feat: add file_url column to factory_reports and update related queries
chore: upgrade nodemailer to version 9.0.1 and undici to version 7.28.0
feat: enhance factory report editor with file upload functionality for PDFs
fix: increase bcrypt hash rounds for improved password security
fix: restrict file uploads to video, audio, and PDF formats
chore: implement safe URL handling for banner CTA links
chore: seed radar_items with random dates, sources, and tags for consistency
add: new image asset for chart analysis
This document provides detailed security measures tailored for applications using Node.js with Postgres or MySQL, including authentication, authorization, file uploads, Stripe integration, and more. It emphasizes the importance of rebuilding safety nets such as Postgres Row Level Security and implementing strict ownership checks to mitigate risks associated with direct database access. Additionally, it covers best practices for CORS, CSRF protection, error handling, and secrets management, ensuring a comprehensive approach to securing the stack.
- Replaced localStorage-based authentication checks with context-based checks using useAuth.
- Updated login handling in PostDetail to navigate to the login page instead of setting localStorage directly.
- Simplified ProfilePage to check for member presence instead of token.
- Removed token dependency from InfoTab, PasswordTab, and ContentTab components.
- Adjusted Radar and RadarPost components to utilize context for authentication state.
fix: redirect to archive instead of reports on missing report in ReportDetail
refactor: remove Reports page and its related components
chore: add proxy configuration for API and uploads in Vite
Security fixes:
- JWT_SECRET/ADMIN_PASSWORD fail-fast on missing/weak values
- Switch admin auth from localStorage to httpOnly cookie
- Rate limiting on login (10/15min) and contact form (3/10min)
- CORS whitelist via ALLOWED_ORIGINS env var
- Helmet with CSP, frameguard
- Escape HTML in contact email and admin panel innerHTML
- Remove SVG from upload whitelist
- err.message no longer leaked in API responses
- MAIL_TO moved to env var
- JWT expiry 7d → 24h
Navbar:
- Rename: رادار آینده → آیندهپژوهی و رصد هوشمند
- Rename: مرز فناوری → فناوری و نوآوری
- Rename: نبض صنعت → بازار و زنجیره فولاد
- Add: پایداری و فولاد سبز (/sustainability)
- Add: ژئوپلیتیک و اقتصاد جهانی (/geopolitics)
- Remove: رویدادها
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- panel/: standalone Express + SQLite + JWT admin (server.js, db.js, seed.js,
vanilla-JS admin UI under public/). CRUD for articles with cover image
uploads. README documents API, run instructions, and integration steps.
- src/data/reports.ts: appended bootstrapReports() that fetches from
VITE_PANEL_API (defaults to http://localhost:3001) and mutates the in-memory
reports array. Static array kept as fallback when panel is offline.
- src/main.tsx: awaits bootstrapReports() before initial render so all
existing consumers see panel data without per-file changes.
alireza