davide/ecommerce-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17 Commits 1 Branch 0 Tags
45a50dc906c90f342d8422e5451d478014b7166c
Commit Graph

10 Commits

Author SHA1 Message Date
davide 45a50dc906 fix(security): whitelist allowed keys in admin settings endpoint 
Reject any key not in the explicit allowlist before writing to the database,
preventing arbitrary configuration injection by a malicious admin.
 2026-05-19 10:10:42 +02:00
davide fcfa0707a1 fix(security): replace localStorage user state with server-side session 
- Add GET /api/auth/me endpoint returning current user from httpOnly cookie
- Add UserContext + useUser() hook that fetches from /api/auth/me on mount
- Wrap root layout with UserProvider
- Remove all localStorage.setItem/getItem('user') calls from login, register,
  navbar, account pages, change-password, and checkout
- mustChangePassword redirect now reads from refreshed server session
 2026-05-19 10:10:24 +02:00
davide 0395a78008 fix(security): add HTTP security headers (CSP, HSTS, X-Frame-Options) 
- middleware.ts: set X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy, Content-Security-Policy on all responses
- Caddyfile: add Strict-Transport-Security (HSTS 1y), X-Frame-Options,
  X-Content-Type-Options at reverse proxy level
 2026-05-19 10:10:08 +02:00
davide 2a6c3a1222 fix(security): validate file uploads with magic bytes, remove SVG from favicon whitelist 
- Add validateImageMagicBytes() to storage.ts reading first 12 bytes
  to verify JPEG/PNG/WebP/ICO signatures regardless of declared MIME type
- Remove image/svg+xml from favicon upload whitelist (SVG can embed scripts)
- Apply magic bytes check in product image and favicon upload endpoints
 2026-05-19 10:09:53 +02:00
davide 7afb609386 fix: hide slug field in product type form, auto-generate from name 
Lo slug viene calcolato automaticamente dal nome senza che l'utente
debba compilarlo — il campo è rimosso dal form ma continua ad essere
inviato nel payload e visibile nella tabella.
 2026-05-19 09:17:17 +02:00
davide 3b800463f5 fix: accept price in currency units instead of cents in product form 
Il campo prezzo del form admin ora accetta valori in unità (es. 19.99)
invece di centesimi (1999). La conversione *100 avviene al submit,
il DB e Stripe continuano a ricevere centesimi.
 2026-05-19 08:58:46 +02:00
davide b62c02adc1 feat: add favicon upload and footer customization to admin settings 
- Admin settings page now has sections for general settings, footer, and favicon
- Footer component reads footer_copyright and footer_links from DB
- New API route POST /api/admin/upload/favicon saves uploaded image and updates favicon_url in DB
- Textarea support added for footer_links JSON field
 2026-05-18 22:50:07 +02:00
davide b33eee8bea docs: add favicon, reorganize docs and add customization guide 
- Add icon.png as default favicon (cropped to remove transparent padding)
- Fix layout.tsx to use icon.png as fallback when favicon_url is not set in DB
- Move ADMIN_GUIDE.md to docs/ folder
- Add docs/CUSTOMIZATION.md with guide on how to customize icon, title, footer
 2026-05-18 22:49:22 +02:00
davide 676b173414 feat: add product image upload to admin panel 
- Add storage.ts utility (saveImage, deleteImageFile) for local disk operations
- Add POST /api/admin/products/[id]/images: validates MIME type and 5MB limit, saves file, creates MediaAsset record
- Add DELETE /api/admin/products/[id]/images?imageId=: removes file and DB record
- Add Images section to product edit form (hidden for new products until saved)
- Display images in square aspect-ratio grid matching storefront display
- Support multi-file upload; hover to reveal delete button
 2026-05-18 17:54:09 +02:00
davide a8d4c158b8 Commit iniziale 2026-05-18 15:25:38 +02:00