NW
ca2ddefd7a
feat(admin): full CRUD + enable/disable for locations, categories, subcategories
...
- Migration 011: add is_active INTEGER NOT NULL DEFAULT 1 to locations, categories, subcategories (idempotent)
- Admin routes: locations edit + toggle, categories toggle, subcategories edit + toggle (parallel endpoints on /catalog)
- Bot-side services: filter is_active=1 on locationService/categoryService read methods (getLocationById/getCategoryById left unfiltered for purchase display)
- Views: edit forms, toggle buttons, Active/Disabled badges, disabled row styling in locations.ejs, categories.ejs, catalog tree
- Add Categories nav item in sidebar (folder icon)
- Tests: 14 new tests for migration idempotency + service is_active filtering (23 total pass)
2026-07-19 23:22:21 +01:00
NW
b6eb42ccfc
fix: seed phrase modal, USDT address bug, CSV balance column, remove CSRF
...
- Fix seed phrase reveal modal: use classList instead of style.display
to properly toggle d-none/d-flex on Bootstrap elements
- Fix USDT/USDC wallet creation bug: was using ETH address (index 0)
instead of correct derivation path address (index 1/2)
- Add Balance column to CSV seed export
- Remove CSRF tokens from wallets.ejs (incompatible with Tor/onion)
- Super admin CSV export: no commission check required
- Audit logging for CSV seed exports
- Use window.addEventListener('load') for seed modal JS to ensure
Bootstrap is loaded before initializing bootstrap.Modal
2026-07-14 14:50:24 +01:00
NW
f0afada884
feat: Mercuryo gateway, crypto QR deposit, mono products, wallet auto-refresh
...
- Replace Quickex/Guardarian with Mercuryo (https://mercuryo.io/ )
- Add crypto QR code payment option in deposit flow (qrcode package)
- Add is_mono product flag for digital/infinite products
- Mono products: no quantity buttons in bot, always available
- Admin wallet page: auto-refresh balances from blockchain APIs
- Migration 010: add is_mono column to products
- i18n updates for en/de/es
2026-07-08 12:08:13 +01:00
NW
a8bf50df24
feat: add i18n localization system (en/es/de) with admin panel
...
- Add i18n module with tForUser/tForLang/t functions and {{param}} interpolation
- Add 3 locale files: en.json, es.json, de.json (201 keys each)
- Add language selection on /start and /language command with flag emojis
- Localize all bot user-facing strings (handlers, keyboards, errors)
- Localize messageRouter keyboard matching via locale keys
- Add DB migrations 008 (language column) and 009 (language_set column)
- Add localization admin tab at /locales for editing translations
- Add userService.getUserLanguage/setUserLanguage methods
- Cache user object on msg.__user to avoid triple DB fetch
- Idempotent migrations with checkColumnExists guards
- Error boundary on i18n locale file loading
- Admin locales route uses AVAILABLE_LANGUAGES import
2026-06-25 21:22:32 +01:00
NW
5a9155613e
fix: location navigation uses IDs and pipe separators instead of underscore
...
Critical fix for product management location selection:
- Country/city callback_data now uses pipe | as separator with
encodeURIComponent/decodeURIComponent for special chars
- District selection uses location ID (prod_loc_{id}, shop_loc_{id})
instead of underscore-delimited country_city_district text
- Empty district names now show city name as fallback
- LocationService.getLocationsByCountryAndCity() returns id+district
for building callback_data with location IDs
- All error handlers in admin product navigation use editOrSendCallback
to avoid chat clutter
- Routes updated: prod_district_ → prod_loc_, shop_district_ → shop_loc_
This fixes the bug where selecting country/city/district in admin panel
or shop failed because split('_') broke on multi-word names or empty
district values.
2026-06-24 22:44:02 +01:00
NW
4657b1dfb5
feat: web admin panel + better-sqlite3 migration + Docker fixes
...
- Added Express.js admin panel on port 3001 (ADMIN_PORT env)
- Dashboard: stats (users, products, purchases, revenue)
- Users: list, details, ban/unban toggle
- Products: CRUD by category
- Wallets: list with balances
- Purchases: history with filters
- Audit log: view audit trail
- Auth: token-based login with ADMIN_SECRET env var
- Migrated sqlite3 → better-sqlite3
- database.js: async adapter (runAsync/allAsync/getAsync)
- purchaseService.js: lastID → lastInsertRowid
- userService.js: lastID → lastInsertRowid
- Removed sqlite3 from package.json
- Fixed: dotenv/config import added to index.js
- Fixed: ENCRYPTION_KEY validation (32+ char hex)
- Fixed: Dockerfile multi-stage build (no python needed)
- Fixed: Docker DNS (network: host in build)
- Fixed: docker-compose port 3001, healthcheck on 3001
- Added express, cookie-parser, pino-pretty, better-sqlite3 deps
2026-06-22 10:54:01 +01:00
NW
49945d9d81
security(csv-export): harden mnemonic export with super admin, audit, watermark ( #48 )
...
- Add SUPER_ADMIN_IDS config (fallback to ADMIN_IDS if not set)
- Add isSuperAdmin() to middleware/auth.js
- Create auditService.js for structured audit logging (DB + pino)
- Create migration 005_audit_log.js
- Add confirmation dialog before CSV export (confirm_export_ callback)
- Check isSuperAdmin before export — block non-super admins
- Audit log every export: admin ID, wallet type, wallet count
- Add exported_by watermark column to CSV with admin telegram ID
- Notify all other super admins when export occurs
- Add SUPER_ADMIN_IDS to .env.example
8 files changed, 154 insertions, 39 deletions
2026-06-22 10:07:58 +01:00
NW
a04e60d751
feat(state): replace in-memory Map with SQLite-backed stateService ( #59 )
...
- Create src/services/stateService.js with get/set/delete/has API
- Create migration 004_user_states.js (chat_id PK, state_data JSON, updated_at)
- TTL of 24 hours — expired states auto-deleted
- Cleanup job runs every hour (setInterval)
- Replace src/context/userStates.js Map with async stateService proxy
- Add await to all 45 userStates.get/set/delete/has calls across 13 files
- Add initStates() call in index.js startup sequence
- All state survives bot restarts now
18 files changed, 172 insertions, 46 deletions
2026-06-22 10:02:57 +01:00
NW
ce1b6003cb
feat(logging): replace 207 console.log/error/warn with pino structured logger ( #58 )
...
- Add pino + pino-pretty dependencies
- Create src/utils/logger.js with env-based LOG_LEVEL
- Replace all 207 console.log/error/warn calls across 46 source files
- Remove [DEBUG], [ERROR] string prefixes (levels convey this)
- Add pino redact for sensitive fields (mnemonic, privateKey, token, etc.)
- Structured logging with context objects instead of string interpolation
- NODE_ENV=production disables pino-pretty transport
49 files changed, 5601 insertions, 6056 deletions
2026-06-22 01:42:47 +01:00
NW
68d83807ad
refactor(arch): Phase 2 — deduplicate isAdmin, convertToUsd, getBaseWalletType
...
- #54 : Extract isAdmin() to src/middleware/auth.js, remove duplicates from 7 admin handlers
- #55 : Add WalletUtils.convertToUsd(), replace 8 switch-case blocks across 4 files
- #56 : Unify getBaseWalletType() — keep only WalletUtils version (most complete),
remove duplicates from Wallet.js and userWalletsHandler.js
New file: src/middleware/auth.js
Net: -215 lines, +80 lines
Closes : #54 , #55 , #56
2026-06-17 22:10:34 +01:00
NW
de415633be
feat(security): Phase 1 — critical security fixes and hardening
...
- #42 : Remove hardcoded ENCRYPTION_KEY fallback from config.js,
add startup validation for BOT_TOKEN and ENCRYPTION_KEY length
- #43 : Fix SQL injection vulnerabilities — add ALLOWED_TABLES
whitelist in database.js, ALLOWED_USER_FIELDS in userService.js,
validate table names before PRAGMA
- #44 : Fix race condition in purchaseService.js — wrap createPurchase
in BEGIN IMMEDIATE TRANSACTION, add atomic balance/stock checks
- #41 : Move all secrets from docker-compose.yml to .env file,
use env_file directive
- #45 : Replace MD5 tx_hash with crypto.randomUUID()
- #46 : Upgrade KDF from SHA-256 to HKDF for mnemonic encryption,
add backward compatibility for legacy format
- #47 : Add input validation across all handlers — walletType
whitelist, string length limits, numeric ID checks, price bounds
New files:
- src/utils/encryption.js (HKDF key derivation)
- src/__tests__/security.test.js (SQL injection prevention tests)
Closes : #41 , #42 , #43 , #44 , #45 , #46 , #47
2026-06-17 21:52:49 +01:00
23b7f8b4bd
big update WG-TOR bot connecting
2025-02-03 09:43:25 +00:00
fa09e81ddf
crypto mnemonic case
2025-01-25 01:13:10 +00:00
dd18e74529
update calculate user balance
2025-01-09 20:07:44 +00:00
f9356c6bbe
update user purchase list
2025-01-09 13:25:35 +00:00
5ae148a2ba
update planned wallets function
2025-01-08 16:20:43 +00:00
66f5251795
update check ETH USDT USDC balance function
2025-01-08 12:01:02 +00:00
c9bcb09221
udpdate wallet function
2024-12-24 09:19:14 +00:00
3129525a1e
update user and admin wallet function
2024-12-23 20:44:56 +00:00
a970a188db
new user registration function
2024-12-18 19:46:29 +00:00
b224b3f331
update UserService
2024-12-18 16:16:41 +00:00
4aebb4e41b
update user info page
2024-12-17 00:05:59 +00:00
21465022b3
whallets upgrade function
2024-12-16 23:43:44 +00:00
d51bc9f0b9
User start registration update function
2024-12-16 12:37:44 +00:00
2cfa37ea86
fix bug back navigation
2024-12-15 02:04:43 +00:00
9d9e0e80ad
Bug update function
2024-12-14 23:12:36 +00:00
eea5d9b9e7
revert 99137e4e97
...
revert Update Detailed Product Viev
2024-12-14 12:54:50 +00:00
99137e4e97
Update Detailed Product Viev
2024-12-14 00:37:24 +00:00
95d5fe644d
Delet Subcategory Function
2024-12-13 16:41:41 +00:00
Artyom Ashirov
5d4f56e265
refactoring
2024-11-23 05:03:30 +03:00
