controlPanel/api
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
126 Commits 2 Branches 0 Tags
70ebd7dabbb2f3abcbb08521b32a73ac82dee52b
Commit Graph
17 Commits
Author SHA1 Message Date
MahdiandCursor 9b11617eab feat: Excel export of all projects for full-access admins 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-10-27 20:44:29 +03:30
MahdiandCursor 30dc83890b feat: granular hamkar/khanegi permissions (manage / settings / appearance) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-10-07 20:48:32 +03:30
MahdiandCursor 674da4e939 feat: add 'other' product type for miscellaneous sites (tracking only, no remote control) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-10-07 16:52:23 +03:30
mohmdsdg a78636d32e fix super admin 2026-09-10 10:04:55 +03:30
mohmdsdgandCursor bcf4724ac4 fix plugin store remote: find tenant by admin URL and allow purchase 
HMAC k.montzar.ir matches the version that uses that admin panel. Remote buy is no longer blocked by plugin_store_enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-09 22:17:44 +03:30
mohmdsdgandCursor 38337c62d7 test: build HMAC tenant fixtures from domain, drop product URLs 
HMAC identity tests should not hardcode gholak/montzar hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-09 22:12:21 +03:30
mohmdsdgandCursor 82e74f86f0 fix remote HMAC: match tenant domain only, not shared adminUrl 
k.montzar.ir on Gholaktala adminUrl was selecting tenant app.gholaktala.ir. HMAC now uses primary domain (and its subdomain), not admin/app/node URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-09 22:07:40 +03:30
mohmdsdgandCursor 3f0dfe448c fix remote HMAC: identify tenant by domain, not shared nodeServer 
new.gholaktala.ir is the API host of many versions. Prefer subdomain of the product domain and refuse ambiguous nodeServer ties. 403 names the matched tenant.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-09 21:53:11 +03:30
mohmdsdg 502b0c8b24 fix pluggin bug 3 2026-09-09 20:57:14 +03:30
mohmdsdgandCursor 94d79c175b fix(plugins): match remote HMAC tenants with the same host rules as get_user 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-08 10:50:40 +03:30
mohmdsdgandCursor 2d43ce6c29 Prefer exact tenant domain over shared nodeServer for remote HMAC auth. 
Stops demo and shop rows that share one API URL from colliding, and skips phone-like adminUrl values when resolving X-Abshode-Domain.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-07 22:47:42 +03:30
mohmdsdgandCursor dd212d01ed fix(plugins): resolve remote tenant from admin and app URLs 
HMAC only matched tenant.domain, so k.montzar.ir / new.gholaktala.ir missed the row. Also return an empty store when catalog tables are missing.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-07 21:54:03 +03:30
MahdiandCursor af1e217a68 feat(auth): add module read/write admin RBAC 
Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-08-10 15:29:04 +03:30
MahdiandCursor 57654e295c Add shared HMAC+domain auth for remote SMS wallet API. 
Products can authenticate with one shared secret and tenant domain instead of per-version tokens; Bearer token remains as fallback.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-08-05 17:11:55 +03:30
Mahdi 14d9c5d143 Implementing SMS panel in Super Admin 2026-08-05 14:13:44 +03:30
MahdiandCursor a6b3457779 Add production-ready SuperAdmin API features for tenants, SMS, servers, and plugins. 
Includes mobile auth, get_user/get_version, SMS wallet parity endpoints, appearance backfill, and related Prisma migrations.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-30 18:19:53 +03:30
SuperAdmin 7fbc47766c Initial SuperAdmin API (NestJS + Prisma) 2026-07-23 10:25:32 +03:30