NW
d03c8419e5
feat(admin): super admin role, seed phrase viewer with QR code, CSRF disabled for Tor
...
- Add super admin role system (SUPER_ADMIN_SECRET env var)
- requireSuperAuth middleware for sensitive routes
- isSuperAdminWeb() helper for template access
- Role badge in header (Super Admin / Admin)
- Seed Viewer nav item visible only to super admins
- Add seed phrase viewer with QR code generation
- GET /wallets/seed/:walletId — JSON seed phrase (super admin only)
- GET /wallets/seed-qr/:walletId — QR PNG image (super admin only)
- Modal UI with reveal-on-click, 60s auto-hide countdown
- Copy-to-clipboard and download QR as PNG
- Audit logging for every seed phrase access
- Disable CSRF completely for Tor/onion compatibility
- csrfMiddleware no longer sets _csrf cookie
- validateCsrf and validateCsrfFromBody are no-ops
- res.locals.csrfToken set to empty string (prevents template errors)
- .env.example: document SUPER_ADMIN_SECRET variable
2026-07-09 16:40:15 +01:00
NW
2b30bc4a91
fix(admin): CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers, validation
2026-07-08 12:08:08 +01:00
NW
d4c476002c
feat(admin): SmartAdmin template redesign + security hardening
...
- Migrated all admin views from inline JS string templates to EJS
- Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid
- Added express-ejs-layouts for master layout wrapper
- Security:
- CSRF protection (double-submit cookie)
- Rate limiting on /login (5/15min)
- Token revocation via jti + globalLogoutTimestamp
- Re-auth (reauth_token) for destructive endpoints
- Settings whitelist (ALLOWED_KEYS) + removed process.exit
- Seed phrases no longer rendered in HTML (CSV export only)
- Multer fileFilter for image uploads + safe filename generation
- SQL injection fix (currency column allowlist)
- Global error handler + asyncHandler wrapper
- New files: csrf.js, errorHandler.js, error.ejs, all EJS templates
- SmartAdmin assets: CSS, icons, webfonts, plugins, scripts
2026-07-06 17:42:54 +01:00
NW
a8bf50df24
feat: add i18n localization system (en/es/de) with admin panel
...
- Add i18n module with tForUser/tForLang/t functions and {{param}} interpolation
- Add 3 locale files: en.json, es.json, de.json (201 keys each)
- Add language selection on /start and /language command with flag emojis
- Localize all bot user-facing strings (handlers, keyboards, errors)
- Localize messageRouter keyboard matching via locale keys
- Add DB migrations 008 (language column) and 009 (language_set column)
- Add localization admin tab at /locales for editing translations
- Add userService.getUserLanguage/setUserLanguage methods
- Cache user object on msg.__user to avoid triple DB fetch
- Idempotent migrations with checkColumnExists guards
- Error boundary on i18n locale file loading
- Admin locales route uses AVAILABLE_LANGUAGES import
2026-06-25 21:22:32 +01:00
NW
935c6df1dc
feat: rebuild Catalog with collapsible tree + product table + photo upload
...
- Left panel: collapsible tree (Country → City → District → Category → Subcategory)
- Quick-add buttons: + City, + District, + Category, + Subcategory
- Delete buttons with confirmation on all nodes
- Product count badges on each node
- Click node to filter right panel
- Right panel: Product table with Photo, Name, Category, Subcategory, Price, Stock
- Edit (✎) and Delete (✕) buttons per row
- Add Product modal with all fields
- Product edit form: name, price, stock, description, category, subcategory (JS filtered),
photo_url/hidden_photo_url (URL or file upload), hidden_coordinates, hidden_description, private_data
- Multer file upload for photos stored in /uploads/
- Routes: add-city, add-district, product CRUD with photo upload
- Product JSON API for modal editing
- Responsive grid: tree (320px) + table (1fr)
2026-06-22 21:42:56 +01:00
NW
c7bf3f132c
feat: unified Catalog page with Location→Category→Subcategory→Product tree
...
- New /catalog page with tree view: Location (🌍 ) → Category (📂 ) → Subcategory (📁 ) → Product
- Add/delete locations, categories, subcategories, products from one page
- JS-powered subcategory dropdown filtered by category
- Sticky sidebar with Add Location/Category/Product forms
- Responsive grid layout (tree + forms side by side, stacks on mobile)
- Navigation simplified: Catalog replaces separate Locations/Categories/Products
- Old routes still accessible for backward compatibility
- Subcategories table migration (006_subcategories.js)
- subcategory_id column added to products table
- Seed data includes subcategories (VPN, Accounts, Hardware, etc.)
2026-06-22 21:12:05 +01:00
NW
2012435370
feat: admin panel - Settings, Categories, Payment Wallets, Seed/Clear data, User Balances
...
- Settings page: bot token (masked), admin IDs, commission config, WireGuard status
- Categories page: CRUD with product count, delete guard
- Payment Wallets page: commission wallets display, toggle, percentage
- Users page: balance adjustment form (total_balance / bonus_balance) with audit log
- Seed & Reset page: seed demo data (5 users, 10 products, 5 wallets, 5 purchases)
and clear all data button with confirmation
- Dashboard: flash messages for seed/clear success
- Fixed seed.js: use dynamic IDs instead of hardcoded to avoid FK violations
- Fixed seed.js: clear all tables before seeding to avoid UNIQUE constraints
2026-06-22 14:20:58 +01:00
NW
4657b1dfb5
feat: web admin panel + better-sqlite3 migration + Docker fixes
...
- Added Express.js admin panel on port 3001 (ADMIN_PORT env)
- Dashboard: stats (users, products, purchases, revenue)
- Users: list, details, ban/unban toggle
- Products: CRUD by category
- Wallets: list with balances
- Purchases: history with filters
- Audit log: view audit trail
- Auth: token-based login with ADMIN_SECRET env var
- Migrated sqlite3 → better-sqlite3
- database.js: async adapter (runAsync/allAsync/getAsync)
- purchaseService.js: lastID → lastInsertRowid
- userService.js: lastID → lastInsertRowid
- Removed sqlite3 from package.json
- Fixed: dotenv/config import added to index.js
- Fixed: ENCRYPTION_KEY validation (32+ char hex)
- Fixed: Dockerfile multi-stage build (no python needed)
- Fixed: Docker DNS (network: host in build)
- Fixed: docker-compose port 3001, healthcheck on 3001
- Added express, cookie-parser, pino-pretty, better-sqlite3 deps
2026-06-22 10:54:01 +01:00
