ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Commit graph

  • b625d70e8e fix(security): resolve pre-auth shared identity lockout with valid session cache (Task 16) main Ochenstarik 2026-08-22 23:31:42 +0700
  • ef8360bd4b fix(security): enforce pre-auth rate limit before session store lookup (Task 15) Ochenstarik 2026-08-22 21:20:27 +0700
  • 8e39ce0cbd fix(validation): Task 14 reject excludeDuplicateComments in API schemas and upgrade CI node-version to 22 Ochenstarik 2026-08-21 22:49:37 +0700
  • 6510ea2a04 fix(security): Task 13 enforce mandatory authentication for POST /api/posts/preview Ochenstarik 2026-08-21 22:32:27 +0700
  • 76ab7d0e77 fix(security): Task 12 add pre-authentication rate limiting to protect session store from flood Ochenstarik 2026-08-21 22:27:33 +0700
  • 906148813e chore: Task 11 dead code cleanup and capability validation unification Ochenstarik 2026-08-21 19:49:16 +0700
  • 1883a86402 fix(ui): Task 10 improve UI error handling, remove alerts and handle unauthenticated state Ochenstarik 2026-08-21 19:45:30 +0700
  • 3feb0d5834 fix(storage): Task 09 ensure eligibleParticipantsCount parity between Memory and Prisma repository drivers Ochenstarik 2026-08-21 19:37:41 +0700
  • 4e095553a1 test(prisma): Task 08 add Prisma integration test harness, separate vitest configs and update CI workflow Ochenstarik 2026-08-21 19:35:07 +0700
  • 2da8b01b1b fix(core): Task 07 resolve duplicate comments semantics, fix commentsCount merging, and maintain legacy snapshot hash compatibility Ochenstarik 2026-08-21 19:31:01 +0700
  • 8741569817 feat(public): Task 06 implement public giveaway verification endpoint and page Ochenstarik 2026-08-21 19:11:03 +0700
  • 1a27a10847 feat(security): Task 05 enforce CSRF validation and strict rate limiting on post preview route Ochenstarik 2026-08-21 19:06:57 +0700
  • 4b8c6b1039 feat(api): Task 04 implement safe atomic snapshot unlock SNAPSHOT_LOCKED -> READY Ochenstarik 2026-08-21 19:01:26 +0700
  • fb6ae61628 feat(infra): Task 03 upgrade to Next.js 16 and React 19 resolving high security advisories Ochenstarik 2026-08-21 18:42:40 +0700
  • 6f3fd44333 feat(security): Task 02 client identity and user-scoped rate limiting Ochenstarik 2026-08-21 18:34:13 +0700
  • 92f6d19225 feat(auth): Task 01 add persistent OAuthTransaction and Session Prisma stores Ochenstarik 2026-08-21 17:53:38 +0700
  • b2888950cd docs(report): update Phase 2.4 report with UNVERIFIED and migration details and fix test typechecks Ochenstarik 2026-08-21 08:44:34 +0700
  • 3279f287fb fix(snapshot): Phase 2.4.1 enforce atomic snapshot lock, single lock invariant and direct seed commitment binding Ochenstarik 2026-08-20 18:23:48 +0700
  • 78151572bd fix(draw): Phase 2.4 enforce seed pre-commit at snapshot lock to prevent grinding Ochenstarik 2026-08-20 17:24:07 +0700
  • 9927e74421 fix(auth): Phase 2.3.1.1 truthful giveaway detail capability based on credential status Ochenstarik 2026-08-18 15:03:15 +0700
  • 0ce91d7b0d docs(agents): define Randomayzer agent workspace workflow ochenstarik-ui 2026-08-18 14:59:10 +0700
  • c4e8731758 docs(agents): add Randomayzer project agent rules ochenstarik-ui 2026-08-18 14:58:49 +0700
  • 4e4370d6f1 fix(vk): Phase 2.3.1 derive effectiveCapabilities from actual resolved auth mode Ochenstarik 2026-08-18 14:50:47 +0700
  • 1495067501 chore(tooling): add AI security review exporter Ochenstarik 2026-08-18 14:46:09 +0700
  • bc2b658570 Phase 2.3.1: token refresh correctness gate Ochenstarik 2026-08-18 14:37:09 +0700
  • d6f087c21e feat(vk): Phase 2.3 Authenticated VK Organizer Integration - VkAuthContextResolver, single-flight token refresh mutex, controlled user token fallback, runtime capabilities, and test suite Ochenstarik 2026-08-18 13:04:57 +0700
  • f8c4d12b98
         Merge 8476934153 into b5467f617e ochenstarik-ui 2026-08-18 12:59:31 +0700
  • 8476934153 chore(agents): единая структура заданий и приёмки chore/agents-workspace Ochenstarik 2026-08-18 12:57:51 +0700
  • b5467f617e feat(security): Phase 2.2.3 Final Auth Security Gate - fix GET /api/giveaways IDOR, scoped DB query, Prisma ownership migration, atomic OAuth consumeTransaction, trusted production origin, rate limiting, and comprehensive security tests Ochenstarik 2026-08-18 12:02:39 +0700
  • 02a04df271 feat(auth): Phase 2.2.2 Authorization Ownership Invariant Fix - strict requireGiveawayOwner null check, Prisma non-null organizerId with onDelete Restrict, repository non-null organizer invariant, migration documentation, and regression tests Ochenstarik 2026-08-18 11:28:18 +0700
  • 5d2554f33a feat(security): Phase 2.2.1 Critical AuthZ & Credential Security - centralized ownership guards, protected giveaway mutations, safe redirect validator, CSRF defenses, TokenVault production fail-fast, and comprehensive security tests Ochenstarik 2026-08-18 03:08:02 +0700
  • 7c5bf641cd feat(auth): Phase 2.2 VK ID OAuth 2.1 Authentication - PKCE flow, single-use state, encrypted token vault, HttpOnly session, /api/auth endpoints, UI badge, and comprehensive security tests Ochenstarik 2026-08-18 02:45:09 +0700
  • 7acf4d2d4e feat(vk): Phase 2.1.1 VK Client Correctness & Official VK Contract Alignment - separated timeout vs cancellation state with VkCancelledError, HTTP vs VK error separation based on VKCOM/vk-api-schema, listener cleanup, pagination truncation guards, and VK_METHOD_CAPABILITIES documentation Ochenstarik 2026-08-18 02:38:43 +0700
  • e666161612 feat(vk): Phase 2.1 Real VK Client Foundation - dedicated VkClient with typed errors, exponential backoff, rate limiting, token security, full pagination, and documentation Ochenstarik 2026-08-18 02:31:39 +0700
  • a27341a302 feat(core): Phase 1.5 Final Production Gate - Idempotency hardening with canonical request fingerprinting, secure client IP resolver with trusted proxy validation, proactive rate limit & idempotency bucket eviction, strict winner count contract (no silent under-delivery), DRAW_ALREADY_COMPLETED terminal error, 100-concurrency draw regression test, and PRODUCTION_GUARDS documentation Ochenstarik 2026-08-18 02:22:54 +0700
  • 3f795e23fe feat(core): Phase 1.4.1 Final Race & Payload Fix - atomic conditional transition in saveParticipants, summary-only POST /participants response, and 100k payload regression & concurrency race tests Ochenstarik 2026-08-18 02:02:35 +0700
  • 867923186e test(concurrency): sync concurrency and provider capabilities tests with Phase 1.4 normalized error responses and FSM snapshot-first draw flow Ochenstarik 2026-08-18 01:56:26 +0700
  • 50973b4f85 feat(core): Phase 1.4 Production Hardening - double draw atomic protection, snapshot concurrency safety, Zod API validation, payload scalability & pagination, provider safety, normalized errors, idempotency, rate limiting, and 20 concurrent draw integration tests Ochenstarik 2026-08-18 01:53:56 +0700
  • 46bf8aad6e Merge remote-tracking branch 'origin/main' Ochenstarik 2026-08-18 00:42:06 +0700
  • d0aa55ae30 test(opencode): independent review, VK integration plan, expanded unit tests, provider capabilities validation, and security/concurrency coverage Ochenstarik 2026-08-18 00:24:00 +0700
  • 26e82fcf8d feat(core): Phase 1.3 Public Verification Integrity - drawId persistence, real participant snapshot and rules recalculation, reserve winners check, auditEventHash verification, strict snapshot lookup, and anti-tampering test suite Ochenstarik 2026-08-18 00:15:30 +0700
  • 1bc6650041 feat(core): Phase 1.2 Final Core Audit Fixes - storage driver policy, snapshot relation binding, true Fisher-Yates HMAC_SHA256_FY_V1, proof/event hash separation, verification API, and GitHub Actions CI Ochenstarik 2026-08-17 23:55:01 +0700
  • 0fb5fe3f8d feat(core): Phase 1.1 hardening - Prisma persistence, FSM, immutable snapshots, unbiased HMAC_SHA256_FY_V1 randomizer, and audit proof Ochenstarik 2026-08-17 23:44:51 +0700
  • 02920a8743 feat: initial commit - VK Giveaway Randomizer Phase 1 Ochenstarik 2026-08-17 23:34:49 +0700