8 Commits

Include renames

Author	SHA1	Message	Date
Simo	8abfe352ef	fix(security): authorize site uploads and harden tokens, media and request identity	2026-09-13 19:24:43 +02:00
openhands	a513d9b7bd	Migrate dependencies: bcrypt→@node-rs/argon2, sanitize-html→isomorphic-dompurify, remove nodemailer/next-view-transitions	2026-07-28 19:03:04 +02:00
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
openhands	942bc6fc8d	Security hardening, code quality, and ESLint setup ... - Remove production DB dump (db_backup_*.sql) and update.log from git tracking - Add DB backups to .gitignore - Replace all console.log/console.error with structured logger module - Translate Dutch error messages to English (link-discord.ts) - Remove dead code blocks (register-form.tsx false && pattern) - Add ESLint flat config with TypeScript, React, Next.js, jsx-a11y, and security plugins - Add Prettier config - Add eslint-plugin-security for security-aware linting - Fix all 119+ ESLint warnings across the codebase: - Resolve security/detect-object-injection with safe access patterns - Resolve security/detect-non-literal-fs-filename with path traversal validation - Replace <img> with next/image <Image> component - Remove unused variables and imports - Replace non-null assertions with proper type guards - Replace <a> with <Link> for internal navigation - Use next/script Script component for external scripts - Fix setState-in-useEffect anti-patterns (navbar-color-picker, logo-generator, theme-switcher) - Add lint and format scripts to package.json All checks: typecheck ✓, tests 58/58 ✓, lint 0 errors 0 warnings ✓	2026-07-10 22:48:22 +02:00
openhands	eb01b14379	Add ultimate file-based email fallback so mailer always works without any configuration	2026-07-07 20:18:30 +02:00
openhands	065215b4dc	Add local sendmail fallback so mailer works internally without external services	2026-07-07 20:15:29 +02:00
openhands	bf4075233d	Add Resend mailer as primary with SMTP fallback for reliable email delivery	2026-07-07 20:12:56 +02:00
Simo	e668fa85ec	Add 2FA, email + password reset, and batch-7 pages ... Auth (hand-built on the auth core): - 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin reveals the code field). /settings/2fa enable/confirm/disable flow. - Password reset: nodemailer email service; PasswordReset model + migration; /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id hash). Login links to forgot. Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors), social write actions (friend request + guild forum new thread), /help/[category], /badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).	2026-06-28 14:25:19 +02:00