senke/veza
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1903 commits 37 branches 94 tags 1.5 GiB
Commit graph

1903 commits

This branch
This branch
All branches
Author SHA1 Message Date
senke
834fa1f979 refactor: remove dead code (api_manager.go, unused templates) 
CLN-01: Deleted archived api_manager.go (~789 LOC, build-tag ignore)
and dev-environment/templates/ (~806 LOC, never used by generator).
 2026-02-22 17:44:19 +01:00
senke
763aea15cb fix(security): hash password reset tokens before database storage
Some checks failed
Backend API CI / test-unit (push) Failing after 0s
Details
Backend API CI / test-integration (push) Failing after 0s
Details 
INF-10: Reset tokens are now SHA-256 hashed before INSERT. Validation
hashes the received token and compares against stored hash. Plain
tokens never persisted.
 2026-02-22 17:36:10 +01:00
senke
6b25ccc9da feat(monitoring): add Prometheus alerting rules for critical conditions 
INF-08: Alert rules for service_down, high_error_rate (>5%),
high_latency (P99>2s), and redis_unreachable. Enabled rule_files
in prometheus.yml.
 2026-02-22 17:36:07 +01:00
senke
3e0e1b5286 feat(infra): complete staging compose with chat, stream, and reverse proxy 
INF-07: Added chat-server, stream-server, Caddy reverse proxy,
and healthchecks for all services in staging compose.
 2026-02-22 17:36:03 +01:00
senke
de92bf6029 feat(ci): add CodeQL SAST scanning for Go and TypeScript 
INF-06: New sast.yml workflow runs CodeQL analysis on push to main
and PRs for Go and JavaScript/TypeScript.
 2026-02-22 17:35:50 +01:00
senke
68069df6e4 feat(ci): add clippy lint step for Rust services 
INF-05: New rust-ci.yml runs cargo clippy with -D warnings for both
chat-server and stream-server.
 2026-02-22 17:35:46 +01:00
senke
13c21ac114 feat(ci): add go vet and gofmt check to backend CI 
INF-04: Backend CI now runs go vet and gofmt to catch issues early.
 2026-02-22 17:35:42 +01:00
senke
66149ff2f7 fix(ci): add lint, typecheck and build steps to frontend CI 
INF-03: frontend-ci.yml now runs eslint, tsc --noEmit, and vite build.
Audit level aligned to critical.
 2026-02-22 17:35:39 +01:00
senke
389cfa95b0 fix(infra): align PostgreSQL to version 16 in test compose 
INF-02: Test environment now uses postgres:16-alpine to match production.
 2026-02-22 17:35:35 +01:00
senke
c29edd099b feat(security): implement Redis-backed rate limiter with in-memory fallback 
INF-01: RedisRateLimiter uses atomic Lua script (INCR+EXPIRE) for
distributed rate limiting. Falls back to in-memory SimpleRateLimiter
when Redis is unavailable. Same X-RateLimit-* headers and 429 format.
 2026-02-22 17:35:21 +01:00
senke
d64512ec66 fix(ci): move hardcoded E2E credentials to GitHub Secrets 
SEC-10: Replaced hardcoded TEST_PASSWORD, JWT_SECRET, DATABASE_URL
password, and RABBITMQ_URL with GitHub Secrets references. Secrets
to create: E2E_TEST_PASSWORD, E2E_JWT_SECRET, E2E_RABBITMQ_URL,
E2E_DB_PASSWORD.
 2026-02-22 17:32:52 +01:00
senke
d3245b2e4b fix(build): unify Go version to 1.24 across Dockerfile and CI 
SEC-09: go.mod declares Go 1.24.0 but Dockerfile.production used 1.23
and backend-ci.yml used 1.23. Aligned both to 1.24.
 2026-02-22 17:32:17 +01:00
senke
368c78c102 fix(security): require Hyperswitch webhook secret in production when payments enabled 
SEC-08: If HYPERSWITCH_ENABLED=true in production, startup now fails
unless HYPERSWITCH_WEBHOOK_SECRET is set. This prevents webhook
signature verification from being silently bypassed.
 2026-02-22 17:31:52 +01:00
senke
f14574322c fix(security): add SSRF protection for webhook URL registration 
SEC-07: Strengthened ValidateWebhookURL to require HTTPS only (was
allowing HTTP). Private IP ranges, localhost, and cloud metadata
endpoints remain blocked.
 2026-02-22 17:31:10 +01:00
senke
da3bad1b0e fix(security): add ownership check to GetUploadStatus handler (IDOR fix) 
SEC-06: GetUploadStatus now verifies that the authenticated user owns the
upload before returning status. Returns 404 for non-owners to prevent
information disclosure.
 2026-02-22 17:30:30 +01:00
senke
c6db1da25e fix(infra): add JWT_SECRET to stream-server in production compose 
SEC-05: stream-server was missing JWT_SECRET while chat-server had it.
Both services need the shared secret to validate tokens.
 2026-02-22 17:28:37 +01:00
senke
b84baf1823 fix(infra): remove docker-compose.hybrid.yml (network_mode host + default credentials) 
SEC-04: File used network_mode: host on all services and had default
Grafana password 'admin'. Removed entirely; if needed in the future,
recreate without host networking.
 2026-02-22 17:28:17 +01:00
senke
5e4291ecba feat(auth): add ephemeral stream-token endpoint for HLS and WebSocket authentication 
SEC-03: TokenStorage.getAccessToken() returns null with httpOnly cookies.
New POST /api/v1/auth/stream-token returns a 5-min JWT compatible with
both stream server (Claims struct) and chat server (JwtClaims struct).
Frontend hlsService and websocket updated to use fetchStreamToken() fallback.
 2026-02-22 17:28:00 +01:00
senke
3ad4699e80 fix(infra): add Redis authentication in production compose 2026-02-22 17:24:12 +01:00
senke
eb82e02c83 fix(ci): repair CD pipeline -- use vars.* instead of secrets.* in if conditions, target Dockerfile.production 2026-02-22 17:23:43 +01:00
senke
40c31b8c3d feat(marketplace): wire RefundRequestModal to API, add refund button to SellerDashboard (v0.403 R2) 
- RefundRequestModal: call marketplaceService.refundOrder, loading state, onSuccess callback
- PurchasesView: pass loadPurchases as onSuccess to refetch after refund
- SellerDashboardView: add Refund button on each sale, RefundRequestModal with fetchData onSuccess
- MSW: add POST /marketplace/orders/:id/refund handler
 2026-02-22 16:19:31 +01:00
senke
bab3f38c4a feat(marketplace): add license revoked_at migration 2026-02-22 16:18:01 +01:00
senke
51373b653f feat(hyperswitch): add CreateRefund to client 2026-02-22 16:17:54 +01:00
senke
9f4c84c025 feat(marketplace): add invoice download link to PurchasesView and LicensesView 2026-02-22 16:15:55 +01:00
senke
166acc6069 chore(backend): add PDF library for invoices 
feat(marketplace): add invoice generation service and download endpoint
 2026-02-22 16:11:42 +01:00
senke
e6797481cf feat(marketplace): add review API to frontend 2026-02-22 16:09:04 +01:00
senke
c6611c3d8f feat(marketplace): add avg_rating and review_count to Product 2026-02-22 16:07:06 +01:00
senke
85daf595a8 feat(marketplace): add create and list reviews endpoints 2026-02-22 16:06:18 +01:00
senke
d6d49dbfc3 feat(marketplace): add ProductReview model and service 2026-02-22 16:05:16 +01:00
senke
4ac1bf7c25 feat(marketplace): add product_reviews migration 2026-02-22 16:04:14 +01:00
senke
7534c1d50e docs: prepare v0.403 implementation (scope, plan, SCOPE_CONTROL) 
- Add V0_403_RELEASE_SCOPE.md: P3 Payout, R1 Reviews, F1 Factures, R2 Remboursements
- Add PLAN_V0_403_IMPLEMENTATION.md: phases détaillées, commits suggérés
- Update SCOPE_CONTROL: reference v0.403, v0.402 taguée
- Update FEATURE_STATUS: section Prévu en v0.403
- Update PROJECT_STATE: prochaines étapes v0.403
 2026-02-22 16:01:03 +01:00
senke
89a09c2b35 feat(checkout): integrate Hyperswitch payment form in Cart 2026-02-22 14:46:06 +01:00
senke
5ac4c3988a fix(checkout): handle cancelled status in Hyperswitch webhook 2026-02-22 14:42:57 +01:00
senke
9cd56a05a6 docs: update PAYMENTS_SETUP for checkout complete URL 2026-02-22 14:42:44 +01:00
senke
508e082bcc feat(checkout): add CheckoutSuccessView, CheckoutErrorView and getOrder 2026-02-22 14:42:15 +01:00
senke
5233a5b7f2 feat(checkout): add order_id to Hyperswitch return URL 2026-02-22 14:40:13 +01:00
senke
c8400789d5 docs: update SCOPE_CONTROL for v0.402 2026-02-22 14:26:28 +01:00
senke
464a23e545 docs: add V0_402_RELEASE_SCOPE and PLAN_V0_402_IMPLEMENTATION 2026-02-22 14:26:19 +01:00
senke
fa4d141572 test(marketplace): add MSW handlers, update CHANGELOG and docs for v0.401 2026-02-22 14:23:28 +01:00
senke
0adc212719 feat(seller): add GET /sell/stats/evolution, top-products, sales, SalesEvolutionChart, real commerceService 2026-02-22 14:21:21 +01:00
senke
c418e677d2 feat(marketplace): add getMyLicenses, enrich LicenceCard/LicenceDetailsModal, LicensesView 2026-02-22 14:18:05 +01:00
senke
1fef428ce0 feat(marketplace): add migration 098 product_licenses, ProductLicense model, GET /licenses/mine 2026-02-22 14:16:24 +01:00
senke
31a27e4724 feat(marketplace): add playable preview and image gallery to ProductDetailView 2026-02-22 14:14:38 +01:00
senke
a8549add70 feat(marketplace): add rich text description with sanitization 2026-02-22 14:14:27 +01:00
senke
7ee70925e8 feat(marketplace): add BPM, key, category filters to MarketplaceHome 2026-02-22 14:14:20 +01:00
senke
3d7cc141fe feat(marketplace): connect CreateProductView to enriched product API 2026-02-22 14:10:26 +01:00
senke
13d9e96001 feat(marketplace): add bpm, musical_key, category to marketplaceService listProducts 2026-02-22 14:08:59 +01:00
senke
d292270d4e feat(marketplace): add bpm, musical_key, category filters to ListProducts 2026-02-22 14:08:41 +01:00
senke
aec22b596c feat(marketplace): add product images management endpoint 2026-02-22 14:08:13 +01:00
senke
c6f094a3d5 feat(marketplace): add POST /products/:id/preview for audio preview upload 2026-02-22 14:07:30 +01:00