8 Commits

Author	SHA1	Message	Date
Fringg	a744b41910	fix: harden OAuth login flow — open redirect, path traversal, info leak ... - Validate authorize_url is HTTPS before redirect (open redirect prevention) - encodeURIComponent on provider name in API URL paths (path traversal prevention) - encodeURIComponent on referralCode in t.me deep link - Gate console.warn behind import.meta.env.DEV (no info leak in prod)	2026-02-11 02:58:04 +03:00
Fringg	83aeae81b8	feat: add OAuth 2.0 login UI (Google, Yandex, Discord, VK) ... - Add OAuthProvider type and extend User.auth_type union - Add OAuth API methods (providers, authorize, callback) - Add loginWithOAuth to auth store - Create OAuthCallback page with state validation - Create OAuthProviderIcon component with brand SVGs - Add OAuth buttons to Login page between Telegram and Email - Add OAuth callback route to App.tsx - Add translations for ru, en, zh, fa	2026-02-07 01:59:05 +03:00
Egor	2f1083d005	Update auth.ts	2026-01-30 15:52:51 +03:00
c0mrade	bc90ba3779	refactor: migrate to eslint flat config and format codebase with prettier ... - Remove legacy .eslintrc.cjs and .eslintignore - Add eslint.config.js with flat config, security rules (no-eval, no-implied-eval, no-new-func, no-script-url) - Add .prettierrc and .prettierignore - Format entire codebase with prettier	2026-01-27 17:37:31 +03:00
Egor	cb1476f808	Update auth.ts	2026-01-25 09:25:27 +03:00
Egor	9688fc5581	Update auth.ts	2026-01-25 08:46:14 +03:00
Egor	3a5034cb1e	Add files via upload	2026-01-23 11:34:14 +03:00
Egor	7be6b5c0ae	Add files via upload	2026-01-15 19:18:17 +03:00