NW
88a15acb29
fix(admin): delete feedback alerts + informative block errors (issue #127 )
...
- locations/categories GET pass req.query.error/success to views
- locations/categories EJS render dismissible error/success alerts (modeled on catalog.ejs)
- Delete errors include blocking counts + 'Remove X first' hints
- 🔒 lock hint on rows with linked categories/products/subcategories
- 18 new tests (adminDeleteFeedback.test.js); 48 total pass
2026-08-04 17:05:06 +01:00
NW
47c698aa42
fix(admin): make catalog CRUD management visible
...
- Add management toolbar on /catalog with links to /locations and /categories
- Expand catalog tree by default (all levels visible, no collapsed accordion)
- Add Back to Catalog link on /locations and /categories pages
- Edit/toggle/delete buttons for locations/categories/subcategories now immediately accessible
2026-07-25 13:12:12 +01:00
NW
ca2ddefd7a
feat(admin): full CRUD + enable/disable for locations, categories, subcategories
...
- Migration 011: add is_active INTEGER NOT NULL DEFAULT 1 to locations, categories, subcategories (idempotent)
- Admin routes: locations edit + toggle, categories toggle, subcategories edit + toggle (parallel endpoints on /catalog)
- Bot-side services: filter is_active=1 on locationService/categoryService read methods (getLocationById/getCategoryById left unfiltered for purchase display)
- Views: edit forms, toggle buttons, Active/Disabled badges, disabled row styling in locations.ejs, categories.ejs, catalog tree
- Add Categories nav item in sidebar (folder icon)
- Tests: 14 new tests for migration idempotency + service is_active filtering (23 total pass)
2026-07-19 23:22:21 +01:00
NW
2b30bc4a91
fix(admin): CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers, validation
2026-07-08 12:08:08 +01:00
NW
d4c476002c
feat(admin): SmartAdmin template redesign + security hardening
...
- Migrated all admin views from inline JS string templates to EJS
- Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid
- Added express-ejs-layouts for master layout wrapper
- Security:
- CSRF protection (double-submit cookie)
- Rate limiting on /login (5/15min)
- Token revocation via jti + globalLogoutTimestamp
- Re-auth (reauth_token) for destructive endpoints
- Settings whitelist (ALLOWED_KEYS) + removed process.exit
- Seed phrases no longer rendered in HTML (CSV export only)
- Multer fileFilter for image uploads + safe filename generation
- SQL injection fix (currency column allowlist)
- Global error handler + asyncHandler wrapper
- New files: csrf.js, errorHandler.js, error.ejs, all EJS templates
- SmartAdmin assets: CSS, icons, webfonts, plugins, scripts
2026-07-06 17:42:54 +01:00
