3 Commits

Author	SHA1	Message	Date
NW	2b30bc4a91	fix(admin): CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers, validation	2026-07-08 12:08:08 +01:00
NW	d4c476002c	feat(admin): SmartAdmin template redesign + security hardening ... - Migrated all admin views from inline JS string templates to EJS - Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid - Added express-ejs-layouts for master layout wrapper - Security: - CSRF protection (double-submit cookie) - Rate limiting on /login (5/15min) - Token revocation via jti + globalLogoutTimestamp - Re-auth (reauth_token) for destructive endpoints - Settings whitelist (ALLOWED_KEYS) + removed process.exit - Seed phrases no longer rendered in HTML (CSV export only) - Multer fileFilter for image uploads + safe filename generation - SQL injection fix (currency column allowlist) - Global error handler + asyncHandler wrapper - New files: csrf.js, errorHandler.js, error.ejs, all EJS templates - SmartAdmin assets: CSS, icons, webfonts, plugins, scripts	2026-07-06 17:42:54 +01:00
NW	c7bf3f132c	feat: unified Catalog page with Location→Category→Subcategory→Product tree ... - New /catalog page with tree view: Location (🌍) → Category (📂) → Subcategory (📁) → Product - Add/delete locations, categories, subcategories, products from one page - JS-powered subcategory dropdown filtered by category - Sticky sidebar with Add Location/Category/Product forms - Responsive grid layout (tree + forms side by side, stacks on mobile) - Navigation simplified: Catalog replaces separate Locations/Categories/Products - Old routes still accessible for backward compatibility - Subcategories table migration (006_subcategories.js) - subcategory_id column added to products table - Seed data includes subcategories (VPN, Accounts, Hardware, etc.)	2026-06-22 21:12:05 +01:00