d04901d296
security: fix 9 vulnerabilities + OrdersTable 14px font + colored status badges
...
Security fixes:
- Remove VITE_SUPABASE_SERVICE_ROLE_KEY from Docker build args
- Add missing security.ts functions (verifyInternalRequest, requireSameOrigin, etc)
- Store only OTP hash, remove plaintext otp_code
- Fix CORS origin check: startsWith → exact match
- Use atomic SQL check_rate_limit RPC instead of JS rate limiter
- Mask PII in get_delivery_invitation_by_token single-order path
- Add RequireAuth wrapper for protected routes
- Revoke anon execute on confirm_delivery_choice_by_token
- Add HSTS header to Caddyfile
UI:
- OrdersTable desktop: all cells text-sm (14px)
- Status column: use colored Badge with tone from getOrderGroupStatusTone
- Header row: text-sm (14px)
2026-06-19 12:14:19 +00:00
28ccb655d3
fix: mobile card — no phone, show ordersTotal badge, cache-control headers
...
Mobile: removed phone + buildGroupSummary, kept name + type badge + status +
order numbers + count badge (N сч.)
Caddyfile: Cache-Control immutable for assets, no-cache for HTML+SW
SW v7→v8
2026-06-18 17:56:37 +00:00
dc9d7de60f
feat: push notifications + PWA notifications UI
...
- VAPID keys generated for web push
- push_subscriptions, notifications, notification_preferences tables
- DB triggers: auto-notify on order status change, driver assignment
- Edge functions: send-push-notification, subscribe-push, unsubscribe-push
- Frontend: NotificationBell, NotificationSettings components
- usePushNotifications hook (subscribe/unsubscribe push)
- useNotifications hook (fetch + realtime + mark read)
- Service worker: push event handler + notification click
- AppShell: notification bell in header
- DashboardPage: wired notifications
- manifest.webmanifest: name updated to SuperSam
- Caddyfile: CSP allows wss:// + fcm push
2026-05-22 10:48:33 +00:00
cfb4110d82
fix: Caddyfile static assets + update package-lock
2026-05-20 14:01:40 +00:00
b9c6bb2810
fix: RLS recursion, driver UI, auth errors, status counts
...
- Fix infinite RLS recursion in users policies via current_role_name()
- Add is_admin() helper and simplify users select policies
- Fix order_groups insert for service_role (n8n integration)
- Fix status option counts in dropdown (LogisticsReadinessBoard)
- Add driver delivery status buttons (loaded, on_route, delivered, problem, cancelled)
- Replace driver date range filters with single date picker + date pills
- Hide SMS/internal data from driver view in OrderDetailPanel
- Fix Edge Function error messages in OTP flow (read error.context body)
- Add update_delivery_status RPC for driver workflow
- Remove customer column from order_groups fetch (DB schema mismatch)
- UI: swap filter/search positions, limit modal width, status label cleanup
2026-05-20 16:25:05 +03:00
d44d944517
Add deployment config files and supabaseClient lock fix
2026-05-03 16:44:58 +00:00
root
root
Codex
root