3 Commits

Include renames

Author	SHA1	Message	Date
Simo	4a1e1115b3	Harden CMS security and theme contrast	2026-07-11 20:27:20 +02:00
Simo	f7b3845131	Close the web-feasible 100% gaps: REST write/token API, tickets, draw-badge, /me, sanitisation, dusk, radio SSE ... Final parity push (web-tier only): - REST API write + token auth: POST /api/tokens (issue a personal_access_token for the session user), Bearer auth via src/lib/api-auth.ts, POST /api/articles/[slug]/comment, GET/DELETE /api/me/tokens, full tickets API (/api/tickets +[id] +[id]/reply), radio current-dj/points/points-leaderboard/ embed-config + POST shouts, and a real-time /api/radio/stream (SSE). 31 public API routes total. - Pages: /draw-badge (buy a custom profile badge → credits + RCON), /me dashboard (stats + online friends + referral claim). Wired into the nav. - HTML sanitisation (sanitize-html) — the HTMLPurifier equivalent — applied to writeable boxes + article bodies before dangerouslySetInnerHTML. - "Dusk" dark theme preset + a default-dark site option honoured by the no-flash boot script. Verified live (prod, amx_test): token issue → Bearer endpoint 200, no-token 401; /api/me/tokens lists it; current-dj/leaderboard JSON; /me + /draw-badge 200; reverted the test user + tokens. tsc 0, vitest 49/49, next build 0.	2026-06-29 18:15:01 +02:00
Simo	80f591a343	Add public REST API, anti-abuse protections, radio/GitHub cron jobs ... Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under /api mirroring AtomCMS: users/[username], online(+/count), me, articles (+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories), values(+/categories), settings, radio/{config,now-playing,listeners, shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination). Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/ 2FA secrets/mail). Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile / Google reCAPTCHA, settings-driven, widget rendered on the register page), VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn settings), and max-accounts-per-IP. All fail-open when unconfigured. src/lib/services/{captcha,ip-lookup}.ts. Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist when no live DJ), github-update-check (hourly, sets update_available). Shared src/lib/services/radio.ts (now-playing/listeners parsing). Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6 users, settings carry no secrets, user endpoint hides password). tsc 0, vitest 49/49, next build 0 (20 new API routes).	2026-06-28 21:44:02 +02:00