5 Commits

Author	SHA1	Message	Date
chiguyong	848939dc21	feat: add admin review + Hermes sync workflow with sync_token auth	2026-06-21 15:25:01 +08:00
chiguyong	2055b62afd	fix(security): apply code review fixes and rewrite README ... - fix(P1): prevent YAML injection in adaptToHermesConfig via yamlString() and sanitizeComment() - fix(P2): add @@index([userId, createdAt]) to ApiKey model - fix(P2): change Hermes error responses from text/plain to JSON - fix(P2): set .env file permissions to 600 in setup-server.sh - fix(P2): remove dead model fallback code - fix(P2): unify API Key response naming (GET returns { apiKeys }) - fix(P3): add console.warn to fire-and-forget catch - fix(P3): correct keyPrefix comment (8 -> 12 chars) - fix(P3): move require() to file top in auth.js - fix(P3): stop printing database password in setup-server.sh - docs: rewrite README with architecture, operation flow, and Hermes interaction flow	2026-06-21 14:05:37 +08:00
chiguyong	6037bf2bd6	feat: add Hermes Agent cross-machine deployment via CLI pull	2026-06-21 14:05:37 +08:00
chiguyong	d6f222c2e0	fix(security): resolve 2 P0 issues - hardcoded JWT secret and stored XSS ... P0-1: JWT secret hardcoded fallback (src/lib/auth.js) - Remove insecure hardcoded default 'eternalai_jwt_secret_2026_change_in_prod' - Fail-fast in production: throw error if JWT_SECRET env var is missing - Dev/test: print security warning and use dev-only temporary secret P0-2: Stored XSS via innerHTML (app.js) - Add escapeHtml() utility function (escapes & < > " ') - Escape all user-controlled data in innerHTML templates: - Role library list (id, displayName, desc, avatar, price) - Creator center role list (id, displayName, avatar, status) - Role detail price - Income records (role, time) - Error messages in catch blocks All 35 E2E tests pass.	2026-06-21 14:05:37 +08:00
chiguyong	6234c27138	feat: add PostgreSQL + JWT backend, fix 4 critical issues (auth/role persistence/edit/library)	2026-06-21 14:05:37 +08:00