NW
f0afada884
feat: Mercuryo gateway, crypto QR deposit, mono products, wallet auto-refresh
...
- Replace Quickex/Guardarian with Mercuryo (https://mercuryo.io/ )
- Add crypto QR code payment option in deposit flow (qrcode package)
- Add is_mono product flag for digital/infinite products
- Mono products: no quantity buttons in bot, always available
- Admin wallet page: auto-refresh balances from blockchain APIs
- Migration 010: add is_mono column to products
- i18n updates for en/de/es
2026-07-08 12:08:13 +01:00
NW
d4c476002c
feat(admin): SmartAdmin template redesign + security hardening
...
- Migrated all admin views from inline JS string templates to EJS
- Integrated SmartAdmin template with dark sidebar, fixed header, CSS grid
- Added express-ejs-layouts for master layout wrapper
- Security:
- CSRF protection (double-submit cookie)
- Rate limiting on /login (5/15min)
- Token revocation via jti + globalLogoutTimestamp
- Re-auth (reauth_token) for destructive endpoints
- Settings whitelist (ALLOWED_KEYS) + removed process.exit
- Seed phrases no longer rendered in HTML (CSV export only)
- Multer fileFilter for image uploads + safe filename generation
- SQL injection fix (currency column allowlist)
- Global error handler + asyncHandler wrapper
- New files: csrf.js, errorHandler.js, error.ejs, all EJS templates
- SmartAdmin assets: CSS, icons, webfonts, plugins, scripts
2026-07-06 17:42:54 +01:00
NW
98eb27c573
fix: lock seed phrases behind commission payment gate
...
- Seeds only unlock when lastPaidAmount >= currentCommission
- CSV export endpoint also checks commission before serving
- Button shows locked state with amount due when commission unpaid
- Prevents free access to encrypted mnemonics without payment
2026-06-23 13:13:43 +01:00
NW
a6d81cfe83
feat: commission tracking based on wallet balances with payment history
...
- Commission = 5% of total wallet balances (not sales)
- Track commission payments in commission_payments table (migration 007)
- Show 'Due Now' = current commission - last payment amount
- Record payment form with amount and optional note
- Payment history table with date, balances, commission, paid, delta
- Delta shows difference between consecutive payments (new users = more owed)
- Seed phrase unlock reminder shows the commission due amount
- Stat warning highlight when commission is due
2026-06-23 13:01:15 +01:00
NW
76daf07bb4
feat: owner summary with wallet stats, commission info and seed phrase unlock
...
- Added Owner Summary section below user wallets with:
- Total wallet balance (USD) across all currencies
- Completed sales total
- Commission calculation (rate × sales)
- User and wallet counts
- Wallet balances by currency table (coin, count, balance, USD)
- Commission wallets display for owner payment
- Seed phrases section: locked by default, unlock via button
- CSV export for all decrypted seed phrases
- Seed phrase decrypt uses existing WalletService.decryptMnemonic
- Preserves user selection when toggling seed unlock
2026-06-23 12:51:57 +01:00
NW
b6f21222e7
feat: wallet balances grouped by user with split layout
...
- Left sidebar: user list with ID, username, status icon, wallet count
- Right panel: selected user's balances + crypto wallet table
- Fix inverted status logic (0=Active, 1=Deleted, 2=Blocked)
- Admin bot: block/unblock toggle based on current user status
- Seed data: set active users to status=0 instead of status=1
- Toggle-status route: 0↔2 instead of 1↔0
2026-06-23 12:41:18 +01:00
NW
4657b1dfb5
feat: web admin panel + better-sqlite3 migration + Docker fixes
...
- Added Express.js admin panel on port 3001 (ADMIN_PORT env)
- Dashboard: stats (users, products, purchases, revenue)
- Users: list, details, ban/unban toggle
- Products: CRUD by category
- Wallets: list with balances
- Purchases: history with filters
- Audit log: view audit trail
- Auth: token-based login with ADMIN_SECRET env var
- Migrated sqlite3 → better-sqlite3
- database.js: async adapter (runAsync/allAsync/getAsync)
- purchaseService.js: lastID → lastInsertRowid
- userService.js: lastID → lastInsertRowid
- Removed sqlite3 from package.json
- Fixed: dotenv/config import added to index.js
- Fixed: ENCRYPTION_KEY validation (32+ char hex)
- Fixed: Dockerfile multi-stage build (no python needed)
- Fixed: Docker DNS (network: host in build)
- Fixed: docker-compose port 3001, healthcheck on 3001
- Added express, cookie-parser, pino-pretty, better-sqlite3 deps
2026-06-22 10:54:01 +01:00
