Commit Graph

10 Commits

Author SHA1 Message Date
omair 337cbb8ade fix: remaining audit items — anim counter, API 404s, graceful shutdown, null checks
- anim(): guarantee final frame shows exact target value (not target-1)
- API: /api/* catch-all returns 404 JSON instead of SPA fallback HTML
- Server: SIGTERM handler closes pool + server gracefully
- renderTeamBar: null-check allBtn before DOM manipulation
2026-03-10 07:19:21 +08:00
omair 53d8324fb4 harden: security, UX, and data integrity fixes from deep audit
Extension:
- SQL injection fix: dollar-quoting instead of single-quote escaping
- Cache team.json + resolved member (no re-reads every call)
- System prompt: removed forceful 'Always use member=X', now says auto-detected
- Member name sanitisation: strip non-alphanumeric chars

API (server.js):
- Auth middleware: requireAuth on POST/PATCH/DELETE endpoints (SHIPS_API_KEY env)
- Member normalisation: cleanMember() strips special chars, lowercases
- Case-insensitive queries: LOWER() on all member WHERE/GROUP BY clauses
- XSS prevention: member values sanitised on insert

Frontend (index.html):
- renderFilters: clear old pills before appending (fixes duplication bug)
- filterByMember: hero count stays fixed to total (not filtered count)
- filterByMember: fetches global stats separately for hero + team bar
- filterByMember: loading state (opacity transition during fetch)
- filterByMember: resets project filter when switching members
- renderTeamBar: hidden when ≤1 member (removes redundant UI)
- renderTeamBar: properly manages Everyone pill active state
- renderTeamBar: esc() on member names to prevent XSS
2026-03-10 07:16:15 +08:00
omair 824dedfc3e fix: team log polish — capitalise names, fix filter re-render, add DISPLAY entries, improve project detection
- renderTeamBar: titleCase() member names for public display
- filterByMember: re-render project filters + team bar after switching member
- DISPLAY map: add entries for #228 (team tracking) and #229 (polish)
- detectProject: added keywords — donor, checkout, deploy, docker, build log, etc.
- Preserves active state on team pills when re-rendering
2026-03-10 07:04:11 +08:00
omair 9fa0c7554d feat: team member awareness for ship/oops log
- API: all endpoints support ?member= filtering
- API: POST /ships and /oops now accept member field
- API: new GET /api/team endpoint with per-member ship counts
- Frontend: team filter pill bar on /live page
- Frontend: click member to filter timeline, stats, incidents
- Frontend: Everyone pill shows master view across all members
2026-03-10 06:57:05 +08:00
omair 5981d24104 Migrate calvana API into quikcue-site: add Node.js server, update Dockerfile, add migrated HTML pages 2026-03-10 06:27:11 +08:00
omair 0526bf27f7 fix: www.quikcue.com 301 redirect, /work/ 403 fix, canonical trailing slashes, blog sitemap in robots.txt 2026-03-09 19:20:55 +08:00
omair 28abaea39b fix: scrub infra details — no server topology, tool names, or shared hosting references 2026-03-06 02:19:09 +08:00
omair 1fac4cd2ee feat: /live complete UI redesign — hero, rings, project cards, timeline, incidents 2026-03-06 00:24:45 +08:00
omair 46eef75555 feat: /live overhaul — visitor-friendly titles, project filters, incident log cleanup 2026-03-06 00:04:08 +08:00
omair 9e82633a5e feat: /live page — full ship log + oops on quikcue.com 2026-03-05 23:44:33 +08:00