Luca a4b4485d32 fix(categories): address PR #790 review — event ownership, migration renumber, nits ...

- 🔴 Event ownership: GET /event/:eventId and DELETE /reorder/:eventId now use
  requireEventOwnership; POST /reorder (event_id in body) gets the equivalent
  inline check (super_admin bypasses; others limited to owned/ownerless events).
  New test covers a settings.edit-holding non-super_admin blocked (403) on all
  three per-event routes.
- 🔴 Migration renumber: 158→159, 159→160 (upstream #788 already took 158);
  headers + the test's require path updated.
- 🟢 Nits: stale inline "Drag the arrows" fallback → "Use the arrows" (matches
  en.json; control is click-only); invalid bg-accent-dark/150 → bg-accent-dark.

2026-07-10 20:10:40 +02:00

..

public

fix(csp): external bootstrap script to survive strict reverse-proxy CSP (#564)

2026-05-31 22:35:00 +02:00

scripts

feat(localization): add i18next extraction helper & refactor backup configuration component to tsx

2026-05-09 18:23:12 +02:00

src

fix(categories): address PR #790 review — event ownership, migration renumber, nits

2026-07-10 20:10:40 +02:00

.dockerignore

…

.env.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.env.production.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.gitignore

…

audit-frontend.json

…

docker-entrypoint.sh

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

Dockerfile

chore(security): bump frontend nginx to r4 — close 4 HTTP/2 & module CVEs

2026-07-02 17:14:29 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

Dockerfile.prod

fix(security): resolve Docker image CVEs for code scanning alerts

2026-03-02 23:06:15 +01:00

eslint.config.js

…

i18next.config.ts

feat(localization): add i18next extraction helper & refactor backup configuration component to tsx

2026-05-09 18:23:12 +02:00

index.html

fix(branding): point HTML favicon link at /favicon.ico (the real Safari fix)

2026-06-03 19:01:55 +02:00

nginx.conf

fix(og): broaden social-crawler coverage (Bluesky Cardyb, WeChat-scraper, fediverse, etc.)

2026-07-05 23:37:16 +02:00

nginx.dev.conf

fix(nginx): honour outer X-Forwarded-Proto when behind a reverse proxy (#547)

2026-05-22 13:32:01 +02:00

package-lock.json

chore(security): close 27 code-scanning alerts via dep + base-image bumps

2026-06-29 23:26:32 +02:00

package.json

chore(main): release 3.85.0-beta.0 (#793)

2026-07-10 13:38:57 +00:00

postcss.config.js

…

tailwind.config.js

feat(theme): expand color settings to 8-token CI palette + alt button

2026-05-05 16:04:43 +02:00

tsconfig.app.json

…

tsconfig.json

…

tsconfig.node.json

…

vite.config.ts

feat(crm): frontend code — pages + services + components

2026-05-26 18:19:32 +02:00

vitest.setup.ts

…