5 Commits

Include renames

Author	SHA1	Message	Date
openhands	9f024dc6ac	perf(app): batch catalog updates, tune caches, add captcha env fallback ... - catalog: apply bulk offer edits in a single transaction with one RCON refresh instead of N round-trips, virtualize the items table past 150 rows and cap the shop preview at 200 tiles - cache: lift the public cache TTLs and the boot warm-up into env-tunable constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED) - auth: resolve the captcha provider, site key and secret from CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the admin settings are unset; an explicit DB value (including "none") still wins, so Turnstile can be enabled per-deploy without touching the DB.	2026-10-15 16:00:00 +02:00
openhands	0f35bc8529	Add hCaptcha support alongside Turnstile and reCAPTCHA ... - Add hcaptcha_site_key and hcaptcha to captcha_provider options in admin settings - Update captcha.ts server-side verification for hCaptcha (new endpoint + secret key) - Add hCaptcha widget rendering in register-form.tsx - All TypeScript and Biome checks pass	2026-08-14 17:04:34 +02:00
SimoandCursor	ed7db6e048	feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX ... Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills. Co-authored-by: Cursor <[email protected]>	2026-07-21 21:08:33 +02:00
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
Simo	80f591a343	Add public REST API, anti-abuse protections, radio/GitHub cron jobs ... Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under /api mirroring AtomCMS: users/[username], online(+/count), me, articles (+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories), values(+/categories), settings, radio/{config,now-playing,listeners, shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination). Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/ 2FA secrets/mail). Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile / Google reCAPTCHA, settings-driven, widget rendered on the register page), VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn settings), and max-accounts-per-IP. All fail-open when unconfigured. src/lib/services/{captcha,ip-lookup}.ts. Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist when no live DJ), github-update-check (hourly, sets update_available). Shared src/lib/services/radio.ts (now-playing/listeners parsing). Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6 users, settings carry no secrets, user endpoint hides password). tsc 0, vitest 49/49, next build 0 (20 new API routes).	2026-06-28 21:44:02 +02:00