7 Commits

Author	SHA1	Message	Date
ryan	05606dfb56	feat(frontend): add a dedicated 403 forbidden page ... Show /403 instead of toasting or staying on the denied screen when the API returns 403 or a non-admin opens an admin route.	2026-09-02 18:39:11 +08:00
ryan	ae3b792e16	feat(core): sync framework security hardening and accessibility improvements ... - add util.Go with panic recovery for background goroutines - add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries - add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks - enforce session ID rotation upon login/oauth callback to prevent session fixation - add sliding window login failure rate limiting and oauth state rate limiting - fix redis client capture race in pubsub listeners and wait on stop channel - adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast - fix semantic heading levels and missing aria-labels across UI components - document security, concurrency, and a11y standards in AGENTS.md	2026-08-27 23:01:28 +08:00
ryan	30acdb91e8	feat(message-gateway): add profile bot pairing card	2026-08-16 12:23:44 +08:00
ryan	124ce9bebb	feat(message-gateway): add admin channel cards and per-type forms	2026-08-16 12:22:28 +08:00
ryan	6a53619dd2	feat(framework): 回灌 OpenFlare 分层、安全与运行时改进 ... 将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。 邮件头写入前清除 CR/LF，防止 header 注入。 httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。 设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。 升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。	2026-08-16 11:07:20 +08:00
ryan	9f15f42b47	fix(frontend): keep browser API on same-origin rewrites in dev ... Document that NEXT_PUBLIC_WAVELET_BACKEND_URL must stay unset for local next dev so axios hits /api/* and Next rewrites proxy to the backend.	2026-08-03 21:25:22 +08:00
ryan	1625cfb2fb	feat(frontend): add next-intl bilingual i18n for core paths ... Wire next-intl without locale routes, add zh-CN/en catalogs, language switcher, and migrate layout/auth/settings UI copy. Document i18n rules in AGENTS.md and keep static export builds working.	2026-07-24 16:25:41 +08:00