Repository navigation
chore(deps)(deps): bump the production-dependencies group across 1 directory with 13 updates - #140
Open
dependabot[bot] wants to merge 548 commits into
Open
dependabot[bot] wants to merge 548 commits into
dependabot[bot] wants to merge 548 commits into
Conversation
JS-driven progress bars now animate transform: scaleX instead of width (no layout thrash): pl-bar loader (header/page-loader), toast progress bar, loading-popup fill, transfer progress, password-strength bar. Track overflow-hidden kept/clamped; transform-origin left center.
POST /admin/addons/store/uninstall was fetched by admin-addons.js and store.ejs but had no route (404). Matches its sibling stubs (list/discussions/install) while the addon store is coming soon.
Prior-session WIP (complete): mobile more-sheet gains a server-view submenu (sheet-swipe-left/right stagger, reduced-motion respected), template sidebar items get --i stagger animation. Repaired $1 sed artifacts in template.ejs admin nav.
admin user create/edit/delete flows, api-key page, sidebar nav (Dashboard/Locations), and server edit page referenced keys absent from the canonical en locale (rendered via view fallbacks).
…il shown - hide pc-sidebar on mobile via hidden class (was a tall empty block on top of the page since items became opacity:0 until .showing) - apply initial showSidebarView on load so sidebar/sheet items are visible without user interaction - openSheet shows main view when no server view exists (items stayed opacity:0 forever on non-server pages) - sheet hiding now transform-based instead of CSS translate (works on older browsers that ignore the translate property)
window 'load' never fires if an external resource (dicebear avatar, font) hangs, so js-loading was never removed and the loader overlay (pointer-events:all) stayed up forever: blank page + unclickable UI. - reveal content via 2s load guard on DOMContentLoaded (load still wins if it fires first) - loader overlay is now pointer-events:none (decorative only)
a8dc4f8 dropped the default-hidden mechanism (opacity-0 pointer-events-none) from the consolidated global modal; with no hidden state, the rgba(0,0,0,0.5) scrim and empty panel covered every page until the backdrop was tapped. Restore display:none via the hidden class (utilities layer, wins over .al-sheet-overlay flex); Animate.openModal/closeModal already toggle it.
…ak the UI iOS Safari often serves cached assets without revalidating, so the user's phone kept running the pre-guard page-loader.js — js-loading stuck, the loader overlay covering everything, content invisible until the More tap. Version all /js, /javascript, styles.css, layout-animations.css and styles/motion.css references so every page forces fresh files.
…ted inside it Since c56e337 the sheet's closing </div> was missing, so the browser parsed the modal, backdrop and the entire <main> content as children of #mobile-more-sheet. The sheet is translate-y-full (off-screen), which pushed the whole page below the viewport: only the fixed top bar and bottom nav were visible. Clicking More slid the sheet up — dragging the entire app back into view, which is why it looked like the overlay 'cleared' only then. Desktop was affected too (sheet lg:hidden made everything inside it invisible).
… animation The Back and Go Back buttons in the mobile sheet had the mobile-more-link class, which triggered closeSheet() on click — instead of switching views like the sidebar equivalents. Removed that class so they call showSheetView(). Added active:scale-95 depress on press to all four buttons (sidebar + sheet). Bumped sidebar button touch target from min-h-9 (36px) to min-h-[44px] (44px) to match.
…, active highlights) - Fixed critical missing </div> that caused sheet to swallow page content - Sheet positioned above bottom bar (bottom: 60px) with max-height constraint - Added pill drag handle at top of sheet - Extend-up animation on open, reverse on close - Sheet background matches nav theme (--theme-nav-bg) - Active state highlights on current page items using --theme-accent - More button toggles open/close - Drag-down-to-close on pill handle - Server view with Back/GoBack navigation between views
- Fix CRITICAL XSS in edit.ejs (JSON.parse with unescaped output) - Fix XSS in create.ejs (single-quote breakout in data attributes) - Fix XSS in user EJS views (onclick handlers, req.translations leaks) - Remove all type casts (as any, as Record<string, unknown>, etc.) - Extract 200+ magic values into named constants across JS files - Replace all var with const/let (35 JS files, 80+ EJS inline scripts) - Fix silent error swallowing (empty catch blocks → console.error) - Add input validation (admin-node-edit, admin-node-create, create-server) - Remove dead code (renderAllocatedPorts, unused variables) - Fix GB→MB conversion bug in Pterodactyl API (node.ram * 1024) - Fix wrong defaults in Pterodactyl API (Memory:4→512, Cpu:2→100) - Replace monkey-patching with WeakMap in daemon nativeSftp - Add named constants to all handler utils (ports, csrf, nodeStatus, etc.) - Fix catch(error: any) → catch(error: unknown) across all modules - Fix Prisma types (ServerGetPayload, UIComponentStore export) - Fix URL scheme validation in addon store (prevent javascript: URLs)
CSS & Themes: - Fix WCAG AA contrast: 13 color tokens across 7 themes - Add missing design tokens (--theme-disabled, --theme-focus-ring, --theme-radius-*, --theme-shadow-*, --theme-skeleton-*, --theme-btn-*) - Unify motion timing: replace mixed easing with cubic-bezier(0.16, 1, 0.3, 1) - Fix duplicate CSS selectors (hide-scrollbars.css) - Add disabled states to al-btn-ghost, al-input, cs-trigger, tab-btn, chips - Fix solarized-light dark mode copy-paste (html.dark prefixed selectors) - Add --ease-bounce for checkbox micro-interaction EJS Components (30 files): - Fix <a><button> invalid HTML nesting → styled <a> - Add missing alt text on images (users, settings) - Add missing aria-labels (store cards, toasts, install status) - Add keyboard support (store addon cards → <button>) - Add prefers-reduced-motion for skeleton animations - Add manual dismiss button on toasts - Add theme-color meta tag - Make store search responsive (w-full on mobile) - Add complete button state coverage (hover/active/focus/disabled) - Fix orphaned closing tags (players, file, worlds) - Add missing toast/footer includes (startup, players, credits) - Fix heading hierarchy (al-card-header → <h2>) Admin Views: - Fix duplicate type attribute, duplicate style attribute - Fix inconsistent padding (p-6 → pb-12) - Replace button-onclick navigation with <a href> User Views: - Fix broken worlds.ejs noWorldsMessage block - Move breadcrumb/search out of <table> in files.ejs - Add scope/aria-label on table headers - Add for/id on form labels (databases, startup, backups, account) JS-Driven Styles: - Replace hardcoded colors/easings with CSS custom properties (--theme-*, --ease-*) - Fix syntax error in component-persistence.js - Replace hardcoded chart colors with theme tokens
Sidebar: - Remove CSS !important overrides on active nav (let JS handle inverted colors) - Active nav now white in dark mode, black in light mode Admin/apikeys: - Fix FormData encoding (URLSearchParams instead of FormData body) - Server was receiving empty body → 'name required' error Admin/images: - Add upload modal with drag-drop zone (matching files.ejs pattern) - Replace native file picker with proper popup Admin/images/store: - Add 1.5s delay before closing install popup - Show success state (checkmark + green background) before close Activity logging: - Add logActivity calls for user:create/delete/update - Add logActivity calls for node:create/update/delete - Add logActivity calls for apikey:create/delete - Add logActivity calls for image:create/update/delete Admin/users: - Fix error responses (return JSON instead of redirect) - Add self-deletion guard - Add session cleanup on user delete Admin/locations: - Merge into admin/nodes page as bottom section - Add scroll-to anchor link in page header - Redirect /admin/locations to /admin/nodes#locations Tables: - Add table-layout: fixed to .al-table for even column distribution - Add colgroup/col width definitions to servers, nodes, users tables - Card headers already extend edge-to-edge via negative margins
…reate-server page
Admin/mounts:
- Rebuild page with proper al-table (Name/Source/Target/Read-only/Actions)
- Colgroup width distribution, empty state, font-mono path chips
- Rebuild modal with al-sheet-overlay pattern, Animate.openModal
- Delete via window.modal.confirm
Sidebar:
- Remove Locations link from sidebar and mobile bottomNav
- Locations now a tab on nodes page (Nodes/Locations tabs, hash-aware)
Sidebar highlight:
- Fix page-loader.js setDesktopActiveLink (identical dark/light ternaries bug)
- Fix transitions.js updateNav same bug
- Add inverted pill CSS (!important, #pc-sidebar specificity)
- Active nav now white bg/black text in dark, black bg/white text in light
Nodes/edit:
- Rebuild Maintenance Mode card with proper toggle switch (sr-only peer + al-toggle)
- Remove overflow:hidden CSS override clipping card headers
Admin/servers/create:
- Fix double-encoded JSON (JSON.stringify of stored JSON strings)
- Tolerant parseJson() helper, unwraps legacy double-encoding
- Fix ports showing 2 pre-selected ('[]'.length === 2 bug) → Math.max(1, requirements.length)
Server/console (manage.ejs): - Fix vendor script 404s (xterm-addon-fit, xterm-addon-web-links had wrong URLs) - Fix defer ordering bug: inline console script ran before deferred vendor scripts, Terminal was undefined - Switch xterm from CDN to self-hosted /vendor paths - Terminal now connects, install logs stream, power buttons work end-to-end Server/databases: - Root cause: <%= JSON.stringify(req.translations) %> HTML-escaped JSON into script → SyntaxError killed ALL handlers - Remake: al-card + al-table (Name/Host/Connection string/Username/Password/Actions) - data-action delegation instead of fragile onclick, in-place rotate update - Fix eye icon (didn't exist), proper Animate modal pattern, empty states Server/schedules: - Fix broken [data-schedule-id] selectors after restructure - Fix broken data-sched-name escaping - Modal footer out of scrollable area - Remake: al-table (Name/Schedule/Tasks/Enabled/Actions) + inline task management rows Server/subusers: - Fix JSON.stringify in onclick splitting HTML attribute (edit modal never opened) - Fix apostrophe escaping in remove handler - Pass canonical PERMISSION_GROUPS from serverAuthUtil (was stale 24-perm subset) - Remake: al-sheet modal pattern, permission rows with accent highlight, empty state
Root cause: panel only showed lifecycle messages; real container output was invisible because logs weren't being captured by the daemon without an open console WS (now fixed daemon-side). Panel now fetches and displays them. Changes in manage.ejs: - Extract loadRecentLogs(showMarkers): reusable helper from loadLogHistory - On lifecycle 'started': auto-load real logs from disk history, then force-reconnect console socket if it wasn't open - On lifecycle 'stopped'/'killed': fetch ring buffer to show final output - On lifecycle 'installing': auto-load install logs once per session - Server-stopped flag: prevent reconnect hammering while container stopped - Force-reconnect helper: reset backoff + immediate reconnect on start - Placeholder: showConsolePlaceholder now writes 'waiting for output' message - New flags: serverStopped, logsAutoLoaded, installLogsLoaded (dedup + gating)
…ed output
Server delete (servers.ts):
- Delete activityLog rows for the server inside the delete transaction
- Log server:delete with serverId:null + UUID in metadata (was passing
server.UUID after the row was deleted → foreign key constraint violation
on every delete, '[audit] failed to write activity log' error)
Console (manage.ejs):
- Fix writeConsole('info', ...) 2-arg call → '[info] undefined' spam
(placeholder message now correct: writeConsole('daemon', 'info', ...))
- Guard crashReasonLabel null: writeConsole/showToast only when reason
exists (was printing '[daemon] null' + null toast on unexpected stop)
…ge, regenerate prisma client
Security (panel): - SSRF protection: fetchPublic() for image import, assertSafePublicUrl for file pull - Path validation: isPathSafe on writeFile/deleteFile/renameFile - Password reset: invalidate all tokens on password change - Sibling token invalidation on reset completion - DaemonService: enforceDaemonHttps protocol resolution - Remove duplicate 2FA check (dead code) Security (daemon): - BEHIND_PROXY: TRUSTED_PROXY_IPS alignment with server.ts - SFTP TOCTOU: secureOpenRead/Write/Append/ReadWrite via openat2 - REQUIRE_HMAC: read config.requireHmac not Bun.env - copyIntoVolume: skip symlinks - listDir cache: return limited array not full - secureUnlink: document remaining TOCTOU window - downloadTokens: truncate token in logs - sftpServer: unref cleanup interval - ws/server.ts: WebSocket count drift fix CI (panel): - Path filters: skip CI on doc-only changes - dorny/paths-filter: conditional job execution - Dependency caching with pnpm store - Proper postinstall: prisma generate for typecheck/test/build - ci-gate job for branch protection - --frozen-lockfile everywhere CI (daemon): - Path filters: skip on doc-only changes - Bun dependency cache - --frozen-lockfile - Embedded check job - Build verification job - ci-gate job for branch protection - Fix lockfile ref (bun.lock not bun.lockb) Build (daemon): - Preflight job: validate version, run checks before building - SHA-256 checksums in release - Bun dependency cache Version bump (daemon): - Manual dispatch only (was auto-bumping on every push) - Version format validation - Optional sync toggles for README/example.env - Skip empty commits Docs: - Fix README curl command, update version refs - Fix example.env VERSION drift - Fix release-specification bun version
pnpm/action-setup@v4 + setup-node cache:pnpm race condition. Node.js 24 -> 22 (stable). Explicit pnpm version: 11.
- Add GRANT CREATE ON SCHEMA public (PG15+ removed from GRANT ALL) - Add GRANT ALL ON ALL TABLES/SEQUENCES for existing objects - Detect pnpm or fall back to npm/npx throughout setup
Lockfile was gitignored causing --frozen-lockfile to fail in CI. Removed pnpm-lock.yaml from .gitignore.
- Rewrite migration.sql: MySQL backticks → PG double quotes, DATETIME→TIMESTAMPTZ - cspHeaders.test.ts: defer readFileSync into beforeAll to prevent ENOENT at describe time - filesBackend.test.ts: mock Redis to prevent rate limiter hanging in CI
…and test fixes (#124) * chore:checkpoint commit too many changes rn * chore:checkpoint commit 2 * feat: config system, i18n, CSS extraction, views restructure, source cleanup - Config system: src/config/ with context-specific modules (timeouts, limits, auth, server, daemonTimeouts, urls, mime, ui) + barrel defaults.ts + backwards-compat constants.ts - i18n service: src/services/i18n.ts with t(), tn(), logT(), req.translations Proxy, i18nMiddleware - English lang.json: deduplicated 59 duplicate keys, 2096 canonical keys - EJS templates: hardcoded strings replaced with i18n calls (admin, user, server views) - CSS: extracted ~40 hardcoded values to :root custom properties (tw.css, layout-animations.css, motion.css) - Views: renamed camelCase to kebab-case, moved admin/mounts/index.ejs → mounts.ejs, extracted settings script - Source: barrel index.ts files, merged platform/daemon/dtos, Alternative → legacy - Fix: CSP upgradeInsecureRequests only when HTTPS, doubled import prefixes, as const assertion - Fix: i18n logger import path, middleware types, LANG_DIR path - Fix: playerStatsCollector/daemonRequest/wsToken config import names - DB: prisma db push synced schema to PostgreSQL * fix: seed default roles on startup, conditional CSP upgradeInsecureRequests - Seed owner/admin/user roles when Role table is empty (fixes fresh DB registration FK violation) - Only enable upgradeInsecureRequests CSP directive when running HTTPS (fixes blank page on remote access via HTTP) * feat: expand env config, Dockerfile, Playwright, remove onboarding, codebase cleanup - Expand .env with 20+ configurable fields (TLS, SMTP, rate limits, CSP, proxy, cookies, storage, logging) - Add parsePositiveInt/parseBytes to config.ts for env parsing - Wire all new env options into app.ts (TLS HTTPS, trust proxy, session, rate limiting) - Update templateConfig.ts to expose all panel config fields to EJS - Fix envLoader.ts comment-line parsing in example.env scanner - Bundle @tanstack/query-core as IIFE vendor script - Create Dockerfile (node:22-bookworm test image) + .dockerignore - Create playwright.config.ts with chromium webServer setup - Update setup.mjs with 11 new CLI flags for all env options - Update installer.sh with 7 new args, TUI prompts, full .env generation - Fix CSP test (cspEnabled check + unsafe-eval) - Fix migration-invariants test (query-core path) - Fix responsiveA11y test (aria-label partial match) - Remove onboarding system (schema, routes, views, JS, i18n keys) - Remove old admin-settings JS bundles (replaced by new builds) - Clean up Prisma generated types and API modules - Remove stale dashboard/settings/ejs views * refactor: clean up package.json, move Docker test infra to tests/docker/, merge e2e into ci.yml - package.json: add keywords, homepage, bugs, description; add db:* scripts (generate, push, migrate, seed, reset, drop, studio, status); add test:e2e, test:docker, test:all; remove dead installer/build-vendor refs - Move Dockerfile + entrypoint.sh + docker-compose.test.yml → tests/docker/ - Add e2e Playwright job to ci.yml (depends on build, uploads report artifact) - Add top-level env vars (NODE_VERSION, PNPM_VERSION) to ci.yml for DRY - Fix migrate:deploy → db:migrate:deploy in ci.yml - Delete redundant test.yml workflow * fix(ci): remove pnpm version conflict — let action read from packageManager * fix: resolve all CI failures — lint, tests, build job - Fix eslint: singlequotes in app.ts, curly braces in config.ts (eslint --fix) - Fix CI build job: db:migrate:deploy → db:push (no migration files exist) - Fix cspHeaders test: match escaped unsafe-eval string - Fix featureRegistry test: api/alternative → api/legacy (renamed module) - Skip apiAlternativeValidator + daemonDtos tests (modules deleted in cleanup) - Fix activityLogger + adminUsersHtmx tests: add res.locals.t/tn mock, update assertions for i18n keys * fix(tests): mock realtime/events in adminNodesServers to prevent Redis cascade Missing mock caused emitRealtime to hit real Redis → Connection closed → timeouts in adminUsersHtmx and backupsBackend via parallel runner. * fix(ci): add Redis service + .env to UT job, mock realtime/events in 4 tests CI Unit Tests had no Redis service and no .env file — tests that import modules using emitRealtime (shared, backups, schedules, files) hit real Redis, got MaxRetriesPerRequestError, cascading timeouts. - Add Redis 7 service container to CI test job - Write full .env mirroring setup.mjs output (session, redis, db, smtp) - Mock realtime/events in resourceRelease, filesBackend, schedulesBackend, adminNodesServers to prevent real Redis connections in unit tests * fix: remove type:module (breaks CJS build output), drop E2E from CI gate - Replace "type": "module" with "main": "dist/app.js" — tsconfig outputs CommonJS, module:module makes Node treat .js as ESM → crash - Remove E2E from ci-gate needs/results — no Playwright test files exist yet, so E2E always fails and blocks the pipeline * chore :add generated dir * fix: use SUPPORTED_LANGUAGES constant in account.ejs language selector - Template referenced undefined 'supportedLanguages' variable - Matches res.locals.SUPPORTED_LANGUAGES set by templateConfig.ts - Fixes ReferenceError crash on /account page
Vite build pipeline: - Add vite.config.mjs (reads public/styles/tw.css, outputs hashed assets) - Add assetUrl() helper with Vite manifest resolution - Update 24 EJS templates: assetPath() → assetUrl() - Wrap 4 bare hardcoded paths in assetUrl() - Add db-reset.mjs with warning UIs Prisma Json-as-String migration (report #5): - Convert 13 String fields to native Json type in schema.prisma (permissions, Ports, Variables, allocatedPorts, bannedIps, dockerImages, variables, scripts, config_files, portRequirements, payload, SubUser.permissions, ApiKey.permissions) - Remove JSON.parse/JSON.stringify in 35+ TS files - Add type casts for Prisma JsonValue compatibility Baseline migration (report #8): - Remove broken 20260829_add_passkey_model migration - Create 20260910_baseline with full schema DDL - Database re-provisioned cleanly Other fixes from report: - SQL injection guard in addonHandler (report #1) - DatabaseHost password encryption AES-256-GCM (report #2) - req.panelUser auth middleware (report #4) - ESLint no-explicit-any: error (report #7) - Dev script uses prisma migrate dev (report #11) - Installer copyright fix (report #12)
- Create scripts/executer.mjs — single entry point for all package.json commands (start, build, test, db:*, lint, format, typecheck, etc.) - Move scripts/ out of public/ to prevent CDN/asset exposure - CSP: allow cdn.jsdelivr.net in dev-only for Eruda console - Add Eruda debugger to both header.ejs and auth-header.ejs (dev mode only: NODE_ENV !== production) - package.json: route all scripts through executer.mjs - Remove old Express /scripts block (no longer needed)
- Remove defer from query-core.js — state.js (footer, no defer) was executing before query-core set window.ALQuery - Add 98 missing log.* translation keys to en/lang.json - Switch CSS minification from lightningcss to esbuild — eliminates 59 'Unknown at rule' warnings for Tailwind v4 @theme/@plugin/@tailwind - Simplify addonHandler build logging (no more warnings to condense)
…p lock race - New ui.mjs: shared B&W TUI primitives (Logger, box, prompt, secret, confirm, menu, spinner, sudo) - New pg-super.mjs: shared postgres superuser helper (detectMethod, runAsSuper, dropRoleCleanly) - New db-cleanup.mjs: drop DB + role permanently (no recreate) - executer.mjs: drop chalk/boxen, use ui.mjs, fix node_modules/.bin PATH, add descriptions - db-backup.mjs: unlock .backups/ dir before writing (chmod 000 race fix), simplified lockDir - db-reset.mjs: rewrite using ui.mjs + pg-super.mjs - setup.mjs: rewrite using ui.mjs, unified theme - installer.sh: copyright/header cleanup - package.json: add db:cleanup script
Phase 01-09: Turbo Drive migration + lifecycle cleanup + API consolidation BREAKING: Buttons may be broken - api-client.js script tag was missing, now added Changes: - Phase 01: Introduce Turbo Drive (@hotwired/turbo v8.0.23), account.ejs turbo-frame - Phase 02: Persistent shell (data-turbo-permanent), sidebar re-mark, online-check WS removed - Phase 03: Replace Alnav with Turbo, 19 Alnav.load() -> Turbo.visit(), 15 Alnav.reload() -> Turbo.visit(window.location.href), navigator.js deleted - Phase 04: Alpine/HTMX lifecycle cleanup, removed Alpine internals manipulation - Phase 05: API/UI contract consolidation, deleted api.js (window.api), canonical window.Api in api-client.js - Phase 06: Endpoint route cleanup, fixed nodes.ts duplicate router.get(/:id/configure) -> router.post(/:id/maintenance), removed 125 dead Api.* methods (929 -> 153 lines) - Phase 07: Realtime/islands lifecycle, added turbo:before-render + pagehide teardown for server console and file editor - Phase 08: UI system audit, removed dead .al-card-header CSS, fixed page-header gap inconsistency - Phase 09: Final hardening, removed motion.js (0 callers), cleaned dead exports from layout-animations.js, renamed al_nav -> __asm_nav, removed data-alnav-skip attributes Files changed: - Deleted: public/javascript/shared/navigator.js (793 lines, Alnav) - Deleted: public/javascript/shared/api.js (33 lines, redundant API client) - Deleted: public/javascript/shared/motion.js (195 lines, unused IntersectionObserver animations) - Modified: public/javascript/api-client.js (929 -> 153 lines, removed 125 dead methods) - Modified: public/javascript/shared/page-loader.js (renamed al_nav flag) - Modified: public/javascript/shared/layout-animations.js (removed dead exports) - Modified: public/styles/tw.css (removed duplicate .al-card-header, dead motion token) - Modified: src/modules/api/v2/admin/nodes.ts (fixed duplicate route bug) - Modified: views/components/header.ejs (Turbo enabled, api-client.js loaded, Alnav removed) - Modified: views/components/sidebar.ejs (data-turbo-permanent, online-check removed) - Modified: views/components/toast.ejs (data-turbo-permanent) - Modified: views/components/bottom-nav.ejs (removed data-alnav-skip) - Modified: views/components/footer.ejs (removed motion.js script) - Modified: views/components/ui/page-header.ejs (gap-3 -> gap-4) - Modified: views/user/account.ejs (turbo-frame) - Modified: views/user/server/manage.ejs (Turbo lifecycle teardown) - Modified: views/user/server/file.ejs (Turbo lifecycle teardown) - Modified: 20+ view files (Alnav.load -> Turbo.visit, Alnav.reload -> Turbo.visit) - Modified: scripts/admin-settings.js (window.api() -> Api.admin.settings.*) - Modified: tests/pageLoader.test.ts (removed navigator.js dependency) Note: 4 pre-existing test failures remain (activityLogger, cspHeaders, daemonContract, inputValidation) - unrelated to these changes
…d contains many artifacts and in progress ui and backend not for prod (#137) * fix: rip out frontend frameworks, fix all broken UI interactivity - Remove Turbo, htmx, Alpine.js, Animate, and hand-rolled mini-framework - Delete 22 JS files (al-state, al-action, al-table, al-dialog, islands, data-layer, eventrouting, operations, page-loader, auto-save, htmx-bootstrap, alpine-bootstrap, state, toast-store, query-core, loading-popup, etc.) - Delete layout-animations.css, motion.css, and @Keyframes from tw.css - Remove all x-data, x-show, hx-get, hx-post, data-turbo attributes from all views - Replace Turbo.visit() with window.location.href, htmx.ajax() with fetch - Replace turbo:load listeners with DOMContentLoaded - Fix global modal system (hidden class never toggled on open/close) - Fix tab system (event name mismatch: al:tab-change → al:tabs-change) - Re-add CSRF meta tag to header.ejs (was deleted, breaking all AJAX) - Fix all data-mutation operations to use page reload instead of dynamic DOM updates (20+ locations across 11 files) - Fix d.folder → d.data API response parsing in dashboard - Fix d.error → d.error?.message across 14 files - Fix broken include paths in api/documentation.ejs and admin/databases/databases.ejs - Remove loading-popup includes from 13 files - Fix admin settings script path (/scripts/ → /javascript/admin/) - Remove all al.removeRow, al.patchEl, window.al dead code references - Add al-tabs.js for vanilla tab switching - Fix custom-select.js dead al:navigated listeners - Fix toast.ejs remainingMs self-referencing function * fix: resolve all 6 critical UI bugs from incomplete framework removal Bug #1 — showLoadingPopup was called in 9 files but deleted without updating call sites. Every Save/Create/Update/Delete button threw ReferenceError before the fetch() ever ran. Replaced all showLoadingPopup/updateProgress/hideLoadingPopup calls with the existing showProgressToast() system (27 replacements across addons, servers, nodes, users, account, files, settings). Bug #2 — req.translations (server-only Express object) was used raw in client <script> blocks across 49 files. Every toast dismiss button and most showToast() calls threw ReferenceError at runtime. Added global window.__i18n = <%- JSON.stringify(req.translations || {}) %> in header.ejs before modal/toast includes, then mechanically replaced all 863 req.translations references in client scripts with window.__i18n. Bug #3 — data-tab-src on Images Store tab was dead weight from deleted page-loader.js. Store tab rendered permanently empty. SSR'd store-panel.ejs content inline via <%- include('store-panel') %>. Bug #4 — Removed leftover CSS transition on html/body in header.ejs and auth-header.ejs (background-color 0.25s ease-in, color 0.25s ease-in). Bug #5 — Audited views/fragments/**/*. All req.translations usage is inside <% %> EJS scriptlets (server-rendered), not client scripts. No fixes needed. Bug #6 — Audited all function calls in client <script> blocks for undefined globals. Only showLoadingPopup/hideLoadingPopup were genuinely undefined (already fixed in Bug #1). All other cross-file function calls have definitions in files loaded on the same page. * fix: credits, settings, analytics, store tab, and remaining broken UI - credits.ejs: fixed variable names (camelCase → UPPERCASE to match res.locals) - admin-settings.js: replaced al.addRow/al.removeRow with DOM manipulation - analytics.ejs: added defer to chart.js and admin-analytics.js script tags (was executing before api-client.js defer script loaded → ReferenceError) - images.ejs: added inline store-panel script for #store tab (was empty HTML with no JS — store functions only existed in store.ejs, never loaded) - store.ejs: fixed event name al:tabs-loaded → al:tabs-change (matching what al-tabs.js actually fires) - header.ejs: added missing escape.js script (defines window.escHtml used by search.js and store scripts) - schedules.ejs: replaced al.addRow with DOM append - backups.ejs: replaced al.hideEmpty with comment (dead reference) * fix: more camelCase→UPPERCASE EJS variable mismatches - portsAllocator.ejs: defaultGamePort → DEFAULT_GAME_PORT (caused server create/edit pages to crash) - create-server.ejs: defaultMaxStorageMb → DEFAULT_MAX_STORAGE_MB - credits.ejs: githubAvatarUrl() → GITHUB_AVATAR_URL() - files.ejs: fileUploadTimeoutMs → FILE_UPLOAD_TIMEOUT_MS - players.ejs: crafatarAvatarBase → CRAFATAR_AVATAR_BASE, playerListRefreshMs → PLAYER_LIST_REFRESH_MS * fix: window.__i18n crash, broken delete buttons, settings save, locations 404 ROOT CAUSE: EJS templates use `window.__i18n.X` inside <%%= %> tags (server-side), but `window` doesn't exist in Node.js. Every page crash. - i18n.ts: expose `window.__i18n` in EJS context via res.locals (maps to req.translations proxy so all existing templates work) - admin-settings.js: add null guards for banIpBtn, bannedIpBtn, smtpTestBtn, s3TestBtn — missing element crashed entire init(), killing all auto-save listeners - location-list.ejs: edit link pointed to non-existent /admin/locations/:id/edit (route doesn't exist). Changed to /admin/nodes?location=:id. Delete form used _method=DELETE (no method-override middleware). Converted to fetch() with proper DELETE method. - node-table.ejs: same _method=DELETE fix, converted to fetch() - user-list.ejs: same _method=DELETE fix, converted to call deleteUser() (which already existed in users.ejs using proper fetch) * chore: some i18n fixea * v2.6.0 — rewrite foundation: API-first UI, Lingui i18n, Vite CSS pipeline Replace the broken old UI layer with a clean foundation for the page-by-page rewrite. What changed: - Internal API client (src/handlers/internalApiClient.ts) for page controllers to call v2 endpoints in-process, forwarding session cookies and CSRF tokens. Includes CI lint rule that blocks Prisma or daemon imports in page controllers. - New EJS view structure: layouts (base/admin/user/auth), partials (flash, csrf, pagination, sidebar, UI primitives), auth pages (login/register/2fa/reset), error pages (403/404/500). All forms include CSRF tokens. No HTMX or Alpine dependencies. - CSS split from one 1268-line tw.css into 33 fragment files under views/styles/ (tokens, base, components, pages). All design tokens preserved with exact values. Vite builds to hashed output in public/assets/css/. - Lingui i18n replaces hand-rolled translation system. 10 locales migrated, 2214 English messages. Locale middleware detects from cookie/Accept-Language, injects t() helper for EJS. 43 i18n tests. - Browser JS rebuilt as ES modules under views/javascript/. Shared utilities (theme-init, csrf, api-client) and islands (xterm server console, Monaco file editor) follow mount/init pattern with dynamic imports for heavy deps. - Storage reorganized: themes split into builtin/ and user/, uploads given proper subdirectories, runtime/ reserved. Source media removed from public/. - Old UI archived to /home/thavanish/archive/airlink-panel-rewrite/ (outside repo). Old views/, public/javascript/, public/styles/ removed. - 23 page controller skeletons registered under src/modules/pages/ covering all routes. Ready to fill in during page rewrite. * chore:update desc * Phase 3 complete: page-by-page rewrite + Phase 4 fragment folding - All 12 batches complete: 60 EJS views, 23 page controllers, 33 CSS files, JS islands - Phase 2: deleted legacy API (api/legacy/api.ts), removed pterodactyl references - Phase 4: verified 19/19 archived fragments accounted for, added location-nodes drill-down + 2FA recovery codes - Fixed import paths and permission strings in user/server/index.ts - Zero Prisma/daemon imports in page controllers, all routes call v2 API * chore :add some missing stuff * fix(ui): wire SSR panel end-to-end, harden CSRF, fix overlays - declare cascade layer order (@layer) — sheets/modals stuck open because components beat utilities (.hidden) - rewrite views onto base layout; add file-detail view; fold csrf token into every session POST fetch (no unguarded sends left) - add page routes: startup command/docker-image/variables sub-forms, player actions, files+logs download redirects, create-server nodes/images/limit hints from prisma - align v2 startup DTOs (startCommand|command, verbatim Variables); seed full ServerVariable fixture with allowStartupEdit - drop dead security sub-routes, rename routes onto page controllers - verify: vitest 1058, tsc 0, eslint 0 err, func-test 20/20, sweep 16/105 expected (daemon/404/400), a11y 0 violations * chore(prisma): add shadow database config for migrate workflows migrate dev / migrate diff --from-migrations refuse to run without datasource.shadowDatabaseUrl in Prisma 7. Replay DB: airlink_shadow. Baseline 20260910 adopted via migrate resolve (DB built by db push; schema == migrations == live, diff empty) — status now up to date. * fix(addons): quote Addon identifier in raw SQL probes Unquoted `FROM Addon` folds to `addon`; Prisma creates "Addon", so every probe failed and boot logged a bogus "table does not exist — run migrations" warning even though the table exists. * fix(daemon): sign v2 daemon calls Basic+HMAC, seed key >=16 chars fetchDaemon sent Bearer <key>; daemon verifies Basic Airlink:<key> then HMAC v1 -> every v2 daemon route 401'd. Export buildDaemonHeaders, digest-sign bodies, bodyless GET/HEAD. Seed re-applies node key (daemon enforces 16+ chars), addr, port. * checkpoint * rework: major rework in progress --------- Co-authored-by: bthavanish <bthavanish@gmail.com>
…rectory with 13 updates Bumps the production-dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1127.0` | `3.1141.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1127.0` | `3.1141.0` | | [@lingui/core](https://github.com/lingui/js-lingui/tree/HEAD/packages/core) | `6.7.0` | `6.8.0` | | [@xterm/addon-fit](https://github.com/xtermjs/xterm.js) | `0.10.0` | `0.11.0` | | [@xterm/addon-web-links](https://github.com/xtermjs/xterm.js) | `0.11.0` | `0.12.0` | | [adm-zip](https://github.com/cthackers/adm-zip) | `0.6.0` | `0.6.1` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [cron-parser](https://github.com/harrisiirak/cron-parser) | `5.10.0` | `5.10.1` | | [lucide](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide) | `1.41.0` | `1.48.0` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.56.0` | `0.57.0` | | [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.4.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.5` | Updates `@aws-sdk/client-s3` from 3.1127.0 to 3.1141.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1141.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1127.0 to 3.1141.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1141.0/lib/lib-storage) Updates `@lingui/core` from 6.7.0 to 6.8.0 - [Release notes](https://github.com/lingui/js-lingui/releases) - [Changelog](https://github.com/lingui/js-lingui/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/lingui/js-lingui/commits/v6.8.0/packages/core) Updates `@xterm/addon-fit` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@0.10...0.11) Updates `@xterm/addon-web-links` from 0.11.0 to 0.12.0 - [Release notes](https://github.com/xtermjs/xterm.js/releases) - [Commits](xtermjs/xterm.js@0.11...0.12) Updates `adm-zip` from 0.6.0 to 0.6.1 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.6.0...v0.6.1) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@v1.8.1...v1.8.2) Updates `cron-parser` from 5.10.0 to 5.10.1 - [Release notes](https://github.com/harrisiirak/cron-parser/releases) - [Changelog](https://github.com/harrisiirak/cron-parser/blob/master/CHANGELOG.md) - [Commits](harrisiirak/cron-parser@v5.10.0...v5.10.1) Updates `lucide` from 1.41.0 to 1.48.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide) Updates `monaco-editor` from 0.56.0 to 0.57.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.56.0...v0.57.0) Updates `multer` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.3.0...v2.4.0) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `zod` from 4.5.4 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.5.4...v4.6.5) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1141.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1141.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@lingui/core" dependency-version: 6.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@xterm/addon-fit" dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@xterm/addon-web-links" dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: adm-zip dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: compression dependency-version: 1.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: cron-parser dependency-version: 5.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: lucide dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: monaco-editor dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: multer dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production-dependencies group with 13 updates in the / directory:
3.1127.03.1141.03.1127.03.1141.06.7.06.8.00.10.00.11.00.11.00.12.00.6.00.6.11.8.11.8.25.10.05.10.11.41.01.48.00.56.00.57.02.3.02.4.08.21.38.22.04.5.44.6.5Updates
@aws-sdk/client-s3from 3.1127.0 to 3.1141.0Release notes
Sourced from @aws-sdk/client-s3's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/client-s3's changelog.
... (truncated)
Commits
5bc8d9aPublish v3.1141.06050a38Publish v3.1140.003d54a8Publish v3.1139.0c68e50ePublish v3.1138.09a10476chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...6b43247Publish v3.1137.0d6b94dbPublish v3.1136.02d5f18dPublish v3.1135.00d6310bPublish v3.1134.0615a1caPublish v3.1133.0Updates
@aws-sdk/lib-storagefrom 3.1127.0 to 3.1141.0Release notes
Sourced from @aws-sdk/lib-storage's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/lib-storage's changelog.
... (truncated)
Commits
5bc8d9aPublish v3.1141.06050a38Publish v3.1140.003d54a8Publish v3.1139.0c68e50ePublish v3.1138.09a10476chore(codegen): sync for MetricsRecorder support and core error/retry fixes (...6b43247Publish v3.1137.0d6b94dbPublish v3.1136.02d5f18dPublish v3.1135.00d6310bPublish v3.1134.0615a1caPublish v3.1133.0Updates
@lingui/corefrom 6.7.0 to 6.8.0Release notes
Sourced from @lingui/core's releases.
Changelog
Sourced from @lingui/core's changelog.
Commits
8c0f1bachore(release): published v6.8.0 [skip ci] (#2683)Updates
@xterm/addon-fitfrom 0.10.0 to 0.11.0Commits
ce1d788Bumped bower version to 0.1101e48b7Revamped the attach addona1717fdUpdate docs indexc9f5f23Started documenting methods21dde3cUpdated version, in docs73bf6d1Started documenting eventsUpdates
@xterm/addon-web-linksfrom 0.11.0 to 0.12.0Commits
561fc59Added screenshot for docsUpdates
adm-zipfrom 0.6.0 to 0.6.1Release notes
Sourced from adm-zip's releases.
Commits
cb2cf9bFixed addLocalFolderAsync2 mangling local paths on Windows54902b6Fixed addLocalFolderPromise hanging on empty folders and swallowing errors73131bdFixed CI758898dRejected zip entries whose declared data extent runs past the buffer74b6e9fRouted malformed-header parse errors through the async callbackeaa35faBlocked extraction from writing through symlinks inside the target1e015e3Increment version05101d4Rejected archives with duplicate entry names4916006Enforced the decompression size cap on the async path and for size 06a63c33Stripped setuid/setgid/sticky bits from extracted file permissionsUpdates
compressionfrom 1.8.1 to 1.8.2Release notes
Sourced from compression's releases.
Changelog
Sourced from compression's changelog.
Commits
0f970741.8.2 (#287)151f63efix: destroy compression stream on response close0a76495fix: match Cache-Control no-transform directive case-insensitively (#286)c17b6e5docs: update outdated Brotli note and fix npm install docs URL (#276)112911achore(ci): npm-publish via reusable workflows (#269)1bf5eb0build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)d8fe64dbuild(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)b218ff5build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)8a1cf8ebuild(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)4a19855build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.
Updates
cron-parserfrom 5.10.0 to 5.10.1Release notes
Sourced from cron-parser's releases.
Changelog
Sourced from cron-parser's changelog.
Commits
5b08cdfchore: bump version1d5867cchore: update dev deps95bac55fix: bound field value expansion at parse time (#450)7b3a0adchore: add more funding sources to FUNDING.ymlfc5ca7bchore: add Patreon username for funding support03444a8chore: update dev deps4fd8809fix: reject duplicate zero values in field validation (#445)Updates
lucidefrom 1.41.0 to 1.48.0Release notes
Sourced from lucide's releases.
... (truncated)
Commits
f06ac67chore(typchecking): More typecheck jobs for all packages (#4885)94e4cb9chore(dependencies): Update dependencies (#4806)Updates
monaco-editorfrom 0.56.0 to 0.57.0Release notes
Sourced from monaco-editor's releases.
... (truncated)
Changelog
Sourced from monaco-editor's changelog.