einundzwanzig/einundzwanzig-verein
1
0
Fork 0
mirror of https://github.com/HolgerHatGarKeineNode/einundzwanzig-nostr.git synced 2026-06-04 02:05:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
352 Commits 2 Branches 0 Tags
5f28bfedd4d74c2eb54757c9bfab7f80339a8488
Commit Graph

19 Commits

Author SHA1 Message Date
HolgerHatGarKeineNode 5f28bfedd4 🚀 Enhance authorization and exception handling across Livewire components and SecurityMonitor 
- **SecurityMonitor:** Added logic to record and prevent logging of locked-property exceptions, while ensuring non-security exceptions are properly forwarded.
- **Livewire `Members/Admin`:** Centralized authorization logic in private methods, enforced access control on actions, and moved allowed pubkeys to class constant for maintainability.
- **Livewire `News`:** Enforced authorization for editing and deleting news with guard methods and ensured unauthorized users can't access data.
- **Bootstrap exceptions:** Implemented custom exception handling to record Livewire-related security issues while preventing redundant logs.
- Updated tests with new behavior verification covering access control and exception responses.
 2026-06-02 19:23:51 +02:00
HolgerHatGarKeineNode 3b855e9517 🚀 Refactor: Centralize isBoardMember logic in EinundzwanzigPleb model and replace redundant checks 2026-05-18 22:04:45 +02:00
vk 6aa05e47f3 News Design (vibe-kanban 220425f3) 
Nutze das aktuelle pencil Design und setze die News Seite 100% genauso um. Validiere deine Ergebnisse mit playwright. Überschreibe tailwindcss und Flux UI Styles wenn nötig.
 2026-02-13 16:02:03 +01:00
vk ff7b9a3493 Die News Ansicht verschönern (vibe-kanban 7c9cbf57) 
Nutze Livewire Flux UI um die Ansicht der News Items zu verschönern. Teste alles am besten auch eine Validierung mit playwright, ob alles passt und richtig in mobile und Desktop angezeigt wird.
 2026-02-12 23:20:23 +01:00
vk 0639c1a656 Fix all tests (vibe-kanban bba3e2c9) 
Fixe alle tests. Frage mich, wenn du nicht weißt, was zu tun ist.
 2026-02-11 23:15:49 +01:00
vk 90288ac20e [P0 Security] Mass Assignment Protection – $fillable für alle 18 Models (vibe-kanban 4a764a11) 
## Security Audit: Mass Assignment Protection

### Problem
Alle 18 Eloquent Models verwenden `protected $guarded = [];` – das bedeutet **kein Schutz** gegen Mass Assignment. Ein Angreifer könnte über manipulierte Requests sensible Felder wie `accepted`, `sats_paid`, `association_status`, `paid` oder `created_by` direkt setzen.

### Betroffene Dateien und empfohlene Änderungen

Ersetze in **jedem** der folgenden Models `protected $guarded = [];` durch ein explizites `protected $fillable = [...]` Array. Hier die Analyse pro Model:

**Höchstes Risiko (Finanzen & Identity):**

1. **`app/Models/PaymentEvent.php`** – Finanz-kritisch!
   - Sensible Felder (NICHT fillable): `einundzwanzig_pleb_id`, `year`, `amount`, `event_id`, `paid`, `btc_pay_invoice`
   - `$fillable` sollte leer oder minimal sein – alle Felder werden programmatisch gesetzt

2. **`app/Models/EinundzwanzigPleb.php`**
   - Sensible Felder: `association_status`, `application_for`, `nip05_handle`
   - `$fillable = ['npub', 'pubkey', 'email', 'no_email', 'application_text', 'archived_application_text']`

3. **`app/Models/Vote.php`**
   - Sensible Felder: `einundzwanzig_pleb_id`, `project_proposal_id`, `value`
   - `$fillable = ['reason']` – alle anderen Felder müssen programmatisch gesetzt werden

4. **`app/Models/ProjectProposal.php`**
   - Sensible Felder: `einundzwanzig_pleb_id`, `accepted`, `sats_paid`, `slug`
   - `$fillable = ['name', 'support_in_sats', 'description', 'website']`

5. **`app/Models/Election.php`**
   - Sensible Felder: `year`, `candidates`, `end_time`
   - `$fillable` sollte leer sein – nur Admin-gesteuert

**Mittleres Risiko (mit `created_by` auto-fill in boot):**

6. **`app/Models/Venue.php`** – `$fillable = ['name']` (slug & created_by auto-generiert)
7. **`app/Models/MeetupEvent.php`** – `$fillable = ['start']` (meetup_id, created_by, attendees guarded)
8. **`app/Models/CourseEvent.php`** – `$fillable = ['from', 'to']` (course_id, venue_id, created_by guarded)
9. **`app/Models/Course.php`** – `$fillable = ['name', 'description']` (lecturer_id, created_by guarded)
10. **`app/Models/Meetup.php`** – `$fillable = ['name']` (city_id, created_by, slug, github_data, simplified_geojson guarded)
11. **`app/Models/Lecturer.php`** – `$fillable = ['name']` (active, created_by, slug guarded)
12. **`app/Models/City.php`** – `$fillable = ['name']` (country_id, created_by, slug, osm_relation, simplified_geojson guarded)

**Niedrigeres Risiko (Lookup/Reference-Daten):**

13. **`app/Models/Event.php`** – `$fillable = []` (alle Felder: event_id, parent_event_id, pubkey, json, type sind extern gesteuert)
14. **`app/Models/RenderedEvent.php`** – `$fillable = []` (event_id, html, profile_image, profile_name alle system-generiert)
15. **`app/Models/Profile.php`** – `$fillable = ['name', 'display_name', 'picture', 'banner', 'website', 'about']` (pubkey, deleted, nip05, lud16, lud06 guarded)
16. **`app/Models/Category.php`** – `$fillable = ['name']`
17. **`app/Models/Country.php`** – `$fillable = ['name']` (code, language_codes guarded)
18. **`app/Models/Notification.php`** – `$fillable = ['name', 'description']` (einundzwanzig_pleb_id, category guarded)

### Vorgehen
1. Jedes Model öffnen und `$guarded = []` durch das oben definierte `$fillable` Array ersetzen
2. Prüfen, ob bestehende `::create()` oder `::update()` Aufrufe noch funktionieren – ggf. müssen explizite Feld-Zuweisungen ergänzt werden
3. Für jedes geänderte Model einen Pest-Test schreiben, der verifiziert, dass Mass Assignment von sensiblen Feldern blockiert wird
4. `vendor/bin/pint --dirty` ausführen
5. Bestehende Tests laufen lassen: `php artisan test --compact`

### Akzeptanzkriterien
- Kein Model hat mehr `$guarded = []`
- Alle sensiblen Felder (status, paid, accepted, created_by, slug, IDs) sind NICHT in `$fillable`
- Bestehende Features funktionieren weiterhin (Tests grün)
- Neue Tests verifizieren Mass Assignment Protection
 2026-02-11 21:13:36 +01:00
HolgerHatGarKeineNode 2957e89c79 🔒 Add #[Locked] attribute to Livewire components to enhance security against client-side state tampering 2026-02-03 22:49:42 +01:00
HolgerHatGarKeineNode 7bad86dcb9 🔗 Update news view to use media.signed route for temporary signed URLs 2026-01-25 19:52:09 +01:00
HolgerHatGarKeineNode 1391808793 🎨 Add dynamic category-based filtering for news and improve UI interactions 
- 🆕 Introduce `selectedCategory` state with URL binding for category filtering
- 🪄 Add computed `filteredNews` property to handle filtered results efficiently
- 🎛️ Implement category toggle buttons and "Clear Filter" functionality in UI
- 🌟 Improve category display with badges and contextual feedback for empty states
- 🔄 Refactor repeated news loading into a single `loadNews` method
 2026-01-25 19:25:22 +01:00
HolgerHatGarKeineNode 4a425da923 🎨 Update color palette: replace gray with zinc across Blade templates for improved design consistency and accessibility. 
🛠 Refactor forms: rename NostrAuth method for clarity and enhance Flux button usage for cleaner and reusable components.
✨ Add `WithNostrAuth` trait: refactor `show` template logic, streamline project-support handling, and improve layout readability.
 2026-01-20 14:58:02 +01:00
HolgerHatGarKeineNode 34f8d949d5 ✨ Add NIP-05 handle management: Introduce migration, API route, and Livewire updates to support NIP-05 handle verification. 
⚡ Enhance Nostr fetcher: Refactor profile data merging logic for improved efficiency and accuracy.
🛠
 2026-01-20 13:56:50 +01:00
HolgerHatGarKeineNode efb65b226e 🛠️ Refactor Blade templates: improve HTML structure, standardize indentation, replace custom div with Flux components, and enhance layout for consistency and readability. 2026-01-20 00:55:55 +01:00
HolgerHatGarKeineNode 39835c3a24 🗑️ Remove obsolete pulse migration file, clean up unused directives in Blade templates, and streamline delete confirmation logic with Flux modals for improved UX and maintainability. 2026-01-19 23:17:39 +01:00
HolgerHatGarKeineNode 6edcf014a6 🗑️ Remove unused and outdated Blade views, refactor access restriction messages with Flux callout components, and update related Livewire tests for improved maintainability and UX. 2026-01-18 23:10:37 +01:00
HolgerHatGarKeineNode 18f8dd99e3 🚀 Integrate Flux modals and toasts into Blade templates, refactor delete confirmation logic, and replace deprecated WireUI notifications for improved UX. 2026-01-18 20:47:12 +01:00
HolgerHatGarKeineNode b090336c4f 🛠️ Refactor migrations, models, configs, and Blade files to apply consistent formatting, remove unnecessary lines, and improve readability. 2026-01-18 19:50:04 +01:00
HolgerHatGarKeineNode 0694a2d837 ✨ Add Livewire Flux components and new tests for project proposal and editing forms 2026-01-18 15:19:00 +01:00
HolgerHatGarKeineNode 30e78711c9 ✨ Add reusable Blade components for inputs and layouts: FilePond, navigation groups, and notification buttons 2026-01-18 13:23:20 +01:00
HolgerHatGarKeineNode 22c8ad3588 🗑️ Remove unused Blade templates and components across navigation, layouts, and details, streamlining unused sections like admin, association, courses, events, and dark-mode toggle. 2026-01-18 01:45:02 +01:00