041df48ac3
Auth hardening: - payments: per-customer JWT authorization on dual-use /payments routes (balance/methods/invoice/checkout/setup/portal/toggle-ppa) via authorizeCustomer + PAYMENTS_AUTH=enforce; portal retains+sends magic-link JWT (sessionStorage) - hub: fail-closed Stripe webhook, /accept/doc-pdf IDOR gate, telephony field-name guard (SQLi), modem-bridge private-IP guard (SSRF), ALWAYS_ENFORCE expansion Leaked-credential cleanup (token already rotated in ERPNext): - de-hardcode ERPNext API token -> env in bulk_submit.py, import_items.py, apps/client/deploy.sh; placeholder in apps/ops/infra/nginx.conf (nginx injects) - ops prod build no longer bakes VITE_ERP_TOKEN (.env.production empty) - de-hardcode legacy DB password -> env in import_items.py - gitignore legacy migration PII exports (tsv/json) Conversations/UI: - floating (un-docked) conversation panel; full-width mailbox - per-message real sender from email headers; unified scroll; header spacing - campaign pre-send review (subject/from/channel), Gmail send channel, clone-as-draft Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
62 lines
1.2 KiB
Plaintext
62 lines
1.2 KiB
Plaintext
# Environment files (may contain secrets)
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
apps/**/.env
|
|
apps/**/.env.local
|
|
|
|
# Legacy migration exports — customer PII, never commit (purged from history 2026-06-16)
|
|
scripts/migration/genieacs-export/*.tsv
|
|
scripts/migration/genieacs-export/devices-*.json
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Build output
|
|
dist/
|
|
build/
|
|
docker/
|
|
|
|
# Quasar dev cache
|
|
apps/**/.quasar/
|
|
|
|
# Claude workspace (local only)
|
|
.claude/
|
|
|
|
# Data exports (may contain PII)
|
|
exports/
|
|
|
|
# OS
|
|
.DS_Store
|
|
**/.DS_Store
|
|
Thumbs.db
|
|
|
|
# Generated invoice/quote previews (output of setup_invoice_print_format.py
|
|
# + test_jinja_render.py). Keep sources (*.jinja) and final references
|
|
# (docs/assets/*.pdf when added intentionally), never ephemeral output.
|
|
invoice_preview*.pdf
|
|
scripts/migration/invoice_preview*.pdf
|
|
scripts/migration/invoice_preview*.html
|
|
scripts/migration/rendered_jinja_invoice*
|
|
scripts/migration/SINV-*.pdf
|
|
scripts/migration/ref_invoice.pdf
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
|
|
# Playwright snapshots
|
|
.playwright-mcp/
|
|
|
|
# Auto-generated backups from scripts/convert-html-to-unlayer.js
|
|
services/targo-hub/templates/*.bak-*.json
|
|
services/targo-hub/templates/*.bak-*.html
|
|
|
|
# Legacy refresh creds (prod-only, never commit)
|
|
.refresh.env
|
|
**/.refresh.env
|
|
|
|
# Python bytecode
|
|
__pycache__/
|
|
*.pyc
|