5 commits

Author	SHA1	Message	Date
Martin Porwoll	1f62563922	fix: clear console mocks between tests in data-masking spec ... The test was failing because mock.calls[0] was getting calls from the previous test. Added mockClear() in beforeEach to ensure each test starts with fresh mock state. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-15 10:45:19 +00:00
Martin Porwoll	47d4825f77	revert: downgrade to Next.js 15.5.9 for Payload compatibility ... Payload CMS 3.68.4 doesn't officially support Next.js 16 yet. Reverting to 15.5.9 restores full compatibility. Changes: - Revert next: 16.0.10 → 15.5.9 - Revert eslint-config-next: 16.0.10 → 15.5.9 - Revert proxy.ts → middleware.ts (Next.js 15 convention) - Restore eslint config in next.config.mjs - Remove turbopack config (not needed for Next.js 15) Test fixes (TypeScript errors): - Fix MockPayloadRequest interface (remove PayloadRequest extension) - Add Where type imports to access control tests - Fix headers type casting in rate-limiter tests - Fix localization type guard in i18n tests - Add type property to post creation in search tests - Fix nodemailer mock typing in email tests 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-15 10:07:39 +00:00
Martin Porwoll	da735cab46	feat: add Products and ProductCategories collections with CI/CD pipeline ... - Add Products collection with comprehensive fields (pricing, inventory, SEO, CTA) - Add ProductCategories collection with hierarchical structure - Implement CI/CD pipeline with GitHub Actions (lint, typecheck, test, build, e2e) - Add access control test utilities and unit tests - Fix Posts API to include category field for backwards compatibility - Update ESLint config with ignores for migrations and admin components - Add centralized access control functions in src/lib/access - Add db-direct.sh utility script for database access 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-12-12 21:36:26 +00:00
Martin Porwoll	6ccb50c5f4	docs: consolidate and update documentation ... - Remove obsolete instruction documents (PROMPT_*.md, SECURITY_FIXES.md) - Update CLAUDE.md with security features, test suite, audit logs - Merge Techstack_Dokumentation into INFRASTRUCTURE.md - Update SECURITY.md with custom login route documentation - Add changelog to TODO.md - Update email service and data masking for SMTP error handling - Extend test coverage for CSRF and data masking 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-12-09 09:25:00 +00:00
Martin Porwoll	0cdc25c4f0	feat: comprehensive security test suite ... Add 143 security tests covering all security modules: Unit Tests (125 tests): - rate-limiter.unit.spec.ts: limiter creation, request tracking, blocking, window reset, IP extraction, header generation - csrf.unit.spec.ts: token generation/validation, origin checking, double submit cookie pattern, referer validation - ip-allowlist.unit.spec.ts: CIDR matching, wildcards, endpoint- specific allowlist/blocklist rules, IP extraction - data-masking.unit.spec.ts: field detection, pattern matching, recursive masking, JWT/connection string/private key handling API Integration Tests (18 tests): - security-api.int.spec.ts: rate limiting responses, IP blocking, CSRF protection on state-changing endpoints Test Infrastructure: - tests/helpers/security-test-utils.ts: CSRF token generators, mock request builders, environment setup utilities - vitest.config.mts: updated to include unit tests - package.json: added test:unit and test:security scripts - .github/workflows/security.yml: added security-tests CI job Also updated detect-secrets.sh to ignore .spec.ts and .test.ts files which may contain example secrets for testing purposes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-12-08 00:20:47 +00:00