NW
4657b1dfb5
feat: web admin panel + better-sqlite3 migration + Docker fixes
...
- Added Express.js admin panel on port 3001 (ADMIN_PORT env)
- Dashboard: stats (users, products, purchases, revenue)
- Users: list, details, ban/unban toggle
- Products: CRUD by category
- Wallets: list with balances
- Purchases: history with filters
- Audit log: view audit trail
- Auth: token-based login with ADMIN_SECRET env var
- Migrated sqlite3 → better-sqlite3
- database.js: async adapter (runAsync/allAsync/getAsync)
- purchaseService.js: lastID → lastInsertRowid
- userService.js: lastID → lastInsertRowid
- Removed sqlite3 from package.json
- Fixed: dotenv/config import added to index.js
- Fixed: ENCRYPTION_KEY validation (32+ char hex)
- Fixed: Dockerfile multi-stage build (no python needed)
- Fixed: Docker DNS (network: host in build)
- Fixed: docker-compose port 3001, healthcheck on 3001
- Added express, cookie-parser, pino-pretty, better-sqlite3 deps
2026-06-22 10:54:01 +01:00
NW
25d8507b11
fix: Docker multi-stage build for sqlite3, health endpoint, productValidator exports
...
- Dockerfile: multi-stage build (builder with python3+g++ for native addons)
- Dockerfile: wireguard-tools from edge/community repo
- Dockerfile: removed USER appuser (start.sh needs root for wg-quick)
- Dockerfile: health check on port 3000
- Added /health HTTP endpoint in index.js for Docker healthcheck
- Fixed productValidator.js: added named exports (validateProductName, validateProductPrice)
- Added better-sqlite3 as fallback dependency
2026-06-22 10:18:36 +01:00
NW
49945d9d81
security(csv-export): harden mnemonic export with super admin, audit, watermark ( #48 )
...
- Add SUPER_ADMIN_IDS config (fallback to ADMIN_IDS if not set)
- Add isSuperAdmin() to middleware/auth.js
- Create auditService.js for structured audit logging (DB + pino)
- Create migration 005_audit_log.js
- Add confirmation dialog before CSV export (confirm_export_ callback)
- Check isSuperAdmin before export — block non-super admins
- Audit log every export: admin ID, wallet type, wallet count
- Add exported_by watermark column to CSV with admin telegram ID
- Notify all other super admins when export occurs
- Add SUPER_ADMIN_IDS to .env.example
8 files changed, 154 insertions, 39 deletions
2026-06-22 10:07:58 +01:00
NW
a04e60d751
feat(state): replace in-memory Map with SQLite-backed stateService ( #59 )
...
- Create src/services/stateService.js with get/set/delete/has API
- Create migration 004_user_states.js (chat_id PK, state_data JSON, updated_at)
- TTL of 24 hours — expired states auto-deleted
- Cleanup job runs every hour (setInterval)
- Replace src/context/userStates.js Map with async stateService proxy
- Add await to all 45 userStates.get/set/delete/has calls across 13 files
- Add initStates() call in index.js startup sequence
- All state survives bot restarts now
18 files changed, 172 insertions, 46 deletions
2026-06-22 10:02:57 +01:00
NW
ce1b6003cb
feat(logging): replace 207 console.log/error/warn with pino structured logger ( #58 )
...
- Add pino + pino-pretty dependencies
- Create src/utils/logger.js with env-based LOG_LEVEL
- Replace all 207 console.log/error/warn calls across 46 source files
- Remove [DEBUG], [ERROR] string prefixes (levels convey this)
- Add pino redact for sensitive fields (mnemonic, privateKey, token, etc.)
- Structured logging with context objects instead of string interpolation
- NODE_ENV=production disables pino-pretty transport
49 files changed, 5601 insertions, 6056 deletions
2026-06-22 01:42:47 +01:00
NW
d0b26dae25
refactor(arch): replace if/else router with Map-based dispatcher ( #53 )
...
- index.js: 394→69 lines (82% reduction)
- callbackRouter.js (36 lines): Map-based dispatch with exact + prefix matching
- Longest-prefix-first for specificity
- Logs warning for unregistered callbacks
- messageRouter.js (27 lines): Ordered input handlers + text command Map
- routes.js (345 lines): All 59 callback routes + 9 text commands + 7 input handlers
- Exact routes: 19 (add_wallet, back_to_balance, etc.)
- Prefix routes: 40 (generate_wallet_, view_product_, etc.)
- Admin text commands with isAdmin guard
- Special cases: view_transaction_history_ page extraction
- Input handler order preserved (location → category → import → edit → dump → bonus)
2026-06-22 01:16:34 +01:00
NW
f8123e42bb
refactor(arch): split userWalletsHandler.js into 7 modular files ( #52 )
...
- 747-line monolith → 8 files (all ≤108 lines)
- balanceHandler (96 lines): showBalance, handleBackToBalance
- historyHandler (107 lines): handleTransactionHistory, handleWalletHistory
- refreshHandler (75 lines): handleRefreshBalance with balance refresh
- createHandler (94 lines): handleAddWallet, handleGenerateWallet
- topUpHandler (60 lines): handleTopUpWallet
- archiveHandler (86 lines): handleViewArchivedWallets
- helpers (19 lines): getNetworkName, getWalletAddress
- index.js (20 lines): re-exports all 11 handler methods
- Removed duplicate getBaseWalletType (now uses WalletUtils)
- Removed duplicate getNetworkName (now in helpers.js)
2026-06-22 01:11:53 +01:00
NW
4b7ed0c251
refactor(arch): split adminProductHandler.js into 13 modular files ( #51 )
...
- 1093-line monolith → 13 files (all ≤97 lines)
- navigationHandler: product management entry + country selection
- districtHandler: city + district selection
- categoryAddHandler: add category input + handler
- categoryEditHandler: edit category input + handler
- categorySelectionHandler: category selection display
- createHandler: add product prompt
- importHandler: product import (JSON/text/file)
- editStartHandler: product edit prompt
- editImportHandler: product edit import
- deleteHandler: product delete + confirm
- viewHandler: product detail view
- listHandler: product list with pagination
- productValidator: shared validation utilities
- index.js: router re-exporting all 17 handler methods
- Removed duplicate handleCategorySelection (subcategories table doesn't exist)
- Removed handleSubcategoryInput/handleAddSubcategory (references non-existent subcategories table)
2026-06-17 22:41:04 +01:00
NW
4b8144ac40
refactor(arch): split database.js into migrations + connection module ( #57 )
...
- database.js: 292→42 lines (connection + async helpers only)
- 001_initial_schema.js: 7 CREATE TABLE statements in transaction
- 002_add_columns.js: 5 ALTER TABLE checks with checkColumnExists
- 003_add_indexes.js: 6 CREATE INDEX statements
- runner.js: versioned migration runner with _meta table
- index.js: calls runMigrations() + cleanUpInvalidForeignKeys()
- ALLOWED_TABLES whitelist preserved in runner.js
- Schema version tracked in _meta table for idempotent runs
2026-06-17 22:28:11 +01:00
NW
2e8b6b5659
fix: add isAdmin delegate method to AdminHandler, fix exportCSV call in adminWalletsHandler
...
- AdminHandler.isAdmin() static method delegates to middleware/auth.js
(index.js calls adminHandler.isAdmin() which needs a class method)
- adminWalletsHandler: this.exportCSV() → this.handleExportCSV(callbackQuery)
(exportCSV doesn't exist, handleExportCSV is the correct method)
2026-06-17 22:19:40 +01:00
NW
68d83807ad
refactor(arch): Phase 2 — deduplicate isAdmin, convertToUsd, getBaseWalletType
...
- #54 : Extract isAdmin() to src/middleware/auth.js, remove duplicates from 7 admin handlers
- #55 : Add WalletUtils.convertToUsd(), replace 8 switch-case blocks across 4 files
- #56 : Unify getBaseWalletType() — keep only WalletUtils version (most complete),
remove duplicates from Wallet.js and userWalletsHandler.js
New file: src/middleware/auth.js
Net: -215 lines, +80 lines
Closes : #54 , #55 , #56
2026-06-17 22:10:34 +01:00
NW
de415633be
feat(security): Phase 1 — critical security fixes and hardening
...
- #42 : Remove hardcoded ENCRYPTION_KEY fallback from config.js,
add startup validation for BOT_TOKEN and ENCRYPTION_KEY length
- #43 : Fix SQL injection vulnerabilities — add ALLOWED_TABLES
whitelist in database.js, ALLOWED_USER_FIELDS in userService.js,
validate table names before PRAGMA
- #44 : Fix race condition in purchaseService.js — wrap createPurchase
in BEGIN IMMEDIATE TRANSACTION, add atomic balance/stock checks
- #41 : Move all secrets from docker-compose.yml to .env file,
use env_file directive
- #45 : Replace MD5 tx_hash with crypto.randomUUID()
- #46 : Upgrade KDF from SHA-256 to HKDF for mnemonic encryption,
add backward compatibility for legacy format
- #47 : Add input validation across all handlers — walletType
whitelist, string length limits, numeric ID checks, price bounds
New files:
- src/utils/encryption.js (HKDF key derivation)
- src/__tests__/security.test.js (SQL injection prevention tests)
Closes : #41 , #42 , #43 , #44 , #45 , #46 , #47
2026-06-17 21:52:49 +01:00
c8b6e3ceb3
litle update
2025-02-05 16:40:00 +00:00
23b7f8b4bd
big update WG-TOR bot connecting
2025-02-03 09:43:25 +00:00
633a27164b
upgrade comission wallet function
2025-01-26 22:21:13 +00:00
ae1cd45aea
create functional commission
2025-01-25 13:35:22 +00:00
fa09e81ddf
crypto mnemonic case
2025-01-25 01:13:10 +00:00
fcd89bc345
update calculate user balance in admin section
2025-01-09 20:13:45 +00:00
dd18e74529
update calculate user balance
2025-01-09 20:07:44 +00:00
f9356c6bbe
update user purchase list
2025-01-09 13:25:35 +00:00
18647091cf
minor edits to aesthetics and functionality
2025-01-08 18:26:50 +00:00
5ae148a2ba
update planned wallets function
2025-01-08 16:20:43 +00:00
66f5251795
update check ETH USDT USDC balance function
2025-01-08 12:01:02 +00:00
e64f185eda
separate wallet ETH USDT USDC
2025-01-02 19:31:28 +00:00
22f76c64a6
delet TRON wallet type
2025-01-02 16:19:39 +00:00
c9bcb09221
udpdate wallet function
2024-12-24 09:19:14 +00:00
3129525a1e
update user and admin wallet function
2024-12-23 20:44:56 +00:00
a970a188db
new user registration function
2024-12-18 19:46:29 +00:00
b224b3f331
update UserService
2024-12-18 16:16:41 +00:00
bfb9a55e36
update viev balance
2024-12-17 00:19:53 +00:00
4aebb4e41b
update user info page
2024-12-17 00:05:59 +00:00
a575f75faf
user catalog navigation upgrade
2024-12-16 23:56:09 +00:00
21465022b3
whallets upgrade function
2024-12-16 23:43:44 +00:00
d51bc9f0b9
User start registration update function
2024-12-16 12:37:44 +00:00
2cfa37ea86
fix bug back navigation
2024-12-15 02:04:43 +00:00
9d9e0e80ad
Bug update function
2024-12-14 23:12:36 +00:00
682246675e
update handleProductSelection
2024-12-14 15:06:22 +00:00
2aea225e2e
update back category
2024-12-14 15:02:50 +00:00
12d29c66b9
Update DistrictSelection back button
2024-12-14 13:16:22 +00:00
207b9a829c
delet subcatecory viev line
2024-12-14 13:10:23 +00:00
3843dcb094
Update handleBuyProduct
2024-12-14 13:07:46 +00:00
eea5d9b9e7
revert 99137e4e97
...
revert Update Detailed Product Viev
2024-12-14 12:54:50 +00:00
057d1536bb
Check bug delet category
2024-12-14 10:47:22 +00:00
99137e4e97
Update Detailed Product Viev
2024-12-14 00:37:24 +00:00
a400d12d16
Delet subcategory function in handleCategorySelection
2024-12-13 18:24:24 +00:00
95d5fe644d
Delet Subcategory Function
2024-12-13 16:41:41 +00:00
3e78e231f3
0 update adminHandlers
2024-12-13 13:41:49 +00:00
13a2d67474
rewrite sampleProduct
2024-12-05 18:43:00 +00:00
Artyom Ashirov
82ffa81141
account deletion
2024-12-05 21:29:32 +03:00
Artyom Ashirov
e3b82bb3dd
pay with main balance
2024-12-05 16:18:27 +03:00
