- Implemented `caveman-compress` skill to detect and compress natural language files.
- Created `caveman-review` skill for generating concise code review comments.
- Added `caveman-help` skill providing a quick-reference card for commands and modes.
- Developed `caveman-stats` skill to report real token usage and savings from the session log.
- Updated README and SKILL.md files for all new skills with usage instructions and examples.
- Introduced a script to clear banners from the database.
- Updated skills-lock.json to include new skills and their metadata.
feat: add file_url column to factory_reports and update related queries
chore: upgrade nodemailer to version 9.0.1 and undici to version 7.28.0
feat: enhance factory report editor with file upload functionality for PDFs
fix: increase bcrypt hash rounds for improved password security
fix: restrict file uploads to video, audio, and PDF formats
chore: implement safe URL handling for banner CTA links
chore: seed radar_items with random dates, sources, and tags for consistency
add: new image asset for chart analysis
This document provides detailed security measures tailored for applications using Node.js with Postgres or MySQL, including authentication, authorization, file uploads, Stripe integration, and more. It emphasizes the importance of rebuilding safety nets such as Postgres Row Level Security and implementing strict ownership checks to mitigate risks associated with direct database access. Additionally, it covers best practices for CORS, CSRF protection, error handling, and secrets management, ensuring a comprehensive approach to securing the stack.
- Removed several unused dependencies from frontend package.json including @tabler/icons-react, @tanstack/react-query, cobe, dotted-map, and jalaali-js.
- Deleted the hero-bg.original.mp4 video file as it was no longer needed.
- Removed live_dashboard.html and live_prices.js files, which were part of the old dashboard implementation.
- Eliminated the scraper.py script and related price fetching logic from the server, streamlining the backend.
- Removed the rtk.exe binary file as it was not required.
- Updated CSS to improve touch actions and text size adjustment for RTL layout.
- Modified ticker animation for RTL direction.
- Implemented service worker registration for production builds to enable offline capabilities.
- Enhanced Archive page to utilize search parameters and dynamically generate categories.
- Improved AtAGlance component with new modal design and updated content structure.
- Added keyword animation feature to the AuthPage for a more engaging login experience.
- Created a new SearchResults component to aggregate and display search results from various content sources.
- Introduced a minimal service worker to cache responses and support offline functionality.
- Replaced localStorage-based authentication checks with context-based checks using useAuth.
- Updated login handling in PostDetail to navigate to the login page instead of setting localStorage directly.
- Simplified ProfilePage to check for member presence instead of token.
- Removed token dependency from InfoTab, PasswordTab, and ContentTab components.
- Adjusted Radar and RadarPost components to utilize context for authentication state.
fix: redirect to archive instead of reports on missing report in ReportDetail
refactor: remove Reports page and its related components
chore: add proxy configuration for API and uploads in Vite
Event calendar next to globe: neon-yellow breathing date markers
- Native Jalali calendar (Intl Persian calendar, no deps) replacing the events
list; conference days marked with neon-yellow breathing glow + hover detail card
- Remove events-column background
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@
Footer: curved top edge with scroll-to-top button
- SVG curved top notch matching the Figma (page color shows through the dip)
- Centered scroll-to-top button (ChevronsUp) with smooth scroll, gold hover
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@
three-globe globe (hex polygons + arcs), navbar chevron cleanup
- Globe: real three-globe World via r3f <primitive> (no JSX augmentation),
hex-polygon countries + animated steel-trade arcs, bundled Natural Earth data
- Header: type nav Section.Icon as LucideIcon (fixes r3f JSX type clash);
remove chevron from non-dropdown items (only radar/media dropdowns keep it)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@
Podcast polish: taller videocast, redesigned player + episode list
- Videocast featured height 200 -> 440px, rounded
- Podcast: full-width navy player card (cover, progress, controls) + clean
episode list with active highlight; RTL-correct prev/next + play direction
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@
Home polish: brand copy, footer, section reorg, smaller reports, split casts
- Tab title -> "اندیشکده فولاد آینده"; header/footer subtitle -> The Steel Futures Institute
- Footer: brand description, social links (LinkedIn/Twitter/Aparat/Telegram), drop nav links
- Remove de-zoom HeroSection; SpreadFeatures is now the hero
- Comment out InternalNewsSection + RiskSection (restorable)
- Move IntegrationsSection under RadarTechSection
- FactoryReportsScroll: compact 4-up row instead of large masonry
- Split Videocast and Podcast into separate full-width sections (only prop)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@
Security fixes:
- JWT_SECRET/ADMIN_PASSWORD fail-fast on missing/weak values
- Switch admin auth from localStorage to httpOnly cookie
- Rate limiting on login (10/15min) and contact form (3/10min)
- CORS whitelist via ALLOWED_ORIGINS env var
- Helmet with CSP, frameguard
- Escape HTML in contact email and admin panel innerHTML
- Remove SVG from upload whitelist
- err.message no longer leaked in API responses
- MAIL_TO moved to env var
- JWT expiry 7d → 24h
Navbar:
- Rename: رادار آینده → آیندهپژوهی و رصد هوشمند
- Rename: مرز فناوری → فناوری و نوآوری
- Rename: نبض صنعت → بازار و زنجیره فولاد
- Add: پایداری و فولاد سبز (/sustainability)
- Add: ژئوپلیتیک و اقتصاد جهانی (/geopolitics)
- Remove: رویدادها
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
alireza