ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
48 commits 7 branches 0 tags 981 KiB
Commit graph

48 commits

This branch
This branch
All branches
Author SHA1 Message Date
ochenstarik-ui
6382cb8e04
Merge pull request #4 from ochenstarik-ui/claude/codex-task-vps-ip
Some checks failed
CI / build-and-test (push) Waiting to run
Details
CI / build-and-test (pull_request) Failing after 1s
Details 
docs(agents): correct VPS address in R5
 2026-10-19 12:02:03 +07:00
ochenstarik-ui
1a532465b0 docs(agents): VPS is 178.212.13.102 (shared with Forgejo) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 12:01:50 +07:00
ochenstarik-ui
fa660cd844
Merge pull request #3 from ochenstarik-ui/claude/codex-task-r5-vps 
docs(agents): R5 via VPS and WireGuard
 2026-10-19 12:01:29 +07:00
ochenstarik-ui
5598d2f38e docs(agents): route domain access through the owner's VPS over WireGuard 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 12:01:16 +07:00
ochenstarik-ui
36d98230bf
Merge pull request #2 from ochenstarik-ui/claude/codex-task-2026-10-19 
docs(agents): Codex stage-1 completion task
 2026-10-19 11:59:36 +07:00
ochenstarik-ui
92df7346c7 docs(agents): add Codex stage-1 completion task 
Task from Claude (orchestrator), forwarded by the owner on 2026-10-19:
dependency security fix, real-PostgreSQL integration run, live VK
smoke preparation, single-host deployment and domain access.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 11:59:16 +07:00
Ochenstarik
b625d70e8e fix(security): resolve pre-auth shared identity lockout with valid session cache (Task 16) 2026-08-22 23:31:42 +07:00
Ochenstarik
ef8360bd4b fix(security): enforce pre-auth rate limit before session store lookup (Task 15) 2026-08-22 21:20:27 +07:00
Ochenstarik
8e39ce0cbd fix(validation): Task 14 reject excludeDuplicateComments in API schemas and upgrade CI node-version to 22 2026-08-21 22:49:37 +07:00
Ochenstarik
6510ea2a04 fix(security): Task 13 enforce mandatory authentication for POST /api/posts/preview 2026-08-21 22:32:27 +07:00
Ochenstarik
76ab7d0e77 fix(security): Task 12 add pre-authentication rate limiting to protect session store from flood 2026-08-21 22:27:33 +07:00
Ochenstarik
906148813e chore: Task 11 dead code cleanup and capability validation unification 2026-08-21 19:49:16 +07:00
Ochenstarik
1883a86402 fix(ui): Task 10 improve UI error handling, remove alerts and handle unauthenticated state 2026-08-21 19:45:30 +07:00
Ochenstarik
3feb0d5834 fix(storage): Task 09 ensure eligibleParticipantsCount parity between Memory and Prisma repository drivers 2026-08-21 19:37:41 +07:00
Ochenstarik
4e095553a1 test(prisma): Task 08 add Prisma integration test harness, separate vitest configs and update CI workflow 2026-08-21 19:35:07 +07:00
Ochenstarik
2da8b01b1b fix(core): Task 07 resolve duplicate comments semantics, fix commentsCount merging, and maintain legacy snapshot hash compatibility 2026-08-21 19:31:01 +07:00
Ochenstarik
8741569817 feat(public): Task 06 implement public giveaway verification endpoint and page 2026-08-21 19:11:03 +07:00
Ochenstarik
1a27a10847 feat(security): Task 05 enforce CSRF validation and strict rate limiting on post preview route 2026-08-21 19:06:57 +07:00
Ochenstarik
4b8c6b1039 feat(api): Task 04 implement safe atomic snapshot unlock SNAPSHOT_LOCKED -> READY 2026-08-21 19:01:26 +07:00
Ochenstarik
fb6ae61628 feat(infra): Task 03 upgrade to Next.js 16 and React 19 resolving high security advisories 2026-08-21 18:42:40 +07:00
Ochenstarik
6f3fd44333 feat(security): Task 02 client identity and user-scoped rate limiting 2026-08-21 18:34:13 +07:00
Ochenstarik
92f6d19225 feat(auth): Task 01 add persistent OAuthTransaction and Session Prisma stores 2026-08-21 17:53:38 +07:00
Ochenstarik
b2888950cd docs(report): update Phase 2.4 report with UNVERIFIED and migration details and fix test typechecks 2026-08-21 08:44:34 +07:00
Ochenstarik
3279f287fb fix(snapshot): Phase 2.4.1 enforce atomic snapshot lock, single lock invariant and direct seed commitment binding 2026-08-20 18:23:48 +07:00
Ochenstarik
78151572bd fix(draw): Phase 2.4 enforce seed pre-commit at snapshot lock to prevent grinding 2026-08-20 17:24:07 +07:00
Ochenstarik
9927e74421 fix(auth): Phase 2.3.1.1 truthful giveaway detail capability based on credential status 2026-08-18 15:03:23 +07:00
ochenstarik-ui
0ce91d7b0d docs(agents): define Randomayzer agent workspace workflow 2026-08-18 14:59:10 +07:00
ochenstarik-ui
c4e8731758 docs(agents): add Randomayzer project agent rules 2026-08-18 14:58:49 +07:00
Ochenstarik
4e4370d6f1 fix(vk): Phase 2.3.1 derive effectiveCapabilities from actual resolved auth mode 2026-08-18 14:50:47 +07:00
Ochenstarik
1495067501 chore(tooling): add AI security review exporter 2026-08-18 14:46:09 +07:00
Ochenstarik
bc2b658570 Phase 2.3.1: token refresh correctness gate 2026-08-18 14:37:09 +07:00
Ochenstarik
d6f087c21e feat(vk): Phase 2.3 Authenticated VK Organizer Integration - VkAuthContextResolver, single-flight token refresh mutex, controlled user token fallback, runtime capabilities, and test suite 2026-08-18 13:04:57 +07:00
Ochenstarik
b5467f617e feat(security): Phase 2.2.3 Final Auth Security Gate - fix GET /api/giveaways IDOR, scoped DB query, Prisma ownership migration, atomic OAuth consumeTransaction, trusted production origin, rate limiting, and comprehensive security tests 2026-08-18 12:02:39 +07:00
Ochenstarik
02a04df271 feat(auth): Phase 2.2.2 Authorization Ownership Invariant Fix - strict requireGiveawayOwner null check, Prisma non-null organizerId with onDelete Restrict, repository non-null organizer invariant, migration documentation, and regression tests 2026-08-18 11:28:18 +07:00
Ochenstarik
5d2554f33a feat(security): Phase 2.2.1 Critical AuthZ & Credential Security - centralized ownership guards, protected giveaway mutations, safe redirect validator, CSRF defenses, TokenVault production fail-fast, and comprehensive security tests 2026-08-18 03:08:02 +07:00
Ochenstarik
7c5bf641cd feat(auth): Phase 2.2 VK ID OAuth 2.1 Authentication - PKCE flow, single-use state, encrypted token vault, HttpOnly session, /api/auth endpoints, UI badge, and comprehensive security tests 2026-08-18 02:45:09 +07:00
Ochenstarik
7acf4d2d4e feat(vk): Phase 2.1.1 VK Client Correctness & Official VK Contract Alignment - separated timeout vs cancellation state with VkCancelledError, HTTP vs VK error separation based on VKCOM/vk-api-schema, listener cleanup, pagination truncation guards, and VK_METHOD_CAPABILITIES documentation 2026-08-18 02:38:43 +07:00
Ochenstarik
e666161612 feat(vk): Phase 2.1 Real VK Client Foundation - dedicated VkClient with typed errors, exponential backoff, rate limiting, token security, full pagination, and documentation 2026-08-18 02:31:39 +07:00
Ochenstarik
a27341a302 feat(core): Phase 1.5 Final Production Gate - Idempotency hardening with canonical request fingerprinting, secure client IP resolver with trusted proxy validation, proactive rate limit & idempotency bucket eviction, strict winner count contract (no silent under-delivery), DRAW_ALREADY_COMPLETED terminal error, 100-concurrency draw regression test, and PRODUCTION_GUARDS documentation 2026-08-18 02:22:54 +07:00
Ochenstarik
3f795e23fe feat(core): Phase 1.4.1 Final Race & Payload Fix - atomic conditional transition in saveParticipants, summary-only POST /participants response, and 100k payload regression & concurrency race tests 2026-08-18 02:02:35 +07:00
Ochenstarik
867923186e test(concurrency): sync concurrency and provider capabilities tests with Phase 1.4 normalized error responses and FSM snapshot-first draw flow 2026-08-18 01:56:26 +07:00
Ochenstarik
50973b4f85 feat(core): Phase 1.4 Production Hardening - double draw atomic protection, snapshot concurrency safety, Zod API validation, payload scalability & pagination, provider safety, normalized errors, idempotency, rate limiting, and 20 concurrent draw integration tests 2026-08-18 01:54:35 +07:00
Ochenstarik
46bf8aad6e Merge remote-tracking branch 'origin/main' 2026-08-18 00:42:06 +07:00
Ochenstarik
d0aa55ae30 test(opencode): independent review, VK integration plan, expanded unit tests, provider capabilities validation, and security/concurrency coverage 2026-08-18 00:24:00 +07:00
Ochenstarik
26e82fcf8d feat(core): Phase 1.3 Public Verification Integrity - drawId persistence, real participant snapshot and rules recalculation, reserve winners check, auditEventHash verification, strict snapshot lookup, and anti-tampering test suite 2026-08-18 00:15:30 +07:00
Ochenstarik
1bc6650041 feat(core): Phase 1.2 Final Core Audit Fixes - storage driver policy, snapshot relation binding, true Fisher-Yates HMAC_SHA256_FY_V1, proof/event hash separation, verification API, and GitHub Actions CI 2026-08-17 23:55:01 +07:00
Ochenstarik
0fb5fe3f8d feat(core): Phase 1.1 hardening - Prisma persistence, FSM, immutable snapshots, unbiased HMAC_SHA256_FY_V1 randomizer, and audit proof 2026-08-17 23:44:51 +07:00
Ochenstarik
02920a8743 feat: initial commit - VK Giveaway Randomizer Phase 1 2026-08-17 23:34:49 +07:00