simone/clienthub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
262 Commits 1 Branch 1 Tag
v2.2
Commit Graph

3 Commits

Author SHA1 Message Date
simone a478462aa4 security: full hardening pass — auth guards, rate limiting, headers, internal secret 
- Add requireAdmin() to all unprotected admin server actions
  (clients/new, clients/[id], timer-actions — 17 functions total)
- Protect /api/internal/* endpoints with X-Internal-Secret header
  (proxy.ts sends it; routes reject requests without it)
- Randomize auto-generated client slugs with 4-char suffix
  to prevent enumeration via predictable name-based slugs
- Add in-memory rate limiting to /api/client/approve (20/min)
  and /api/client/comment (10/min) per IP
- Add security headers: X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy, X-DNS-Prefetch-Control
- Reduce JWT session from 30 days to 7 days with daily rotation
- Remove hardcoded NEXTAUTH_URL from Dockerfile (pass via Coolify env)
- Genericize client API error messages to not leak data structure
- Update .env.example with all required variables including INTERNAL_SECRET

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-22 14:36:16 +02:00
simone 5bf5dfce71 infra(04-00): route /c/ → /client/, Dockerfile, Gitea deploy 
- Rename src/app/c/[token] → src/app/client/[token]
- Update proxy.ts, ClientRow, admin client detail with /client/ path
- Add output: "standalone" to next.config.ts for Docker build
- Add Dockerfile (multi-stage, node:20-alpine) and .dockerignore
- Push schema to Coolify Postgres via SSH tunnel (drizzle-kit push ✓)
- Update CLAUDE.md constraint 4 to reflect /client/ route
- Add Phase 4 planning artifacts (04-00, 04-RESEARCH, 04-PATTERNS)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 16:12:05 +02:00
Simone Cavalli 9563b87c81 chore(01-01): bootstrap Next.js 16 with TypeScript, App Router, Tailwind CSS v4 
- Created Next.js 16.2.6 project with App Router, src/ directory, TypeScript strict mode
- Configured Tailwind CSS v4 with postcss.config.mjs
- Simplified src/app/page.tsx to Welcome to ClientHub placeholder
- Updated layout.tsx with ClientHub metadata, Italian lang, viewport export (Next.js 16 API)
- Added .gitignore covering node_modules, .env*, .next/, build artifacts

Note: create-next-app installed Next.js 16.2.6 (latest stable) instead of 15.x — fully compatible upgrade
 2026-05-13 15:28:58 +02:00