novalon-website

653 Commits 4 Branches 1 Tag

3 Commits

Include renames

Author	SHA1	Message	Date
zhangxiang	a366bd1400	fix(qa): 第五轮系统性质量保障缺陷修复 + 单元/集成测试安全/鉴权：登出清服务端 httpOnly 令牌、登录 IP 限流前置 bcrypt、停用账号令牌在 6 个内联 role handler 失效、admin/items 存在性 oracle 认证前置、同意偏好 sanitize fail-closed、api-crypto 按 HTTP 方法判体。 CMS：workflow 状态更新+审计收进交互式 $transaction（失败即回滚）、编辑器 richtext 走 textarea 防换行损毁、array/object 子字段按作用域读写防污染、 about/contact/erp-upgrade 补 ISR revalidate 与路由映射。 UI/a11y：AnimatedCounter 入视口前显起点、CLS 累计上报、MetricCard 动画入 effect 并卸载取消 rAF、后台状态四态映射/搜索防抖+序号守卫/媒体单 input/ 吞错改横幅/表单 label-aria 关联。新增对应判别性单测与 pagination/rate-limit/client-ip/sanitize/validate-content-data 等模块及 tests-integration 真库集成层。	2026-09-28 10:48:07 +08:00
zhangxiang	d5d04aa96d	feat: implement frontend-backend encrypted communication via AES-256-GCM 参考 novavis-authority 的加解密方案，实现前后端通信的应用层加密： - 重写 src/lib/crypto.ts 使用 Web Crypto API（浏览器兼容），PBKDF2+AES-256-GCM - 新增 src/lib/crypto-server.ts 服务端加解密工具（Node.js crypto） - 新增 src/lib/api-crypto.ts API 路由中间件 withCrypto()，自动解密请求体/加密响应体 - 更新 src/lib/admin-api.ts 自动加密所有请求/解密响应 - 所有 11 个 admin API 路由文件已应用 withCrypto 包装器 - 更新 .env 文件，添加 NEXT_PUBLIC_ENCRYPTION_SECRET 和 ENCRYPTION_SECRET	2026-08-02 09:11:36 +08:00
zhangxiang	c480772aec	feat(admin): enhance admin dashboard, user management, and content editor UX - Dashboard: add stats API with content status distribution, recent notifications, and recent content updates; display active users, pending reviews, unread counts - User management: full CRUD with role assignment, search, pagination, delete dialog - Notification center: list with unread filter, mark as read, mark all as read, pagination, and auto-refresh unread count - Content editor: form validation (required fields, slug format, blur-triggered errors), auto-save with 3s debounce and status indicator, publish confirmation dialog, unsaved changes warning on leave - Admin layout: add navigation links for user management, roles, and notifications - admin-api: make request() method public for custom API calls - gitignore: add reports/mutation/ to exclude mutation test output	2026-07-31 23:05:24 +08:00

Author

SHA1

Message

Date

zhangxiang

a366bd1400

fix(qa): 第五轮系统性质量保障缺陷修复 + 单元/集成测试

安全/鉴权：登出清服务端 httpOnly 令牌、登录 IP 限流前置 bcrypt、停用账号
令牌在 6 个内联 role handler 失效、admin/items 存在性 oracle 认证前置、
同意偏好 sanitize fail-closed、api-crypto 按 HTTP 方法判体。

CMS：workflow 状态更新+审计收进交互式 $transaction（失败即回滚）、编辑器
richtext 走 textarea 防换行损毁、array/object 子字段按作用域读写防污染、
about/contact/erp-upgrade 补 ISR revalidate 与路由映射。

UI/a11y：AnimatedCounter 入视口前显起点、CLS 累计上报、MetricCard 动画入
effect 并卸载取消 rAF、后台状态四态映射/搜索防抖+序号守卫/媒体单 input/
吞错改横幅/表单 label-aria 关联。

新增对应判别性单测与 pagination/rate-limit/client-ip/sanitize/validate-content-data
等模块及 tests-integration 真库集成层。

2026-09-28 10:48:07 +08:00

zhangxiang

d5d04aa96d

feat: implement frontend-backend encrypted communication via AES-256-GCM

参考 novavis-authority 的加解密方案，实现前后端通信的应用层加密：
- 重写 src/lib/crypto.ts 使用 Web Crypto API（浏览器兼容），PBKDF2+AES-256-GCM
- 新增 src/lib/crypto-server.ts 服务端加解密工具（Node.js crypto）
- 新增 src/lib/api-crypto.ts API 路由中间件 withCrypto()，自动解密请求体/加密响应体
- 更新 src/lib/admin-api.ts 自动加密所有请求/解密响应
- 所有 11 个 admin API 路由文件已应用 withCrypto 包装器
- 更新 .env 文件，添加 NEXT_PUBLIC_ENCRYPTION_SECRET 和 ENCRYPTION_SECRET

2026-08-02 09:11:36 +08:00

zhangxiang

c480772aec

feat(admin): enhance admin dashboard, user management, and content editor UX

- Dashboard: add stats API with content status distribution, recent notifications,
  and recent content updates; display active users, pending reviews, unread counts
- User management: full CRUD with role assignment, search, pagination, delete dialog
- Notification center: list with unread filter, mark as read, mark all as read,
  pagination, and auto-refresh unread count
- Content editor: form validation (required fields, slug format, blur-triggered
  errors), auto-save with 3s debounce and status indicator, publish confirmation
  dialog, unsaved changes warning on leave
- Admin layout: add navigation links for user management, roles, and notifications
- admin-api: make request() method public for custom API calls
- gitignore: add reports/mutation/ to exclude mutation test output

2026-07-31 23:05:24 +08:00