s.esmaeiliandClaude Opus 5.5 1c850216e9 fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05) ...

- production refuses to boot without JWT_SECRET instead of signing
  admin tokens with the published development key
- CORS_ORIGINS restricts browser callers; blank keeps allow-all with a
  production warning so a running deployment is not cut off
- the boot-time seed creates only roles and permissions in production;
  the demo customers, orders, debt and known-password accounts need
  SEED_DEMO_DATA=true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 11:00:45 +03:30

.cursor/rules

Feat add iam auth

2026-09-25 19:04:48 +03:30

.idea

fix add new version of user in app

2026-09-18 17:16:36 +03:30

apps

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

docs

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

henza_admin @ 1b67448143

md app

2026-10-04 20:11:09 +03:30

henza_pwa @ b171ffffb5

md app

2026-10-04 20:11:09 +03:30

henza_server @ 37c7d7a92f

md app

2026-10-04 20:11:09 +03:30

iranSans

SearchView: Removed the dynamic collection-tile grid (e.g. "پرفروش‌های این هفته") and the "نتایج / N محصول" section header from the UI. Underlying data/filtering logic untouched.

2026-09-18 12:54:45 +03:30

packages/shared-types

chore(release): prepare release/delivery + fix docker env passthrough

2026-09-23 00:30:09 +03:30

scripts

md app

2026-10-04 20:11:09 +03:30

user-app-v2

SearchView: Removed the dynamic collection-tile grid (e.g. "پرفروش‌های این هفته") and the "نتایج / N محصول" section header from the UI. Underlying data/filtering logic untouched.

2026-09-18 12:54:45 +03:30

.dockerignore

Fix some for production

2026-09-10 12:17:47 +03:30

.env.example

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

.gitignore

chore: keep the live henza data dump out of git

2026-10-07 19:35:01 +03:30

DELIVERY.md

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

docker-compose.delivery-test.yml

fix(api): treat blank env vars as unset; verify the whole flow in Docker Compose

2026-09-23 02:27:30 +03:30

docker-compose.yml

fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

2026-10-08 11:00:45 +03:30

DOCKER.md

fix add new version of user in app

2026-09-18 17:16:36 +03:30

nginx-spa.conf

Fix db external port

2026-09-09 23:31:31 +03:30

oapi-struncture.sql

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

package.json

fix add new version of user in app

2026-09-18 17:16:36 +03:30

pnpm-lock.yaml

feat(import): henza → gold-bank data import tool

2026-10-07 19:35:18 +03:30

pnpm-workspace.yaml

feat: initial commit

2026-09-09 06:46:27 +03:30

tsconfig.base.json

feat: initial commit

2026-09-09 06:46:27 +03:30

turbo.json

feat: initial commit

2026-09-09 06:46:27 +03:30

S

Description

No description provided

123 MiB

Languages

JavaScript 73.2%

TypeScript 15%

Vue 10.9%

Less 0.4%

PLpgSQL 0.3%

Other 0.1%