeds.
Closes MITHOME-61
Review follow-up on MITHOME-59:
- no-op publish no longer triggers a background deploy (deploy moved behind
a deterministic hadChanges flag)
- replace output-regex classification ('Already up to date.' also appears on
real publishes when the remote did not move, which misclassified them as
no_changes) with an explicit __NO_CONTENT_CHANGES__ marker echoed by the
shell skip-branch
- failed git pull --rebase is aborted immediately so the repo is never left
mid-rebase; the error is reported and nothing is pushed or deployed
- command + interpretation extracted to scripts/cms-publish.js
- CONTENT_EDITOR_CONTENT_DIR / CONTENT_EDITOR_DEPLOY_CMD env overrides enable
an integration test against throwaway git repos covering: no-change skip,
real publish + deploy, rebase conflict abort
- .gitignore: drop patterns already covered by .env.*
- user guide: new no-changes message
Closes MITHOME-60
- logout asks for confirmation, then invalidates the server-side session
and navigates to a public /login page (logo, form, error messages)
- POST /login validates credentials (timing-safe) and issues an HttpOnly
SameSite=Strict session cookie (8h, Secure behind HTTPS); Basic Auth
stays valid in parallel for curl/API use
- unauthenticated browser navigations redirect to /login; non-browser
requests keep the 401 challenge
- failed form logins share the auth rate-limit budget with Basic attempts
- save/publish redirect to /login when the session expired
- refactor: templates and browser script extracted to scripts/cms-pages.js
and scripts/cms-editor-client.js, session logic to scripts/cms-session.js
(content-editor.js back under the 400-line limit)
- user guide updated (login page, confirmation, 8h session)
Closes MITHOME-58
- docs/felhasznaloi-utmutato.md: user guide for the website and the CMS
(login, editing, arrays, save/validation, publish, security)
- /guide endpoint renders the markdown auth-protected via a dependency-free
renderer (scripts/markdown-render.js) in the CMS dark theme
- new ❓ Súgó entry in the CMS bottom bar
- steering rule: the guide must be updated in the same commit as any CMS or
website feature change
Closes MITHOME-57
Do Siki