c3db6bfa2b
- .env.example: vider les secrets (à rotater côté Plesk)
- src/lib/auth.ts: fail-fast lazy si ADMIN_JWT_SECRET < 32 chars
- src/pages/api/upload.ts: retirer .svg (anti-XSS) + try/catch FS
- src/pages/api/content/[section].ts: masquer err.message (sauf ZodError)
- retirer gsap/three/@types/three/@react-three/{fiber,drei}/lucide-react
- bump astro 6.1.10 (GHSA-xr5h-phrj-8vxv)
- zod 4: z.email()/z.url() au lieu de .email()/.url()
- nettoyer vars inutilisées + Header script is:inline
Vitest (38 tests, 615ms):
- tests/lib/auth.test.ts: verifyPassword + verifySession (round-trip, secrets distincts)
- tests/lib/content.test.ts: load/save + comportement seed
- tests/api/files.test.ts: path traversal (../, /, imbriqué) + 200
- tests/api/upload.test.ts: extension/taille/sanitize folder + bucket
- tests/middleware.test.ts: gating admin pages vs APIs vs routes publiques
- astro check: 0 errors / 0 warnings / 0 hints
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
36 lines
394 B
Plaintext
36 lines
394 B
Plaintext
# build output
|
|
dist/
|
|
.astro/
|
|
|
|
# deps
|
|
node_modules/
|
|
|
|
# env
|
|
.env
|
|
.env.production
|
|
.env.local
|
|
|
|
# logs
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
pnpm-debug.log*
|
|
|
|
# editors
|
|
.vscode/*
|
|
!.vscode/extensions.json
|
|
.idea/
|
|
|
|
# macOS
|
|
.DS_Store
|
|
|
|
# temp
|
|
*.log
|
|
|
|
# runtime data (uploads + JSON content edited via /admin)
|
|
# kept on the server, not deployed via FTP
|
|
data/
|
|
|
|
# test artifacts (coverage)
|
|
coverage/
|