259 Commits

Include renames

Author	SHA1	Message	Date
openhands	2fba923a3a	feat: browser headers on audit fetches + verified clone furnidata sources	2026-08-03 19:00:45 +02:00
openhands	30ed2b8ce2	refactor: switch password hashing from argon2 to bcrypt ... - hashPassword now emits bcrypt (cost 12) instead of argon2id - checkLogin migrates legacy md5/argon2id hashes to bcrypt on sign-in - keep argon2id verification only as a one-time migration path - replace ARGON2_* env vars with BCRYPT_COST	2026-08-03 18:08:57 +02:00
openhands	6fc14b9b84	feat: catalog audit can repair orphaned refs and duplicate classnames ... - add repairOrphanedCatalog: remove catalog_items rows whose item_ids only reference missing items_base entries, strip orphaned ids from mixed rows - add repairDuplicateClassnames: merge items_base duplicates into one canonical row per classname, remap references, delete duplicate rows - add 'repair structural issues' checkbox + result display in audit UI	2026-08-03 18:08:45 +02:00
openhands	44c34dbae6	fix: catalog-repair - allocate sequential ids in generateCatalogSql ... Previously allocateCatalogItemId was called per entry, but since generation does not INSERT, MAX(id) never advanced and every entry got the same id. Now MAX(id) is read once and a local counter hands out sequential ids.	2026-08-02 19:57:21 +02:00
openhands	5308ce6a12	feat: parallelize audit repair and add nitro/SQL repair options ... - Parallelize icon and nitro downloads in the audit repair with a sliding-window worker pool (6 concurrent) to speed up large catalogs - Add repairMissingNitros: fetch missing .nitro bundles from configured nitro sources (Wibbo default), validating each bundle before writing - Add catalog-repair service: generate/apply catalog_items SQL for furni missing a catalog entry and repair FurnitureData.json (add missing + dedupe classnames) - Wire all options through the audit API and client UI with live progress and result stats (icons, nitros, SQL, furnidata) - Add Wibbo as default nitro source alongside existing icon sources - Ignore runtime furni assets downloaded into public/ during repair	2026-08-02 19:12:28 +02:00
Simo	0c8e62357f	fix: preserve runtime furni assets during deploy	2026-08-02 17:32:32 +02:00
openhands	cde15ad022	fix: mirror repaired icons to gamedata ... Repair Icons now resolves all furni asset write targets (webroot plus the live gamedata like /var/www/Gamedata) and writes downloaded or extracted icons to every missing location. Icons already present in one target are copied across instead of re-downloaded, and local .nitro bundles are searched in every target.	2026-08-02 16:56:22 +02:00
openhands	1f9e8a0eec	feat: add default furni icon repair sources ... Fall back to well-known public furni icon hosts (HabboAssets, Hubbly, Leet) when no clone sources are configured, so Repair Icons can download missing icons out of the box. Also handle variant classnames (base name and '*' replaced with '_') and extract icons from remote .nitro bundles. Send a browser User-Agent on downloads to avoid being blocked by hotels.	2026-08-02 16:44:24 +02:00
Simo	88ac5ac1ba	feat: add recent furni resync client contract	2026-08-02 14:56:12 +02:00
Simo	ab43f5d63c	fix: use JSON FurnitureData from gamedata	2026-08-02 14:42:23 +02:00
Simo	c78f8812ad	fix: use configured furni source and catalog assets	2026-08-02 14:22:05 +02:00
Simo	86cd43def9	fix: mirror manual furni uploads to live assets	2026-08-02 13:24:15 +02:00
Simo	01570874a8	fix: map furni imports to production gamedata	2026-08-02 13:16:51 +02:00
Simo	b3245a18ea	fix: bootstrap admin CSRF tokens	2026-08-02 11:46:43 +02:00
Simo	a57c73055f	fix: retry login across deploy cutovers	2026-08-02 11:31:35 +02:00
Simo	bfc951cfd9	fix: minimize deploy cutover downtime	2026-08-02 11:25:03 +02:00
Simo	828fda63e7	fix: keep app online during deploy preparation	2026-08-02 11:19:53 +02:00
Simo	1f4aadb3d7	chore: remove Sentry integration	2026-08-01 22:12:31 +02:00
openhands	c7fb37356e	fix: remove nonce from style-src to allow unsafe-inline to work	2026-08-01 22:09:22 +02:00
openhands	95b1955218	fix: allow unsafe-inline for styles to fix CSP permanently	2026-08-01 21:58:13 +02:00
Simo	d173dd3194	fix: add automatic deployment skew protection	2026-08-01 21:52:28 +02:00
openhands	0dc16e832d	fix: add additional CSP hashes for inline styles	2026-08-01 21:51:32 +02:00
openhands	59f03827bc	fix: add CSP hashes for inline styles from Google Fonts/Tailwind	2026-08-01 21:46:00 +02:00
openhands	0d6032d444	chore: remove standalone output mode, fix Sentry DSN validation, add dev CSP unsafe-inline for styles ... - Remove output: 'standalone' from next.config.ts to allow normal 'next start' - Allow empty SENTRY_DSN/NEXT_PUBLIC_SENTRY_DSN in env validation (zod) - Add 'unsafe-inline' to style-src CSP only in development for Turbopack HMR - Clear placeholder Sentry DSN values from .env	2026-08-01 21:30:51 +02:00
openhands	7c1f8d709e	perf(html): replace proxyAuth with getToken to remove set-cookie; add Cache-Control per auth state	2026-08-01 18:37:19 +02:00
openhands	22d455da7a	fix(auth): drop nonexistent account_blocked column from login lookup ... getLoginUser selected users.account_blocked, which does not exist in the DB (nor the Drizzle schema). Every credentials authorize() call threw a SQL error -> NextAuth CallbackRouteError -> 'error=Configuration', so no login could ever succeed. Remove the phantom column from the query and LoginUser interface. Also fix all remaining biome noNonNullAssertion / noExplicitAny lint warnings so CI's check job (biome:lint) passes and the push deploy runs.	2026-08-01 17:38:43 +02:00
openhands	c601ffbb76	feat(auth): switch password hashing to argon2id with legacy auto-upgrade ... - hashPassword now emits argon2id (same params as the legacy AtomCMS Laravel setup: memory 64MB, iterations 4, parallelism 1) - legacy md5 and bcrypt hashes are verified and auto-upgraded to argon2id on successful login (CONVERT_PASSWORDS=true) - replace BCRYPT_ROUNDS env with ARGON2_MEMORY_KB / ARGON2_ITERATIONS / ARGON2_PARALLELISM - update README and add tests for argon2id and bcrypt upgrade paths	2026-08-01 17:09:29 +02:00
SimoandCursor	811cf5719b	fix(admin): cast clothing-set hard-fail mock return type ... Co-authored-by: Cursor <[email protected]>	2026-08-01 15:57:14 +02:00
SimoandCursor	2194aa1239	fix(admin): type-fix clothing-set hard-fail test mock ... Co-authored-by: Cursor <[email protected]>	2026-08-01 15:56:53 +02:00
SimoandCursor	16191cef14	fix(admin): harden clothing/pets/effects/clone imports ... Align grids on data.items, only treat SSE done as success, hard-fail clothing sets when libs fail, and add Cancel via AbortController. Co-authored-by: Cursor <[email protected]>	2026-08-01 15:56:38 +02:00
SimoandCursor	9c4949186c	feat(admin): server-safe StatusCard and Import hub polish ... Split OnlineUsersWidget from StatusCard, decouple ad delete button, sync badge import to ExternalTexts+WebsiteBadges, add Import section hub with cancelable SSE jobs and upload SQL option. Co-authored-by: Cursor <[email protected]>	2026-08-01 15:48:21 +02:00
SimoandCursor	725e1cb338	feat(ops): health-fail alerts, optional DB backup, admin UX polish ... Wire jobs-worker health probes to Discord/email alerts with cooldown, optional mysqldump, rate-limit /api/health, mark-all-read alerts, ConfirmDialog on destructive admin actions, and raise coverage floors. Co-authored-by: Cursor <[email protected]>	2026-08-01 15:25:47 +02:00
SimoandCursor	3bd712e744	fix(admin): polish tickets, photos purge note, drizzle contracts ... Add queue banners/counts on ticket detail pages, document local-only photo purge, and harden Drizzle Kit smoke contracts after Prisma removal. Co-authored-by: Cursor <[email protected]>	2026-08-01 15:07:54 +02:00
SimoandCursor	ba82789166	chore(db): finish Prisma cutover to Drizzle Kit tooling ... Move CMS SQL to drizzle/migrations, drop prisma packages/schema, wire drizzle-kit scripts, and regenerate schema names from src/db/schema.ts. Co-authored-by: Cursor <[email protected]>	2026-08-01 15:02:21 +02:00
SimoandCursor	d8199ea1e4	feat(admin): unified ticket inbox over CMS and help-center queues ... Merged read-model inbox at /admin/tickets and /mod/tickets with type badges and deep links; CMS-only lists moved to /desk. No DB schema merge. Co-authored-by: Cursor <[email protected]>	2026-08-01 14:49:19 +02:00
SimoandCursor	422567272c	chore(db): remove Prisma facade and drop prisma:generate from CI ... Co-authored-by: Cursor <[email protected]>	2026-08-01 14:38:42 +02:00
SimoandCursor	ca72966a37	refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (6) ... Co-authored-by: Cursor <[email protected]>	2026-08-01 14:15:43 +02:00
SimoandCursor	30b54e99e7	refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5) ... Co-authored-by: Cursor <[email protected]>	2026-08-01 14:15:39 +02:00
SimoandCursor	53b350057d	fix(test): mock @/lib/db in send-currency tests for pre-push ... Co-authored-by: Cursor <[email protected]>	2026-08-01 13:30:16 +02:00
SimoandCursor	65b2fbee6a	refactor(db): finish Drizzle migration for remaining actions and services ... Co-authored-by: Cursor <[email protected]>	2026-08-01 13:27:59 +02:00
SimoandCursor	22234fe102	fix(test): type drizzle mock callbacks for tsc ... Co-authored-by: Cursor <[email protected]>	2026-08-01 13:18:10 +02:00
SimoandCursor	096f55b394	test: align remaining action tests with Drizzle mocks ... EOF Co-authored-by: Cursor <[email protected]>	2026-08-01 13:17:35 +02:00
SimoandCursor	ed9c23c702	refactor(db): migrate staff and app actions from Prisma facade to Drizzle ... Co-authored-by: Cursor <[email protected]>	2026-07-31 21:35:05 +02:00
SimoandCursor	9854719cfd	feat(admin): drizzle trade-lock + RCON sync and photo local purge ... Co-authored-by: Cursor <[email protected]>	2026-07-31 21:14:03 +02:00
SimoandCursor	67656a9aad	fix(ci): migrate on tag release and wire drizzle schema generate ... Co-authored-by: Cursor <[email protected]>	2026-07-31 21:03:54 +02:00
SimoandCursor	20b85381fe	fix(db): accumulate many-includes and nest relations in prisma facade ... Co-authored-by: Cursor <[email protected]>	2026-07-31 20:57:52 +02:00
openhands	e5ff7ec9e5	chore: clean up biome lint warnings — all non- intentional resolved ... - Remove 25 unused imports across 14 test files - Remove 1 unused variable (rename with _ prefix) - Fix 2 noBannedTypes (Function → (...args: unknown[]) => unknown) - Fix 1 useTemplate lint (string concat → template literal in merge-config.cjs) - Fix 1 useNodejsImportProtocol (merge-config.cjs) - Fix 2 noTemplateCurlyInString (generate-drizzle-schema.mjs generator code) - Auto-fix formatting + import sorting across modified files - 221 remaining warnings: intentional noExplicitAny in prisma-facade.ts (Prisma compat layer) - 0 tsc errors, 583 tests passing	2026-07-31 15:26:39 +02:00
openhands	7f7971f578	fix: resolve all biome lint errors and type issues ... - Add file-level biome-ignore for noExplicitAny in prisma-facade.ts (intentional any for Prisma API compatibility surface) - Fix noNonNullAssertion errors in cached-db.ts (redis null-guard fixes) - Auto-fix formatting + organizeImports across modified files - 0 tsc errors, 0 biome errors, 583 tests passing	2026-07-31 15:15:15 +02:00
openhands	d1807ca814	perf: cache online API endpoints with Redis-first cache ... - Upgrade lib/cache.ts: Redis-first cached() with in-memory fallback (was in-memory only, broken across PM2 instances) - Cache /api/online user list (10s TTL, was uncached per-request) eliminates DB query on every poll request - Add uncached() invalidation helper for write-after-cache patterns - 0 tsc errors, 583 tests passing	2026-07-31 15:09:56 +02:00
openhands	ef5e706ee1	perf: optimize DB layer with caching and pool tuning ... - Add Redis cache wrapper (cached-db.ts) — cachedQuery + invalidate helpers - Add cached login user lookup (auth.ts: getLoginUser) — short 15s TTL for brute-force protection, cache invalidation on password/rank changes - Switch auth.ts login flow from Prisma facade to raw SQL via db.execute (avoids abstraction overhead for this hot path) - Cache invalidation wired in: login password upgrade, updateUser, resetPassword - Connection pool tuning: enableKeepAlive, namedPlaceholders, prepared statement cache (Node 22+), multipleStatements off (SQLi hardening) - 0 tsc errors, 583 tests passing	2026-07-31 15:01:34 +02:00