5 Commits

Include renames

Author	SHA1	Message	Date
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
openhands	8efd032cc6	style: format code with prettier agian	2026-07-13 21:41:52 +02:00
openhands	e5ae51bff7	Add NFC normalization to all FormData inputs across 41 server actions ... All user-supplied string values from FormData now go through String.prototype.normalize('NFC') to prevent Unicode homoglyph attacks and canonicalization bypasses. NFC is idempotent for already-normalized strings, so this is a pure security improvement with zero behavioral change for legitimate users.	2026-07-13 12:21:37 +02:00
openhands	f6ad030c5b	Add EpicNext CMS foundation layer and fix critical security gaps ... - Create src/lib/foundation/ (860 LOC, 9 files): typed action wrappers, DbService with health checks, CSRF validation, safe redirects, AsyncLocalStorage request tracing, branded types, reusable Zod schemas - Migrate moderation.ts and user-settings.ts to foundation patterns - Fix abuse-guard.ts: bound in-memory Maps with LRU eviction (was unbounded) - Fix access-guard.ts: separate try/catch per check, log degradation instead of blanket fail-open - Replace raw redirect() calls with safeRedirect() in guard.ts and permissions.ts to prevent open-redirect attacks - Add CSRF validation to api-handler.ts for mutating methods - Add canonicalizeFormData() utility for FormData input sanitization	2026-07-13 12:03:49 +02:00
Simo	e96b606e1e	Add remaining public + admin pages (parallel build, 26 files) ... Built via two parallel agent workflows reading the real Prisma schema, then integrated + verified. Public: /shop (categories + storefront), /community hub, /rankings (top by credits), /staff, /photos (camera_web gallery), /help (categories + rules), /help/tickets (auth-gated user tickets + create), /settings (auth-gated, update motto via RCON). Admin: /admin/catalog (+[id] items), /admin/radio (shouts/apps/schedules + delete shout), /admin/teams (CRUD), /admin/permissions (read), /admin/wordfilter (CRUD + RCON push), /admin/ip (whitelist/blacklist CRUD), /admin/applications (list + dismiss), /admin/logs (chat/command/alert read), /admin/achievements (read). Server actions all staff-gated. Header + admin nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (33 routes); curl-probed every route — public 200/<main>, auth+admin correctly 307-redirect when unauthorized.	2026-06-28 13:24:55 +02:00