5 Commits

Author	SHA1	Message	Date
ryan	ae3b792e16	feat(core): sync framework security hardening and accessibility improvements ... - add util.Go with panic recovery for background goroutines - add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries - add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks - enforce session ID rotation upon login/oauth callback to prevent session fixation - add sliding window login failure rate limiting and oauth state rate limiting - fix redis client capture race in pubsub listeners and wait on stop channel - adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast - fix semantic heading levels and missing aria-labels across UI components - document security, concurrency, and a11y standards in AGENTS.md	2026-08-27 23:01:28 +08:00
ryan	e52592b16d	feat(log): 解耦用户访问日志存储，支持切换日志主库 ... 用户访问日志可在 ClickHouse、PostgreSQL、SQLite 之间切换。 关闭 ClickHouse 时由主库承接写入与查询；切换任务会冻结写入、复制数据后翻转主库。 启动时校验日志主库与运行配置一致，定期清理按各库保留天数删除过期记录。	2026-08-16 11:17:55 +08:00
ryan	9f15f42b47	fix(frontend): keep browser API on same-origin rewrites in dev ... Document that NEXT_PUBLIC_WAVELET_BACKEND_URL must stay unset for local next dev so axios hits /api/* and Next rewrites proxy to the backend.	2026-08-03 21:25:22 +08:00
ryan	e0eb4e5975	prettier	2026-07-13 15:17:45 +08:00
ryan	beae8d2dd9	refactor(frontend): colocate admin components and split service layer ... Move route-specific admin components from components/common/admin into app/(main)/admin/<feature>/components/. Split AdminService god object into domain services, fix UploadService to use BaseService, add AdminUploadService, consolidate DB export into DbManageService, and migrate consumers to the unified services entry.	2026-06-18 10:55:14 +08:00