Do SikiandClaude Sonnet 5
8407b45367
CI Pipeline with Test Management / đ§Ș Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / đł Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / đïž Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / đ Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / đ§Ș Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / đ Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / đ Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⥠Performance Monitoring (push) Blocked by required conditions
Explicit, documented decisions instead of relying on implicit Payload
defaults:
- auth.maxLoginAttempts: 5, lockTime: 10 min â codifies the lockout
policy rather than leaving it as an unstated library default.
- auth.cookies: { secure: NODE_ENV === 'production', sameSite: 'Lax' }
â secure cookies once behind HTTPS (MITHOME-15), harmless over plain
HTTP in local dev.
- access.{create,read,update,delete,unlock}: explicit
requireAuthenticatedUser (== Payload's defaultAccess, Boolean(user)).
Investigated the known open advisory flagged in MITHOME-86
(GHSA-jg8r-5jh2-v2xj â any authenticated user can unlock any other
account) by reading Payload's unlock operation source: the gap only
matters when a less-privileged authenticated identity exists that
needs protecting from a more-privileged one. This project's single
"admin" role model (no role hierarchy â MITHOME-85 epic decision)
has no such identity, so the default is accepted as-is, with the
reasoning and a MITHOME-46 (central IDM/SSO) revisit trigger written
into the code comment rather than left implicit.
- Added an optional `name` field for a nicer admin identity than a
bare email (audit trail, header display).
Verified live: existing dev@mozdit.hu user unaffected (name column
shows "<No Name>", backward compatible). Reproduced the lockout for
real â 5 wrong POST /api/users/login attempts, 6th attempt with the
*correct* password still rejected ("locked due to too many failed
login attempts"), unlocked via Local API (overrideAccess), then the
correct password logged in successfully. build/lint/tsc/test (58
passed) all clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mozdIT Bt. â Weboldal fejlesztĂ©s (websitedev)
Modern Next.js weboldal a mozdIT Bt. szĂĄmĂĄra â webtĂĄrhely, email- Ă©s DNS-szolgĂĄltatĂĄs, magyar IT vĂĄllalkozĂĄs.
Stack
- Frontend: Next.js 15 (Turbopack), React 19, TypeScript, Tailwind CSS 4
- Tartalom: JSON-alapĂș, sĂ©ma-validĂĄlt content rendszer (
proto/src/content/) - CMS: sajĂĄt, dependency-mentes
content-editor.js(böngĂ©szĆs szerkesztĆ) - Backend: Next.js API routes, MongoDB
- TesztelĂ©s: Jest, React Testing Library, Playwright (smoke), valĂłdi szervert indĂtĂł CMS-tesztek
- Deploy: natĂv Docker Compose (
deploy.sh) + Gitea Actions nĂ©lkĂŒl, lokĂĄlisan vezĂ©relt - Monitoring: Winston + Loki, plusz
scripts/security-scan.sh(ntfy riasztĂĄssal)
Gyors indĂtĂĄs
# FejlesztĆi szerver
cd proto && npm run dev
# Docker fejlesztĆi környezet
docker-compose -f docker-compose.dev.yml up -d
# Teljes pre-deploy tesztkészlet
scripts/pre-deploy-tests.sh
Feladatkezelés (Plane)
- Projekt: MITHOME (workspace:
developments) - TODO.md: helyi tĂŒkör, a Plane az elsĆdleges forrĂĄs
- Szinkron:
node plane-sync.js(Plane â TODO.md) - Ticket-azonosĂtĂłk:
MITHOME-XX
Deploy
./scripts/deploy_to_stage_on_local.sh # staging: teljes tesztkészlet + push + deploy + smoke
./deploy.sh production # Ă©les (szerveren, staging ellenĆrzĂ©se utĂĄn)
A CMS âPublikĂĄlĂĄs" gombja szintĂ©n commitol + pushol + deployol (csak a beĂĄllĂtott környezetre). RĂ©szletek: .agent/workflows/deploy.md, docs/helyi-staging-deploy.md.
Tartalomkezelés
A weboldal szövegei és a CMS a proto/src/content/ JSON-fåjljaiból jönnek:
proto/src/content/
âââ schema.js # közös sĂ©ma-validĂĄtor (Next + CMS)
âââ types.ts # TypeScript tĂpusok
âââ index.ts # tartalom-betöltĆ
âââ common.json # közös szövegek (gombok, lĂĄblĂ©c, a11y)
âââ pages/ # oldalankĂ©nti tartalom (home, about, services, âŠ)
HasznĂĄlat:
import { content, getPageContent } from '@/content'
const about = content.pages.about
DokumentĂĄciĂł
- Agent-szabĂĄlyok:
.agent/AGENTS.md,.agent/steering/,.agent/workflows/ - CMS felhasznĂĄlĂłi ĂștmutatĂł:
docs/felhasznaloi-utmutato.md(a CMS-ben a â SĂșgĂł is ezt rendereli) - Plane szinkron:
PLANE-SYNC-GUIDE.md - Staging deploy:
docs/helyi-staging-deploy.md - Gitea runner:
docs/gitea-runner-telepites.md
Környezetek
- Staging: https://stage.mozdit.hu
- CMS (staging): https://cms.stage.llmdev.mozdit.hu
- ntfy (riasztĂĄs):
st_limidev_securitytopic
BiztonsĂĄgi monitoring
scripts/security-scan.sh (cron, 5 percenként) kriptominer/backdoor indikåtorokat figyel
(ålcåzott folyamatnevek, /tmp/.kworkerd-jellegƱ maradvånyok, magas CPU), és talålat esetén
ntfy push-t kĂŒld a st_limidev_security topicra.