louis/gigafibre-fsm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1b7bad1686
gigafibre-fsm/services/targo-hub/lib
History
louispaulb 1b7bad1686 security: harden payments/hub auth + remove leaked ERPNext token from source 
Auth hardening:
- payments: per-customer JWT authorization on dual-use /payments routes
  (balance/methods/invoice/checkout/setup/portal/toggle-ppa) via authorizeCustomer
  + PAYMENTS_AUTH=enforce; portal retains+sends magic-link JWT (sessionStorage)
- hub: fail-closed Stripe webhook, /accept/doc-pdf IDOR gate, telephony field-name
  guard (SQLi), modem-bridge private-IP guard (SSRF), ALWAYS_ENFORCE expansion

Leaked-credential cleanup (token already rotated in ERPNext):
- de-hardcode ERPNext API token -> env in bulk_submit.py, import_items.py,
  apps/client/deploy.sh; placeholder in apps/ops/infra/nginx.conf (nginx injects)
- ops prod build no longer bakes VITE_ERP_TOKEN (.env.production empty)
- de-hardcode legacy DB password -> env in import_items.py
- gitignore legacy migration PII exports (tsv/json)

Conversations/UI:
- floating (un-docked) conversation panel; full-width mailbox
- per-message real sender from email headers; unified scroll; header spacing
- campaign pre-send review (subject/from/channel), Gmail send channel, clone-as-draft

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-16 06:17:17 -04:00
..
ui refactor(targo-hub): extract ui/ kit, migrate tech-mobile to it 2026-04-22 22:47:19 -04:00
util Phase 1 (hygiène) : utils partagés + logique pure testable + observabilité erp + 1ers tests 2026-06-07 10:36:41 -04:00
acceptance.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
address-conformity.js Conformité : repli « centre du code postal / ville » pour les unmatched restants (statut 'area') 2026-06-07 17:14:41 -04:00
address-db.js Phase 1 (hygiène) : utils partagés + logique pure testable + observabilité erp + 1ers tests 2026-06-07 10:36:41 -04:00
address-search.js Recherche d'adresses : base LOCALE (Postgres ERPNext) au lieu du Supabase cloud externe 2026-06-06 15:46:47 -04:00
address-validate.js Optimisation (consolidation helpers address) + doc Vision/modularisation 2026-06-07 01:28:54 -04:00
agent-flows.json refactor: major cleanup — remove dead dispatch app, commit all backend code, extract client composables 2026-04-08 17:38:38 -04:00
agent-tools.json refactor: reduce token count, DRY code, consolidate docs 2026-04-13 08:39:58 -04:00
agent.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
ai.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
auth.js feat(hub+ops): user invite flow sends temp password via Mailjet + dev .env.example 2026-05-05 19:50:06 -04:00
campaigns.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
categories.js feat(inbox+historique): sender-identity fix, single-source taxonomy, dispatch history & leaderboards 2026-06-15 06:11:47 -04:00
checkout.js feat: contract → chain → subscription → prorated invoice lifecycle + tech group claim 2026-04-22 20:40:54 -04:00
client-diag.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
cloud-ips.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
config.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
contracts.js Wizard: 2 cases génériques Prix marketing / Prix original (barré) sur toutes les lignes + aperçu client WYSIWYG 2026-06-03 18:31:54 -04:00
conversation.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
coupon-triage.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
device-extractors.js feat: flow editor, Gemini QR scanner with offline queue, dispatch planning v2 2026-04-22 10:44:17 -04:00
device-hosts.js refactor: major cleanup — remove dead dispatch app, commit all backend code, extract client composables 2026-04-08 17:38:38 -04:00
devices.js feat: contract → chain → subscription → prorated invoice lifecycle + tech group claim 2026-04-22 20:40:54 -04:00
dispatch.js feat(inbox+historique): sender-identity fix, single-source taxonomy, dispatch history & leaderboards 2026-06-15 06:11:47 -04:00
email-queue.js feat(ops): Email Queue admin page (view/delete/purge ERPNext outbound) 2026-06-02 17:29:33 -04:00
email-templates.js refactor: extract composables from 5 largest files — net -1950 lines from main components 2026-04-08 17:57:24 -04:00
email.js feat(campaigns/send): real SMTP error + auto-retry + one-click Renvoyer 2026-05-22 13:29:25 -04:00
erp.js Phase 1 (hygiène) : utils partagés + logique pure testable + observabilité erp + 1ers tests 2026-06-07 10:36:41 -04:00
flow-api.js feat: flow editor, Gemini QR scanner with offline queue, dispatch planning v2 2026-04-22 10:44:17 -04:00
flow-runtime.js docs: reorganize into architecture/features/reference/archive folders 2026-04-22 11:51:33 -04:00
flow-templates.js feat: flow editor, Gemini QR scanner with offline queue, dispatch planning v2 2026-04-22 10:44:17 -04:00
giftbit.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
gmail.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
helpers.js fix(inbox): never resolve our own domains to a customer (wrong sender names) 2026-06-15 06:51:04 -04:00
ical.js refactor(targo-hub): add erp.js wrapper + migrate 7 lib files to it 2026-04-22 23:01:27 -04:00
inbox-triage.js fix(inbox): never resolve our own domains to a customer (wrong sender names) 2026-06-15 06:51:04 -04:00
legacy-dispatch-sync.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
legacy-payments.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
legacy-reports.js fix(legacy-report): treat accounts with a company name as commercial 2026-06-02 06:33:25 -04:00
legacy-sync.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
magic-link.js refactor(targo-hub): add erp.js wrapper + migrate 7 lib files to it 2026-04-22 23:01:27 -04:00
modem-bridge.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
municipality.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
network-intel.js refactor: reduce token count, DRY code, consolidate docs 2026-04-13 08:39:58 -04:00
oktopus-mqtt.js refactor: reduce token count, DRY code, consolidate docs 2026-04-13 08:39:58 -04:00
oktopus.js feat: flow editor, Gemini QR scanner with offline queue, dispatch planning v2 2026-04-22 10:44:17 -04:00
olt-snmp.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
otp.js refactor(targo-hub): add erp.js wrapper + migrate 7 lib files to it 2026-04-22 23:01:27 -04:00
outage-monitor.js refactor: reduce token count, DRY code, consolidate docs 2026-04-13 08:39:58 -04:00
outbox.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
payments.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
pbx.js refactor: major cleanup — remove dead dispatch app, commit all backend code, extract client composables 2026-04-08 17:38:38 -04:00
poller-control.js feat: contract → chain → subscription → prorated invoice lifecycle + tech group claim 2026-04-22 20:40:54 -04:00
portal-auth.js feat(portal): passwordless magic-link login — retire ERPNext /login 2026-04-22 13:25:28 -04:00
project-templates.js fix(contracts): create pending Service Subscription on signing + test templates 2026-04-23 10:03:49 -04:00
provision.js chore(hub): gate Oktopus integration behind OKTOPUS_DISABLED flag 2026-05-04 10:34:36 -04:00
referral.js refactor(targo-hub): add erp.js wrapper + migrate 7 lib files to it 2026-04-22 23:01:27 -04:00
reports.js refactor: reduce token count, DRY code, consolidate docs 2026-04-13 08:39:58 -04:00
roster-assistant.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
roster.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
serviceability.js feat(ops): per-address competitor column via Québec IHV open data 2026-06-01 22:40:47 -04:00
signup.js Install: prix barré 360$ → 240$ (ancre de valeur) + 'financement crédité chaque mois 24 mois' dans contrat + portail signup 2026-06-03 18:22:22 -04:00
sse.js refactor: major cleanup — remove dead dispatch app, commit all backend code, extract client composables 2026-04-08 17:38:38 -04:00
store.js Store: prix barré par produit via champ Item.store_regular_price 2026-06-03 21:55:57 -04:00
supplier-invoices.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
sync-orchestrator.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
tech-absence-sms.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
tech-mobile.js refactor(targo-hub): add types.js, migrate acceptance+payments, drop apps/field 2026-04-22 23:18:25 -04:00
telephony.js security: harden payments/hub auth + remove leaked ERPNext token from source 2026-06-16 06:17:17 -04:00
ticket-collab.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
traccar.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
twilio.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
types.js refactor(targo-hub): add types.js, migrate acceptance+payments, drop apps/field 2026-04-22 23:18:25 -04:00
vision.js feat(fsm): platform build — comms UI, F→ERPNext sync/billing, roster, campaigns, network, reports 2026-06-15 06:12:12 -04:00
voice-agent.js refactor: major cleanup — remove dead dispatch app, commit all backend code, extract client composables 2026-04-08 17:38:38 -04:00