2 Commits

Include renames

Author	SHA1	Message	Date
openhands	5628e7d6b7	Security hardening: 12 improvements across the stack ... 1. env.ts: APP_KEY placeholder detection with validation 2. schema.prisma: password column widened to varchar(255) for argon2id 3. auth.ts: trustHost restricted to development only 4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers 5. api.ts: CORS restricted to APP_URL instead of wildcard 6. register-form.tsx: migrated from REST API fetch to server action (useActionState) 7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed) 8. register.ts: password min length 8 + complexity requirements (upper, lower, digit) 9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation 10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets 11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff) 12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow	2026-07-04 18:52:00 +02:00
Simo	6f15e0c8a3	Production hardening: error pages, rate limiting, metadata ... - Custom not-found (404) + error / global-error boundaries, styled with the public design system; raw errors logged, never shown to users. - In-process rate limiter (src/lib/rate-limit.ts) wired into the abuse- prone flows: login (10/5min/IP), register (5/10min/IP), password-reset request (3/15min/IP), keyed by the proxy-forwarded client IP. - SEO/metadata: root generateMetadata sets a `%s · {hotel}` title template from the live hotel_name; dynamic generateMetadata on news/[slug] (article title + excerpt) and u/[username] (name + motto); static titles on 12 primary public pages. - env.ts: added the vars introduced since (PASSWORD_HASH, OPENAI_API_KEY, DISCORD_WEBHOOK_URL, ALERT_EMAIL, PAYPAL_*) so env stays authoritative. Verified on the prod server: /missing → 404 card, news title renders "News · Habbo". tsc 0, vitest 49/49, next build 0.	2026-06-28 20:12:12 +02:00