8 Commits

Include renames

Author	SHA1	Message	Date
SimoandCursor	0e89d03940	Finish fine-grained ACL across remaining admin pages and actions. ... Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks. Co-authored-by: Cursor <[email protected]>	2026-07-15 20:15:22 +02:00
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
openhands	8efd032cc6	style: format code with prettier agian	2026-07-13 21:41:52 +02:00
openhands	e5ae51bff7	Add NFC normalization to all FormData inputs across 41 server actions ... All user-supplied string values from FormData now go through String.prototype.normalize('NFC') to prevent Unicode homoglyph attacks and canonicalization bypasses. NFC is idempotent for already-normalized strings, so this is a pure security improvement with zero behavioral change for legitimate users.	2026-07-13 12:21:37 +02:00
Simo	5b4228261a	Reapply "Add missing admin action files and navigation links" ... This reverts commit 4d515bc400.	2026-07-11 20:52:56 +02:00
Simo	4d515bc400	Revert "Add missing admin action files and navigation links" ... This reverts commit 41be6835bf.	2026-07-11 20:37:56 +02:00
openhands	41be6835bf	Add missing admin action files and navigation links ... - Add 11 missing server action files: badges, bulk-users, catalog, catalog-bc, catalog-items, import-badges, import-furni, multi-account-detect, permissions, rooms, soundtracks - Add missing admin navigation links: tickets, sounds, translations, import, radio sub-pages - Add translation keys for all new navigation items	2026-07-11 12:01:05 +02:00
Simo	e96b606e1e	Add remaining public + admin pages (parallel build, 26 files) ... Built via two parallel agent workflows reading the real Prisma schema, then integrated + verified. Public: /shop (categories + storefront), /community hub, /rankings (top by credits), /staff, /photos (camera_web gallery), /help (categories + rules), /help/tickets (auth-gated user tickets + create), /settings (auth-gated, update motto via RCON). Admin: /admin/catalog (+[id] items), /admin/radio (shouts/apps/schedules + delete shout), /admin/teams (CRUD), /admin/permissions (read), /admin/wordfilter (CRUD + RCON push), /admin/ip (whitelist/blacklist CRUD), /admin/applications (list + dismiss), /admin/logs (chat/command/alert read), /admin/achievements (read). Server actions all staff-gated. Header + admin nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (33 routes); curl-probed every route — public 200/<main>, auth+admin correctly 307-redirect when unauthorized.	2026-06-28 13:24:55 +02:00