diya/SS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial SMM panel implementation

Browse Source
This commit is contained in:
diyaa
2026-08-13 19:05:47 +02:00
commit 7717a674c7
64 changed files with 8626 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+14
View File
@@ -0,0 +1,14 @@
# Security Checklist
- Passwords are hashed with `bcryptjs` before storage.
- Provider API credentials are read only from environment variables and are never returned by public APIs.
- Money columns use SQL `DECIMAL`; JavaScript money math uses fixed-scale `BigInt` helpers in `src/utils/money.js`.
- Request bodies are validated server-side with `zod`.
- SQL access goes through Knex query builders and transactions.
- Auth, password reset, deposit creation, and order creation have rate limiting.
- Every `/admin/*` route is protected by `auth`, `requireActive`, and `admin` middleware.
- Admin self-ban and last-active-admin lockout are rejected.
- Order prices are calculated on the server from `services.sell_price`; client-submitted prices are ignored.
- Production environment validation rejects missing or placeholder provider/JWT settings and requires `CORS_ORIGIN`.
- Production CORS allows only configured site origins.
- Wallet balance updates are centralized in `wallet.service.js` and covered by race-condition tests.