Commit Graph

3 Commits

Author SHA1 Message Date
NW
49945d9d81 security(csv-export): harden mnemonic export with super admin, audit, watermark (#48)
- Add SUPER_ADMIN_IDS config (fallback to ADMIN_IDS if not set)
- Add isSuperAdmin() to middleware/auth.js
- Create auditService.js for structured audit logging (DB + pino)
- Create migration 005_audit_log.js
- Add confirmation dialog before CSV export (confirm_export_ callback)
- Check isSuperAdmin before export — block non-super admins
- Audit log every export: admin ID, wallet type, wallet count
- Add exported_by watermark column to CSV with admin telegram ID
- Notify all other super admins when export occurs
- Add SUPER_ADMIN_IDS to .env.example

8 files changed, 154 insertions, 39 deletions
2026-06-22 10:07:58 +01:00
NW
ce1b6003cb feat(logging): replace 207 console.log/error/warn with pino structured logger (#58)
- Add pino + pino-pretty dependencies
- Create src/utils/logger.js with env-based LOG_LEVEL
- Replace all 207 console.log/error/warn calls across 46 source files
- Remove [DEBUG], [ERROR] string prefixes (levels convey this)
- Add pino redact for sensitive fields (mnemonic, privateKey, token, etc.)
- Structured logging with context objects instead of string interpolation
- NODE_ENV=production disables pino-pretty transport

49 files changed, 5601 insertions, 6056 deletions
2026-06-22 01:42:47 +01:00
NW
d0b26dae25 refactor(arch): replace if/else router with Map-based dispatcher (#53)
- index.js: 394→69 lines (82% reduction)
- callbackRouter.js (36 lines): Map-based dispatch with exact + prefix matching
  - Longest-prefix-first for specificity
  - Logs warning for unregistered callbacks
- messageRouter.js (27 lines): Ordered input handlers + text command Map
- routes.js (345 lines): All 59 callback routes + 9 text commands + 7 input handlers
  - Exact routes: 19 (add_wallet, back_to_balance, etc.)
  - Prefix routes: 40 (generate_wallet_, view_product_, etc.)
  - Admin text commands with isAdmin guard
  - Special cases: view_transaction_history_ page extraction
  - Input handler order preserved (location → category → import → edit → dump → bonus)
2026-06-22 01:16:34 +01:00