10 Commits

Include renames

Author	SHA1	Message	Date
openhands	ae1393d3e3	refactor: clean up duplicate imports and dead code ... - Merge type and value imports from the same module into single imports - Remove dead import-badges action (flow uses /api/admin/import/badges) - Remove unused babel-plugin-react-compiler devDependency - Remove stray test.txt file - Update knip config: track css imports, drop redundant ignore entries - Update contract test to drop obsolete dead-action assertion	2026-08-09 11:51:26 +02:00
SimoandCursor	2de3696993	Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal. ... Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name. Co-authored-by: Cursor <[email protected]>	2026-07-18 19:38:42 +02:00
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
openhands	8efd032cc6	style: format code with prettier agian	2026-07-13 21:41:52 +02:00
openhands	e2fc7ea1a4	Complete security hardening: zero-migration foundation, edge headers, rate-limit atomics, body limits ... - Make @/lib/safe-action re-export from foundation layer so all 13+ existing server actions instantly get request tracing, rate limiting, and structured error handling without any code changes - Add HSTS, CSP, X-Frame-Options, X-Content-Type-Options to edge proxy (src/proxy.ts) — ran at Cloudflare/Vercel edge for all non-asset routes - Fix rate-limit.ts race condition: compute newCount before assignment to shrink the read-modify-write window; add memory-key prefix to avoid collisions with Redis keys - Add request body size limit (10 MB default) to api-handler.ts with per-route override via maxBodyBytes option - Remove unused imports and clean up backward-compat types	2026-07-13 12:09:43 +02:00
openhands	f6ad030c5b	Add EpicNext CMS foundation layer and fix critical security gaps ... - Create src/lib/foundation/ (860 LOC, 9 files): typed action wrappers, DbService with health checks, CSRF validation, safe redirects, AsyncLocalStorage request tracing, branded types, reusable Zod schemas - Migrate moderation.ts and user-settings.ts to foundation patterns - Fix abuse-guard.ts: bound in-memory Maps with LRU eviction (was unbounded) - Fix access-guard.ts: separate try/catch per check, log degradation instead of blanket fail-open - Replace raw redirect() calls with safeRedirect() in guard.ts and permissions.ts to prevent open-redirect attacks - Add CSRF validation to api-handler.ts for mutating methods - Add canonicalizeFormData() utility for FormData input sanitization	2026-07-13 12:03:49 +02:00
openhands	2e4ed76121	style: format code with prettier	2026-07-12 21:07:34 +02:00
remco	e85e4d74ea	revert fb8e77bb68 ... revert style: clean up code with prettier and eslint	2026-07-12 21:02:03 +02:00
openhands	fb8e77bb68	style: clean up code with prettier and eslint	2026-07-12 20:31:05 +02:00
Simo	3497df9dfd	feat: add asset import services	2026-07-12 19:12:25 +02:00