4 Commits

Include renames

Author	SHA1	Message	Date
Paul Nothaft	2ea26a4962	fix: conform moved code to eslint indent/quotes, 4-arg mutation callbacks ... - eslint --fix on branch-changed backend files (indent shift from the module-wrapper nesting in decomposed files); backend lint now 904 errors vs 1,315 on main - useMutationWithToast forwards all four TanStack v5 callback args (tsc -b strict build flagged the 3-arg passthrough)	2026-07-03 08:17:14 +02:00
Paul Nothaft	6eb46d8c31	refactor(backend): standardize error responses, logging, pagination ... - errorResponse(res, error, status, publicMessage) in routeHelpers, wired into 125 catch blocks across 10 route files; wire format ({ error: <string> }) unchanged byte-for-byte - Replace remaining console.* with logger across src (178 sites); 3 intentional console sites kept (install boot, unbound .catch ref) - Adopt getPagination in 6 routes where semantics match exactly	2026-07-03 07:49:45 +02:00
Luca	807ae3d4fa	fix(security): block script execution in served SVGs via CSP ... Serve uploaded SVGs (admin logos etc.) with a restrictive Content-Security-Policy (default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:) + X-Content-Type-Options: nosniff in secureStatic. The browser still renders the vector, but any embedded <script>/on* handler can't execute if the SVG is opened directly — keeps real SVGs (scalable) instead of rasterising them. Applies to all secureStatic mounts (uploads/photos/thumbnails/fonts); only SVGs get the header.	2026-06-03 14:37:40 +02:00
paulandClaude	1773ed5f95	Initial commit - Project start (July 17, 2025) ... Original: feat: enhance security logging and ensure rate limit blocks are properly tracked - Add comprehensive logging for rate limit blocks with full request details - IP address (with proper proxy detection), user agent, headers, timestamps - Rate limit info (current count, limit, remaining, reset time) - Separate tracking for auth vs general endpoints - Enhance authentication failure logging - JWT validation failures with detailed error info - Admin auth attempts without token - Failed token validation with user context - All events include IP, path, method, user agent - Improve Winston logger configuration for production - Add automatic log rotation (10MB errors, 50MB combined) - Create separate security.log for auth/rate limit events - Ensure logs directory exists automatically - Add structured JSON format for log aggregation - Support container logging with LOG_TO_CONSOLE env var - Create comprehensive documentation - Security logging guide with examples - Monitoring recommendations - Configuration reference - Add test script to verify logging functionality All rate limit settings remain configurable via admin panel: - Window duration, max requests, auth limits - Skip authenticated requests option - Public endpoints only option 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2025-07-24 16:57:07 +02:00