Merge pull request #26 from Supernova3339/1.0.6

Author: Supernova3339

.claude/settings.local.json

@@ -3,7 +3,26 @@
     "allow": [
       "Bash(npm run build:*)",
       "mcp__next-devtools__init",
-      "mcp__next-devtools__browser_eval"
+      "mcp__next-devtools__browser_eval",
+      "WebFetch(domain:api.slack.com)",
+      "Bash(cat:*)",
+      "Bash(find . -type f \\\\\\( -name \"*.test.ts\" -o -name \"*.test.tsx\" -o -name \"*.spec.ts\" -o -name \"*.spec.tsx\" \\\\\\) 2>/dev/null | head -20)",
+      "Bash(for file in app/api/check-setup/route.ts app/api/config/timezone/route.ts app/api/avatar/[hash]/route.ts app/api/integrations/widget/[projectId]/route.ts)",
+      "Bash(do echo \"=== $file ===\")",
+      "Read(//c/Users/Nova/WebstormProjects/changerawr/**)",
+      "Bash(done)",
+      "Bash(grep -n \"smtpPassword\" /c/Users/Nova/WebstormProjects/changerawr/app/api/projects/[projectId]/integrations/email/route.ts | head -10)",
+      "Bash(grep -n \"smtpPassword\\\\|clientSecret\" /c/Users/Nova/WebstormProjects/changerawr/app/api/projects/[projectId]/integrations/email/test/route.ts | head -5)",
+      "Bash(grep -B 5 -A 10 \"return NextResponse.json\\(safeConfig\\)\" /c/Users/Nova/WebstormProjects/changerawr/app/api/projects/[projectId]/integrations/email/route.ts)",
+      "Bash(grep -n \"return NextResponse.json\" /c/Users/Nova/WebstormProjects/changerawr/app/api/projects/[projectId]/integrations/email/route.ts | head -10)",
+      "Bash(wc -l /c/Users/Nova/WebstormProjects/changerawr/app/api/projects/[projectId]/changelog/[entryId]/route.ts)",
+      "Bash(cd \"C:/Users/Nova/WebstormProjects/changerawr\" && npx tsc --noEmit 2>&1 | head -60)",
+      "Bash(cd \"C:/Users/Nova/WebstormProjects/changerawr\" && npx tsc --noEmit 2>&1 | grep -v \"allowedEmailDomains\\\\|blockExistingUsers\\\\|requiredClaims\" | head -40)",
+      "Bash(ls -la \"C:\\\\Users\\\\Nova\\\\WebstormProjects\\\\changerawr\\\\app\\\\api\\\\projects\\\\[projectId]\\\\integrations\\\\email\\\\\" 2>/dev/null | head -20)",
+      "Read(//c/Users/Nova/WebstormProjects/nginx-agent/**)",
+      "Bash(npx tsc --noEmit 2>&1 | grep -v \"allowedEmailDomains\\\\|blockExistingUsers\\\\|requiredClaims\\\\|allowAutoPublish\\\\|requireApproval\" | head -20)",
+      "Bash(cd \"C:/Users/Nova/WebstormProjects/nginx-agent\" && npx tsc --noEmit 2>&1 | head -20)",
+      "Bash(cd \"C:/Users/Nova/WebstormProjects/nginx-agent\" && node_modules/.bin/tsc --noEmit 2>&1 | head -20)"
     ],
     "deny": [],
     "ask": []

.dockerignore

@@ -18,4 +18,9 @@ dist
 .turbo
 public/swagger.json
 public/widget-bundle.js
-public/widget-bundle.js.map
+public/widget-bundle.js.map
+useful-information-for-development
+APIDOCGUIDE.md
+CHANGELOG.md
+docker-compose-online.yml
+docker-compose.yml

.env.example

@@ -1,25 +1,124 @@
-# Environment variables declared in this file are automatically made available to Prisma.
-# See the documentation for more detail: https://pris.ly/d/prisma-schema#accessing-environment-variables-from-the-schema
+# ============================================================================
+# Changerawr Environment Configuration
+# ============================================================================
+# Copy to .env.local and fill in your values
+# Generate secrets: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# ============================================================================
 
-# Prisma supports the native connection string format for PostgreSQL, MySQL, SQLite, SQL Server, MongoDB and CockroachDB.
-# See the documentation for all the connection string options: https://pris.ly/d/connection-strings
+# ============================================================================
+# REQUIRED
+# ============================================================================
 
+# Database (PostgreSQL)
 DATABASE_URL="postgresql://postgres@localhost:5432/changerawr?schema=public"
+
+# JWT secret for tokens
 JWT_ACCESS_SECRET=""
+
+# Public URL (http://localhost:3000 or https://your-domain.com)
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
-GITHUB_ENCRYPTION_KEY="" #  node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-# EASYPANEL_PROJECT_ID used for automatic updates if using Easypanel
-# EASYPANEL_SERVICE_ID used for automatic updates if using Easypanel
-# EASYPANEL_PANEL_URL
-# EASYPANEL_API_KEY
-CHR_EPOA2_SERV_URL=""# oauth2 server URL ( no "/" )
-CHR_EPOA2_SERV_API_KEY="" # oauth2 server API key
-ANALYTICS_SALT=your-secure-random-salt-here
 
-ENABLE_JOB_RUNNER # on development, this must be true if you want to work with scheduled jobs.
+# Analytics salt
+ANALYTICS_SALT="your-secure-random-salt-here"
+
+# ============================================================================
+# Feature Flags
+# ============================================================================
+
+# Set to false after setup wizard completes
+SETUP_COMPLETE=false
+
+# Job runner (true in dev if testing scheduled jobs)
+ENABLE_JOB_RUNNER=false
+
+# Markdown editor toolbar
+NEXT_PUBLIC_ENABLE_CUM=true
+
+# Dev tooling
+NEXT_PUBLIC_SHOW_WWC_TOOLING=false
+
+# Debug telemetry (leave off)
+# SHOW_TELEMETRY_LOGS=false
+
+# ============================================================================
+# Security
+# ============================================================================
+
+# Cookie settings (false for localhost, true for HTTPS)
+COOKIE_SECURE=true
+
+# Comma-separated domains for cookie control
+# COOKIE_SECURE_DOMAINS="example.com,localhost"
+
+# Extra allowed domains beyond defaults
+# (cloudflareinsights.com, cdnjs.cloudflare.com, unpkg.com, cdn.jsdelivr.net, fonts.googleapis.com, fonts.gstatic.com)
+ALLOWED_EXTERNAL_DOMAINS=""
+
+# ============================================================================
+# GitHub Integration ( required )
+# ============================================================================
+
+GITHUB_ENCRYPTION_KEY=""
+
+# ============================================================================
+# Easypanel (if using)
+# ============================================================================
+
+# EASYPANEL_PROJECT_ID=""
+# EASYPANEL_SERVICE_ID=""
+# EASYPANEL_PANEL_URL=""
+# EASYPANEL_API_KEY=""
+
+# ============================================================================
+# OAuth2 Server (if using external auth)
+# ============================================================================
+
+CHR_EPOA2_SERV_URL=""
+CHR_EPOA2_SERV_API_KEY=""
+
+# ============================================================================
+# SSL Certificates (Let's Encrypt)
+# ============================================================================
+# Requires nginx-agent: github.com/changerawr/nginx-agent (if using docker this will auto-install!)
+# ============================================================================
+
+# Show SSL UI in dashboard
+NEXT_PUBLIC_SSL_ENABLED=false
+
+# Let's Encrypt email
+ACME_EMAIL="admin@example.com"
+
+# Use staging (true = test certs, false = production)
+# Staging certs work but aren't browser-trusted. Good for testing.
+ACME_STAGING=true
+
+# Legacy (same as ACME_STAGING)
+ACME_SANDBOX_MODE=false
+
+# ============================================================================
+# nginx-agent (required if SSL enabled)
+# ============================================================================
+# These MUST match your nginx-agent config
+# ============================================================================
+
+NGINX_AGENT_URL="http://localhost:7842"
+
+# Webhook signing (must match AGENT_SECRET in nginx-agent)
+NGINX_AGENT_SECRET=""
+
+# API auth (must match INTERNAL_API_SECRET in nginx-agent)
+INTERNAL_API_SECRET=""
+
+# Certificate encryption
+# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+ENCRYPTION_KEY=""
 
-NEXT_PUBLIC_ENABLE_CUM # set this to false to disable the Changerawr Universal Markdown engine in the editor. It will still render elements, you just will not have the built-in toolset of CUM.
+# ============================================================================
+# SSL Auto-Renewal
+# ============================================================================
 
-NEXT_PUBLIC_SHOW_WWC_TOOLING # set this to true to enable all tooling
+# Days before expiry to renew (default: 30)
+SSL_RENEWAL_THRESHOLD_DAYS=30
 
-SHOW_TELEMETRY_LOGS # set this to true if debugging telemetry, used internally so do not touch this unless you absolutely know what you are doing
+# Max certs per cron run (default: 10)
+SSL_RENEWAL_BATCH_SIZE=10

.gitignore

@@ -65,3 +65,13 @@ next-env.d.ts
 # sensitive changerawr shenanigans
 .changerawr
 .changerawr/donotdeletethisfolder/donotdeletethisfile.chrcli.json
+nul
+null
+.chtsredevmscli
+.claude
+
+# sponsorer server
+/sponsor-server
+
+# user requests to add
+CLAUDE.md

.idea/db-forest-config.xml

@@ -1,9 +1,38 @@
-<!-- Generated by Changerawr CLI on 2025-11-14T05:45:33.110Z -->
+<!-- Generated by Changerawr CLI on 2026-04-16T07:21:32.297Z -->
 # Changelog
 
 All notable changes to this project will be documented in this file.
 
-## 1.0.5
+## v1.0.6
+
+- **Version 1.0.6 - 2026-04-16**: :::warning
+There are security vulnerabilities in previous releases, it is recommended to upgrade as soon as possible to this one. There are also a breaking change, set `SETUP_COMPLETE=true` in your .env file as this is how to complete the setup wizard now. I strongly recommend re-rolling all API keys.
+:::
+
+## Features
+- **Slack Integration** - You can now automatically post published entries to your Slack!
+- **Timezones** - Added timezone support per-user and globally, allowing for much more efficient collaboration between users with different time zones!
+- **SAML** - Adds support for SAML to SSO, adding a new method available for configuring single-sign-on.
+- *SSL Certificates for custom domains** - You can now get SSL certificates for custom domains! Just follow the nginx-sidecar documentation to get set up.
+- **IP Whitelisting** - You can now whitelist IP addresses to access the main panel. Note that this requires the nginx-sidecar to be set up.
+- **Version Templates** - Configure custom version format templates
+
+## Improvements
+- **Extended Project Limits ** - Project limits have been extended for entries. If you wish to go beyond, please sponsor my work.
+- **UI Improvements** - Did various UI improvements to the administrative interface & fully redesigned the version picker
+- **Update Bar** - Whenever an update is available, you'll be much more likely to know thanks to the new pop-up.
+
+## Bug Fixes
+- **Redirect Loop** - fixed issues with an infinite redirect loop after setup
+- **Strict Validation Local Domain** - Fixed issues with any domain being blocked for requests, preventing e.g., cloudflareinsghts from working, which subsequently blocked the panel from loading alltogether itself.
+- **System user show-up in admin dashboard** - Fixed an issue where the system user used for audit logs was being counted as a user in the total user count.
+
+## Other
+- **Security Vulnerability patches** - A few vulnerabilities were disclosed to me, these have been patched in this release.
+- **Dependency Updates** - Updated to the latest dependencies, Nodemailer 8, and changerawr universal markdown 1.2.0!
+
+
+## v1.0.5
 
 - **Version 1.0.5 - 2025-11-13**: :::warning
 There are breaking changes in this release.
@@ -45,25 +74,26 @@ If you are using widgets at all, you will have to recreate them. If you are not
 
 ## 1.0.4
 
-- **Version 1.0.4 - 2025-08-06**: :::warning
+- **Version 1.0.4 - 2025-?-?**: :::warning
 There are no breaking changes in this release.
 :::
 
-**Features**
-
+### Features
 - **Data Importing** - You can now import data from various sources to jump-start your Changerawr project!
-- **CUM** - Changerawr Universal Markdown engine introduces more functionality for the content editor. As of writing, Embeds, Buttons, and Alerts are available! \
-  Provides a better experience overall, improving the parsing engine, adding tokenization, and improving overall usability!
-
-
-**Improvements**
+- **CUM** - Changerawr Universal Markdown engine introduces more functionality for the content editor.As of writing, Embeds, Buttons, and Alerts are available! 
+Provides a better experience overall, improving the parsing engine, adding tokenization, and improving overall usability!
 
+### Improvements
 - **Redesigned Projects Dashboard** - Updated the dashboard at (/dashboard/projects/projectId) to be less cluttered and more professional.
 - **Updated Projects Fetch Pagination** - Updated the default fetch for projects to 50 entries when listing.
 - **Redesigned Main Dashboard** - Redesigned the dashboard at (/dashboard), it needed a facelift and has been the same since 0.3.0 :(
 - **Content Editor Upgrades** - Introduces the CUM ( Changerawr Universal Markdown ) rendering engine for a better changelog experience.
 - **Improved Modal UI** - Added depth and optical borders to the modal UI. Also adds a "disableClose" prop for the rare case in which Changerawr is doing something and needs to let you know of its progress.
 
+hello world!
+
+
+
 ## 1.0.3
 
 - **Version 1.0.3 - 2025-07-02**: **Features**
@@ -135,37 +165,37 @@ You can find the source code at <https://github.com/changerawr/cli> - would supe
 
 - **Redesigned Components** - Redesigned some components
 
-## 0.3.8
+## 0.3.9
 
-- **Version 0.3.8 - 2025-06-10**: **Features**
+- **Version 0.3.9 - 2025-06-10**: **Features**
 
-- **Invite Your Team!** - You can now invite your team early in the initial setup wizard, rawrsome!
+- **Code Analyzation for GitHub Integration** - Changerawr can now look at your changed code and write a better changelog!
 
 
 **Bug Fixes**
 
-- **Changelog Editor Fixes** - Fixed the version picker which would let you select versions already used, leading to issues. It will now check for overlapping before allowing you to set a version for your changelog.
+- **Account Deletion Fix** - Fixed an issue that prevented administrators from deleting a user's account. This process will anonymize all their data and actions while preserving their contributions.
 
 
 **Improvements**
 
-- **Component Redesigns** - Redesigned the Version picker and Editor header
+- **Redesigned the New Project page** - Gave a much-needed facelift to the new project page so it feels more roomy. Has confetti now, success messages, and more excitement!
 
-## 0.3.9
+## 0.3.8
 
-- **Version 0.3.9 - 2025-06-10**: **Features**
+- **Version 0.3.8 - 2025-06-10**: **Features**
 
-- **Code Analyzation for GitHub Integration** - Changerawr can now look at your changed code and write a better changelog!
+- **Invite Your Team!** - You can now invite your team early in the initial setup wizard, rawrsome!
 
 
 **Bug Fixes**
 
-- **Account Deletion Fix** - Fixed an issue that prevented administrators from deleting a user's account. This process will anonymize all their data and actions while preserving their contributions.
+- **Changelog Editor Fixes** - Fixed the version picker which would let you select versions already used, leading to issues. It will now check for overlapping before allowing you to set a version for your changelog.
 
 
 **Improvements**
 
-- **Redesigned the New Project page** - Gave a much-needed facelift to the new project page so it feels more roomy. Has confetti now, success messages, and more excitement!
+- **Component Redesigns** - Redesigned the Version picker and Editor header
 
 ## 0.3.7
 
@@ -199,7 +229,7 @@ You can find the source code at <https://github.com/changerawr/cli> - would supe
 
 **Other**
 
-- **Routine Maintence** - Package Updates and Bug Fixes have been triaged successfully with this release.
+- **Routine Maintenance** - Package Updates and Bug Fixes have been triaged successfully with this release.
 
 ## 0.3.4
 
@@ -225,27 +255,27 @@ You can find the source code at <https://github.com/changerawr/cli> - would supe
 
 - **Better AI Assistant Design** - Redesigned AI Assistant
 
-## 0.3.2
+## 0.3.1
 
-- **Version 0.3.2 - 2025-05-12**: **Features**
+- **Version 0.3.1 - 2025-05-12**: **Features**
 
-- **'What's New' Modal Available on the About Page** - The "What's New" modal is now accessible from the About page.
+- **New Feature** - Added "What's New" model to inform of latest changes from the most recent Changerawr update
 
 
-**Improvements**
+**Bug Fixes**
 
-- **Redesigns** - Redesigned "What's New" modal.
+- **Bug Fixes** - Fixed a few bugs with tokenization and the AI assistant
 
-## 0.3.1
+## 0.3.2
 
-- **Version 0.3.1 - 2025-05-12**: **Features**
+- **Version 0.3.2 - 2025-05-12**: **Features**
 
-- **New Feature** - Added "What's New" model to inform of latest changes from the most recent Changerawr update
+- **'What's New' Modal Available on the About Page** - The "What's New" modal is now accessible from the About page.
 
 
-**Bug Fixes**
+**Improvements**
 
-- **Bug Fixes** - Fixed a few bugs with tokenization and the AI assistant
+- **Redesigns** - Redesigned "What's New" modal.
 
 ## 0.3.0