Simo and Cursor
cbdea70f83
Improve shop hub: CurrencyIcon on packages/vouchers, DataTable for transactions.
...
Co-authored-by: Cursor <[email protected]
2026-07-17 20:32:45 +02:00
Simo and Cursor
0e89d03940
Finish fine-grained ACL across remaining admin pages and actions.
...
Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.
Co-authored-by: Cursor <[email protected]
2026-07-15 20:15:22 +02:00
openhands
df38dccbf1
style: format code biome
2026-07-13 21:57:41 +02:00
openhands
8efd032cc6
style: format code with prettier agian
2026-07-13 21:41:52 +02:00
openhands
e5ae51bff7
Add NFC normalization to all FormData inputs across 41 server actions
...
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
2026-07-13 12:21:37 +02:00
Simo
5b4228261a
Reapply "Add missing admin action files and navigation links"
...
This reverts commit 4d515bc400
2026-07-11 20:52:56 +02:00
Simo
4d515bc400
Revert "Add missing admin action files and navigation links"
...
This reverts commit 41be6835bf
2026-07-11 20:37:56 +02:00
Simo
4a1e1115b3
Harden CMS security and theme contrast
2026-07-11 20:27:20 +02:00
openhands
41be6835bf
Add missing admin action files and navigation links
...
- Add 11 missing server action files: badges, bulk-users, catalog, catalog-bc, catalog-items, import-badges, import-furni, multi-account-detect, permissions, rooms, soundtracks
- Add missing admin navigation links: tickets, sounds, translations, import, radio sub-pages
- Add translation keys for all new navigation items
2026-07-11 12:01:05 +02:00
Simo
08a9882be8
Add register + logout auth flows, and batch-5 resources
...
Auth (hand-built, uses the auth core):
- /register + register() action: validates, hashes with argon2id (hashPassword),
creates an emulator-compatible users row (accountCreated/ipRegister/ipCurrent/
look), redirect kept outside try so NEXT_REDIRECT propagates. Login/register
cross-links; header shows Register (logged-out) and a Logout (signOut) button.
Batch 5 (parallel agents): /admin/rooms (+[id]) search+detail, /admin/vouchers
(CRUD), /admin/subscriptions (read), /admin/calendar (campaigns+rewards read),
/marketplace (public). Header + admin nav extended.
Verified: tsc exit 0, vitest 48/48, next build exit 0 (52 page routes).
2026-06-28 13:52:32 +02:00
SimoandCursor
openhands