Commit Graph

6 Commits

Author SHA1 Message Date
nineap 0927053f4a Fix Docker build: vendor the cyberhack wasm bundle instead of a cross-repo file: path
CI build failed with ENOENT on /Cyberhack/pkg: package.json pointed the
"cyberhack" dependency at "file:../../Cyberhack/pkg", a path outside this
repo's own directory tree entirely. That only ever resolved on a
developer machine that happened to have a sibling checkout of the
Cyberhack repo — Docker's build context is confined to this repo, and CI
never checks out Cyberhack in the first place, so pnpm install had
nothing to link against.

There's no npm registry publish set up for that package, so vendor the
already-built wasm-pack output directly into frontend/vendor/cyberhack
(committed) and point the dependency at "file:./vendor/cyberhack" instead
— a path inside the build context. Dockerfile now copies frontend/vendor
before pnpm install so the file: resolution actually has something to
link to. Verified with a `docker build --no-cache` end-to-end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-04 15:45:05 +07:00
Kirill d4a57c0b6a docs 2026-07-02 23:13:13 +07:00
Kirill f06cc48763 security: fix CSRF/ownership/timing vulns; add billing reconciliation
- auth/guard: добавить CSRF-проверку Origin/Referer для cookie-мутаций,
  исправить инвертированную логику admin_guard (пускал всех, блокировал админов),
  перевести admin_guard на from_fn_with_state
- auth/service: timing-safe сравнение HMAC через verify_slice вместо != по hex;
  криптостойкий Seed через Alphanumeric (был цифровой 0-9)
- billing: confirm_payment проверяет owner (caller_id == invoice.user_id);
  активация триала только для Telegram-аккаунтов (Sybil-защита);
  реализована reconcile_pending_payments — сверка blockchain->pending-инвойсы
- billing/providers: get_recent_transactions перенесён в трейт PaymentProvider
- nodes/service: unwrap() -> map_err по всему SSH-пути; убран TcpStream import
- docker: multi-stage build с cargo-chef, non-root user, healthcheck;
  prod-compose добавляет one-shot migrate-сервис, убирает проброс порта БД
- deploy.yml: параметр image_tag, set -e, pull всего стека вместо только app
- users/service: обработка NO_TICKETS / NO_USER из БД вместо catch-all

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-29 17:58:24 +07:00
nineap 26d6f2db8a deploy change, update token system, fix abuses and add admin verify 2026-05-26 12:50:25 +07:00
nineap 1ef93c2025 [AI] fix some modules, develop the big part of modules. TODO fix critical errors, update pipeline, test everything 2026-05-16 19:16:50 +07:00
nineap 4057d039b8 pipeline and codebase updates 2026-04-22 10:16:58 +07:00