3 Releases 3 Tags

RSS Feed

• v1.2.0 0f075626d1

  Compare

  v1.2.0 — Live VPS Source & Operations Sync Stable

  ahmed released this 2026-10-13 18:06:19 +03:00 | 0 commits to main since this release

  Live VPS source reconciliation

  The owner-approved deployed application source is now synchronized with main (57 changed/added files).

  Included

  • Admin-only account creation and protected administrative fields.
  • Code-locked free early access; registration, payments and notification signup remain disabled.
  • Arabic brand «أنور پآي», content terminology, trial banner and policy copy.
  • SEO titles/descriptions and structured-data image fixes.
  • Highest-read homepage section using the real cumulative views counter.
  • Privacy-enhanced click-to-load YouTube player and safe inline article images.
  • Local Readex Pro font and OFL license.
  • Daily backup script, cron definition and source-reconciliation documentation.

  Verified locally

  • 10/10 launch regression tests passed.
  • Payload type generation and TypeScript checks passed.
  • Next.js production build completed successfully.
  • Independent review found no blocking introduced security/logic findings.
  • All 57 file hashes verified from the merged remote main commit.

  Scope and cautions

  No website redeployment/restart, migrations, database changes or media transfer were performed. Env files, credentials, backups and generated build artifacts are excluded. The existing removal of a hardcoded publishing key from repository documentation is retained.

  Dependencies and lockfile match the deployed VPS by owner instruction; this is not a dependency security upgrade. Separate linting and remote CI success are not claimed. Backup archive-list verification does not substitute for an isolated restore drill.

  Merged through PR #7.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.1.0 1ccb031dba

  Compare

  v1.1.0 — Free Early Access Launch + Foundational Specs Stable

  ahmed released this 2026-10-11 06:27:21 +03:00 | 7 commits to main since this release

  First production launch of anwarpy.ai: the free early-access launch (2026-10-10) and the foundational specification layer (2026-10-11).

  2026-10-10 — Free Early Access Launch (PR #3, 57 files, +4042/−402)

  Launch policy & access

  • Server-side LAUNCH_MODE policy (web/src/lib/launch.ts): free_early_access default — every published guide serves its full body, including membership-tier ones; billing routes honestly 503 in Arabic. Intended tier (access) is data, never rewritten.
  • Field-level content ACL in Posts.ts; same decision consumed by pages, public JSON route, download gate, and llms-full.
  • Paywall CRO pre-built for the paid era: H2 preview, fine print, «قريباً» disabled CTAs.

  Signup trust & CRO

  • Verification email at signup (token written at creation), no confirm-password, honest 429 lockout, duplicate-email inline error, email-typo suggestion, live password hint, verify-email + change-email flow.

  Content pipeline hardening

  • Agent API: x-agent-key auth, pickFields strips access/readingMinutes, sourceId dedup, secret scanning 422 (pattern names only), string content → 400.
  • New Posts fields (contentType, authorName, sourceId) + computed honest reading minutes (160 wpm) + backfill (prod: 15/15 updated, old estimates were 3–18× inflated).

  SEO / AI-SEO

  • robots.txt AI policy (10 named crawlers), /llms.txt + /llms-full.txt with full bodies (prod 49 KB), JSON-LD (Article, BreadcrumbList, FAQPage, Organization), topic hubs /topics/*, sitemap hygiene, noindex auth pages, www→apex redirect, real table renderer.

  Ops

  • backup-db.sh + rehearsed restore on the VPS; deployed via rsync + compose; migration 20261010_142214 applied on boot; prod-verified end-to-end (ghost VIP read, honest errors, sitemap, redirects, schema) — evidence in docs/launch/2026-10-10-launch-readiness.md §11.
  • Launch-time bug fixes: Lexical root unwrap (secret scan inert / word counts 0), llms-full missing bodies, agent string-content silent data loss.

  2026-10-11 — Foundational Specs (PR #4)

  • PRD.md: vision («افهم الذكاء الاصطناعي، ثم ابنِ به.»), personas, MVP incl. moderated comments (logged-in free/VIP; anonymous rejected), roadmap phases: legal → Stripe S-01…S-08 + analytics + distribution → mailing list v2, writer DM, in-post tool-finder chatbot. Strict out-of-scope list.
  • ARCHITECTURE.md: pinned stack (Next 15.4.11, Payload 3.60, Postgres 16, TS 5.9), the single access-decision rule, lib boundaries, API surface, deploy topology + Railway-move anticipation.
  • DESIGN_SYSTEM.md: ink/basalt/champagne tokens, Readex Pro, RTL + LTR islands, component inventory, a11y floor.
  • DATABASE.md: Payload-first schema (7 collections), relationships, indexing, backup rules.
  • SECURITY.md: auth via viewer.ts seam (Google/Clerk anticipated), RBAC, pipeline hardening, env handling, leak-rotation policy.
  • CODE_STYLE.md: strict TS + generated types, honest-error conventions (400/409/422/503), Gitea workflow.
  • TESTING.md: Vitest tier now (libs + route regressions, incl. the Lexical root-unwrap regression); Playwright tier at Stripe launch.
  • AGENTS.md: gstack digest + appended operational rulebook (allowed/ask-first/never, deploy recipe, prod DB tunnel pattern).

  Owner actions outstanding

  • Enable Cloudflare Email Sending (prod mail honestly 503s until then — 10203 email.sending_disabled).
  • L-03 legal facts for /terms + /privacy; L-11 analytics vendor; L-12 editorial distribution.
  • Rotate prod DB_PASSWORD (8 chars leaked in a session transcript 2026-10-10).
  • Safari/Telegram in-app QA (manual).

  Paid launch remains gated on S-01…S-08 — flip via LAUNCH_MODE policy only, never a DB rewrite of access.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v1.0.0 e69e419721

  Compare

  v1.0.0 — Security hardening (pentest response) Stable

  ahmed released this 2026-10-09 17:01:26 +03:00 | 14 commits to main since this release

  Security response to the anwarpy.ai pentest report (2026-10-09). No site flow/UX changes.

  Fixed

  F1 — Single-box DoS froze pages (High)

  Traefik edge caps on the page router (web/docker-compose.vps.yml):

  • pagelimit: 60 req/min average, burst 120 per IP
  • connlimit: 50 in-flight requests per IP
  • apilimit (API router) untouched

  Verified: 200-request flood at concurrency 20 → 127×200, 73×429, zero timeouts, zero 5xx; immediate recovery 200 in 0.69s.

  F2 — Unlimited anonymous signup/login (Medium)

  New web/src/middleware.ts — per-IP in-memory rate limits:

  • POST /api/users (signup): 5/hour
  • POST /api/users/login: 10/15min
  • POST /api/users/forgot-password: 5/hour

  Over limit → 429 JSON محاولات كثيرة جدًا. حاول بعد قليل. + Retry-After. Auth pages already fall back to a generic error on non-ok responses — no UI change. In-memory buckets are correct for the single-container deployment (file comment notes a shared store is needed if scaling horizontally).

  Verified: local signup 5×201 → 6th 429; login 10×401 → 11th 429; prod signup 5×201 → 6th 429.

  F4 — No HSTS (Low)

  Strict-Transport-Security: max-age=63072000; includeSubDomains on all routes (pages, static assets, /api) via web/next.config.mjs. No preload flag (not submitted to the preload list).

  Verified: header present in prod on / and an /api path.

  F7 — Login-timing user enumeration (Low)

  web/src/collections/Users.ts: when no user matches the login email, a dummy PBKDF2 (600000 iterations / 32 bytes / sha256 — identical cost to Payload's real verify) runs before the standard invalid-credentials error, closing the response-time enumeration vector. Admin-unlock branch unchanged.

  Verified: wrong-password login real email ≈107ms vs ghost ≈86ms (Δ ≈ 21ms, was ~300ms); raw pbkdf2@600k = 47ms confirms the dummy hash executes.

  Housekeeping

  • Pentester throwaway accounts deleted from prod DB (ids 42–48: kali.recon999@…, token.probe@…, 5× rl*@recon.example) — verified count 0.

  Verified, no change needed

  • F3 client-writable verificationToken: existing beforeChange untrusted branch already strips it — proven on the new build (response contains no token; role forced free; emailVerified forced false; stripeCustomerId null).
  • F5 CUPS port 631: owner decision — leave open.
  • F6 Stripe webhook: correct pending behavior (503 until configured; stripe-signature verified once keys are set).
  • F8 /api/media readable: required for anonymous <img> cover rendering.
  • F9 /admin: auth-gated, robots-disallowed.

  Deployment

  • Merged via PR #1; deployed to the VPS with docker compose -f docker-compose.vps.yml up -d --build.
  • Flow regression in prod: /, /articles, post page, /api/posts/first-arabic-agent all 200; temp-user login 200 + /api/users/me 200; all test rows deleted from dev and prod DBs.
  • Auth hashing remains PBKDF2-SHA256 600k iterations (Payload 3.90 + Postgres behind Traefik).

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)