louis/gigafibre-fsm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
041df48ac3
gigafibre-fsm/services/targo-hub/templates
History
louispaulb 041df48ac3 security: harden payments/hub auth + remove leaked ERPNext token from source 
Auth hardening:
- payments: per-customer JWT authorization on dual-use /payments routes
  (balance/methods/invoice/checkout/setup/portal/toggle-ppa) via authorizeCustomer
  + PAYMENTS_AUTH=enforce; portal retains+sends magic-link JWT (sessionStorage)
- hub: fail-closed Stripe webhook, /accept/doc-pdf IDOR gate, telephony field-name
  guard (SQLi), modem-bridge private-IP guard (SSRF), ALWAYS_ENFORCE expansion

Leaked-credential cleanup (token already rotated in ERPNext):
- de-hardcode ERPNext API token -> env in bulk_submit.py, import_items.py,
  apps/client/deploy.sh; placeholder in apps/ops/infra/nginx.conf (nginx injects)
- ops prod build no longer bakes VITE_ERP_TOKEN (.env.production empty)
- de-hardcode legacy DB password -> env in import_items.py
- gitignore legacy migration PII exports (tsv/json)

Conversations/UI:
- floating (un-docked) conversation panel; full-width mailbox
- per-message real sender from email headers; unified scroll; header spacing
- campaign pre-send review (subject/from/channel), Gmail send channel, clone-as-draft

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-16 06:17:17 -04:00
..
contract-residential.html feat: flow editor, Gemini QR scanner with offline queue, dispatch planning v2 2026-04-22 10:44:17 -04:00
gift-email-en.html style(campaigns/templates): replace em-dashes with periods/commas 2026-06-01 12:26:59 -04:00
gift-email-en.json style(campaigns/templates): replace em-dashes with periods/commas 2026-06-01 12:26:59 -04:00
gift-email-fr-native.html fix(campaigns/templates): center logos via nested-table pattern 2026-06-01 18:45:30 -04:00
gift-email-fr-native.json fix(campaigns/templates): center logos via nested-table pattern 2026-06-01 18:45:30 -04:00
gift-email-fr.html feat(campaigns/templates): visible wrapper-expiry date in the email 2026-05-22 10:47:58 -04:00
gift-email-fr.json feat(campaigns/templates): visible wrapper-expiry date in the email 2026-05-22 10:47:58 -04:00
gift-email-fr.legacy-rich.html.bak feat(campaigns): MJML canonical templates + test-send button 2026-05-21 22:36:35 -04:00
gift-email-native-reminder-fr.html fix(campaigns/templates): center logos via nested-table pattern 2026-06-01 18:45:30 -04:00
gift-email-native-reminder-fr.json feat(campaigns/templates): native-block reminder template (proof of concept) 2026-06-01 15:31:15 -04:00
gift-email-reminder-en.html style(campaigns/reminder): add "pour te remercier" / "as a thank-you" 2026-06-01 15:09:41 -04:00
gift-email-reminder-en.json style(campaigns/reminder): add "pour te remercier" / "as a thank-you" 2026-06-01 15:09:41 -04:00
gift-email-reminder-fr.html style(campaigns/reminder): add "pour te remercier" / "as a thank-you" 2026-06-01 15:09:41 -04:00
gift-email-reminder-fr.json style(campaigns/reminder): add "pour te remercier" / "as a thank-you" 2026-06-01 15:09:41 -04:00
transactional-excuse-en.html security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
transactional-excuse-en.json security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
transactional-excuse-fr.html security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
transactional-excuse-fr.json security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00