Spaces:
Sleeping
Sleeping
Commit History
-
Fix: Public settings API + Save button + Navbar shows site name/logo
72e4865 -
Fix: Increase login rate limit to 20 attempts
87a681d
-
Feat: Store images as base64 in database for persistence
3196722 -
Fix: Use persistent /data/uploads directory for Hugging Face
70b46f4
-
Fix: Case-insensitive RBAC + relaxed upload validation + seed role uppercase
1bc01b8 -
Fix: Remove Helmet entirely, use manual security headers without frame-ancestors
aa719f8 -
Fix: Disable CSP and crossOriginEmbedderPolicy for Hugging Face iframe
be69037 -
Fix: Enable trust proxy for Hugging Face reverse proxy
d1d1b9a -
Production-ready: Security hardening, RBAC, logging, audit, DB indexes, compression
Phase 1 - Security: - Helmet security headers with CSP - Rate limiting (global/login/API) - CORS with env-based config - Secure file upload (block SVG, MIME validation) - Environment validation at startup Phase 2 - RBAC: - Role-based authorization (SUPER_ADMIN/ADMIN/MANAGER/STAFF/USER) - Mutation routes protected with authorize middleware - GET routes remain public Phase 5 - Observability: - Structured logger (JSON/colored) - Request logging with correlation IDs - Failed login attempt tracking - Audit log model and utility Phase 6 - Database: - Added indexes on Project, Skill, Contact, Analytics - AuditLog model for change tracking - Prisma schema optimization Phase 7 - Docker: - Production Dockerfile with --omit=dev - Compression middleware - Health check endpoints (/health, /health/database, /health/storage)9f5a703
-
Fix: Single server - backend serves frontend directly, no proxy
83e9b3c -
Fix: CORS any origin + bigger project images + cookie session
b1f9ca8 -
Fix: Relative upload URLs + cookie sameSite lax for proxy
d26af29 -
Initial commit
moustafa781d1e4c