Security fixes:
- JWT_SECRET/ADMIN_PASSWORD fail-fast on missing/weak values
- Switch admin auth from localStorage to httpOnly cookie
- Rate limiting on login (10/15min) and contact form (3/10min)
- CORS whitelist via ALLOWED_ORIGINS env var
- Helmet with CSP, frameguard
- Escape HTML in contact email and admin panel innerHTML
- Remove SVG from upload whitelist
- err.message no longer leaked in API responses
- MAIL_TO moved to env var
- JWT expiry 7d → 24h
Navbar:
- Rename: رادار آینده → آیندهپژوهی و رصد هوشمند
- Rename: مرز فناوری → فناوری و نوآوری
- Rename: نبض صنعت → بازار و زنجیره فولاد
- Add: پایداری و فولاد سبز (/sustainability)
- Add: ژئوپلیتیک و اقتصاد جهانی (/geopolitics)
- Remove: رویدادها
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Previous rename dropped the file: public/hero-bg.mp4 was listed in
.gitignore, so the move deleted it from git without re-adding.
Remove the ignore rule and commit the video as LFS so the hero
background plays.
- Move hero-bg.mp4 to public/ so Vite serves it at /hero-bg.mp4
(was at repo root => 404 in built site, video never loaded)
- Download 20 Unsplash images to public/news/ (LFS) and rewrite all
34 refs to same-origin paths (images.unsplash.com blocked in Iran)
- Replace 2 globally-dead photo IDs with fitting industrial/tech images
- Shift design tokens from warm beige/brown to cool off-white + slate inks
with vivid corporate red/amber/green accents
- Rename brand from "اندیشکده فولاد ایران" / "Iran Steel Policy Institute"
to "اندیشکده فولاد آینده" / "Future Steel Policy Institute"
- Replace JS-clone seamless-loop in RiskSection with JSX-doubled items,
immune to StrictMode double-invocation that was leaving the ticker blank
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- panel/: standalone Express + SQLite + JWT admin (server.js, db.js, seed.js,
vanilla-JS admin UI under public/). CRUD for articles with cover image
uploads. README documents API, run instructions, and integration steps.
- src/data/reports.ts: appended bootstrapReports() that fetches from
VITE_PANEL_API (defaults to http://localhost:3001) and mutates the in-memory
reports array. Static array kept as fallback when panel is offline.
- src/main.tsx: awaits bootstrapReports() before initial render so all
existing consumers see panel data without per-file changes.
- Header: replaced 3-bar masthead with slim dark meta strip + 68px main bar
(brand · centered nav · search/CTA actions). ~60% shorter than before.
- Home: added numbered SectionLabel chapter markers (01–07) between
sections with red accent bar; alternated paper/paper-2 backgrounds
for clearer section separation.
- Typography: wrapped base h1–h4 and p element styles in @layer base so
Tailwind utilities (text-white, etc.) can override defaults. Previously
unlayered p { color: var(--ink-3) } was overriding all carousel white
titles, making them appear grey-brown.
- Carousel: removed pagination arrows; strengthened title gradient,
added top centered red category badge, text-shadow + generous padding
so titles never crash into card edges. Modal hero received same
treatment with overflow-safe inset positioning.
- PlansSection: rewrote with compact shadcn-pricing pattern; price
reduced from 42px to 26px; featured plan elevated with translateY
and shadow; star badge for "Popular" plan.
- TeamSection: redesigned member cards more compact (avatar 60→44px,
reports count moved to top-end, line-clamp on bio).
- Removed inline padding overrides across all sections so Tailwind
max-md:px-5 mobile responsiveness actually works.
alireza
Mohammad Jebeli
asd asd