This document provides detailed security measures tailored for applications using Node.js with Postgres or MySQL, including authentication, authorization, file uploads, Stripe integration, and more. It emphasizes the importance of rebuilding safety nets such as Postgres Row Level Security and implementing strict ownership checks to mitigate risks associated with direct database access. Additionally, it covers best practices for CORS, CSRF protection, error handling, and secrets management, ensuring a comprehensive approach to securing the stack.
- Removed several unused dependencies from frontend package.json including @tabler/icons-react, @tanstack/react-query, cobe, dotted-map, and jalaali-js.
- Deleted the hero-bg.original.mp4 video file as it was no longer needed.
- Removed live_dashboard.html and live_prices.js files, which were part of the old dashboard implementation.
- Eliminated the scraper.py script and related price fetching logic from the server, streamlining the backend.
- Removed the rtk.exe binary file as it was not required.
- Updated CSS to improve touch actions and text size adjustment for RTL layout.
- Modified ticker animation for RTL direction.
- Implemented service worker registration for production builds to enable offline capabilities.
- Enhanced Archive page to utilize search parameters and dynamically generate categories.
- Improved AtAGlance component with new modal design and updated content structure.
- Added keyword animation feature to the AuthPage for a more engaging login experience.
- Created a new SearchResults component to aggregate and display search results from various content sources.
- Introduced a minimal service worker to cache responses and support offline functionality.
- Replaced localStorage-based authentication checks with context-based checks using useAuth.
- Updated login handling in PostDetail to navigate to the login page instead of setting localStorage directly.
- Simplified ProfilePage to check for member presence instead of token.
- Removed token dependency from InfoTab, PasswordTab, and ContentTab components.
- Adjusted Radar and RadarPost components to utilize context for authentication state.
fix: redirect to archive instead of reports on missing report in ReportDetail
refactor: remove Reports page and its related components
chore: add proxy configuration for API and uploads in Vite
Security fixes:
- JWT_SECRET/ADMIN_PASSWORD fail-fast on missing/weak values
- Switch admin auth from localStorage to httpOnly cookie
- Rate limiting on login (10/15min) and contact form (3/10min)
- CORS whitelist via ALLOWED_ORIGINS env var
- Helmet with CSP, frameguard
- Escape HTML in contact email and admin panel innerHTML
- Remove SVG from upload whitelist
- err.message no longer leaked in API responses
- MAIL_TO moved to env var
- JWT expiry 7d → 24h
Navbar:
- Rename: رادار آینده → آیندهپژوهی و رصد هوشمند
- Rename: مرز فناوری → فناوری و نوآوری
- Rename: نبض صنعت → بازار و زنجیره فولاد
- Add: پایداری و فولاد سبز (/sustainability)
- Add: ژئوپلیتیک و اقتصاد جهانی (/geopolitics)
- Remove: رویدادها
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- panel/: standalone Express + SQLite + JWT admin (server.js, db.js, seed.js,
vanilla-JS admin UI under public/). CRUD for articles with cover image
uploads. README documents API, run instructions, and integration steps.
- src/data/reports.ts: appended bootstrapReports() that fetches from
VITE_PANEL_API (defaults to http://localhost:3001) and mutates the in-memory
reports array. Static array kept as fallback when panel is offline.
- src/main.tsx: awaits bootstrapReports() before initial render so all
existing consumers see panel data without per-file changes.
alireza