feat(admin): SmartAdmin template redesign + security hardening

- Migrated all admin views from inline JS string templates to EJS - Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid - Added express-ejs-layouts for master layout wrapper - Security: - CSRF protection (double-submit cookie) - Rate limiting on /login (5/15min) - Token revocation via jti + globalLogoutTimestamp - Re-auth (reauth_token) for destructive endpoints - Settings whitelist (ALLOWED_KEYS) + removed process.exit - Seed phrases no longer rendered in HTML (CSV export only) - Multer fileFilter for image uploads + safe filename generation - SQL injection fix (currency column allowlist) - Global error handler + asyncHandler wrapper - New files: csrf.js, errorHandler.js, error.ejs, all EJS templates - SmartAdmin assets: CSS, icons, webfonts, plugins, scripts
2026-07-06 17:42:54 +01:00
parent 8d85776135
commit d4c476002c
1010 changed files with 256079 additions and 1625 deletions
--- a/src/admin/views/layout.ejs
+++ b/src/admin/views/layout.ejs
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html lang="en" data-bs-theme="light">
+
+<head>
+    <meta charset="utf-8">
+    <title><%= title || 'Admin' %> | Shop Admin</title>
+    <meta name="description" content="Shop Admin Panel">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no, maximum-scale=5">
+
+    <!-- Standard favicon for browsers -->
+    <link rel="icon" href="/img/favicon-32x32.png" type="image/png" sizes="32x32">
+    <link rel="icon" href="/img/favicon-16x16.png" type="image/png" sizes="16x16">
+
+    <!-- Apple Touch Icon (iOS) -->
+    <link rel="apple-touch-icon" href="/img/apple-touch-icon.png" sizes="180x180">
+
+    <!-- Android/Chrome (Progressive Web App) -->
+    <link rel="icon" href="/img/favicon-192x192.png" type="image/png" sizes="192x192">
+
+    <!-- Call App Mode on ios devices -->
+    <meta name="mobile-web-app-capable" content="yes">
+
+    <!-- Remove Tap Highlight on Windows Phone IE -->
+    <meta name="msapplication-tap-highlight" content="no">
+
+    <%- include('partials/app-head-css') %>
+</head>
+
+<body class="set-nav-dark set-nav-fixed set-header-fixed set-nav-full">
+    <div class="app-wrap">
+
+        <%- include('partials/app-header') %>
+
+        <%- include('partials/app-sidebar') %>
+
+        <main class="app-body">
+            <div class="app-content">
+
+                <div class="content-wrapper">
+
+                    <%- include('partials/app-pagetitle', { pageTitle: title || 'Page', pageSubTitle1: 'Home', pageSubTitle2: title || 'Page' }) %>
+
+                    <div class="main-content">
+                        <%- body %>
+                    </div>
+
+                </div>
+
+            </div>
+
+            <%- include('partials/app-footer') %>
+
+        </main>
+
+        <%- include('partials/app-drawer') %>
+
+        <%- include('partials/app-settings') %>
+
+    </div>
+
+    <%- include('partials/app-scripts') %>
+
+</body>
+
+</html>