David Dyer
242c5165e1
- Added role-based access control for user management links in admin navigation. - Improved user account display with a dedicated account link. - Implemented form submission confirmation for delete actions in the admin interface. - Introduced a password visibility toggle on the login page. - Added login throttling to prevent brute-force attacks, recording failed attempts. - Created a CLI script for creating an admin user, replacing the previous hardcoded admin credentials. - Updated database schema to support login attempt tracking. - Enhanced user editing functionality, allowing role changes with restrictions. - Improved modal handling for user actions, ensuring better focus management. - Added styles for new account management page and improved modal transitions.
82 lines
2.3 KiB
JavaScript
82 lines
2.3 KiB
JavaScript
#!/usr/bin/env node
|
|
'use strict';
|
|
|
|
/**
|
|
* Assembles a clean, production-only copy of the site into dist/.
|
|
*
|
|
* This is an allowlist by design: only the files and folders listed below
|
|
* are copied. Dev-only stuff (node_modules/, src/, package*.json, .git/,
|
|
* .claude/, docker-compose.yaml, dev.sh, .hintrc, config.example.php, the
|
|
* live db/fitz.sqlite, ...) never ends up in dist/ — including anything
|
|
* added later, since it has to be added here explicitly first.
|
|
*
|
|
* Run with: npm run dist
|
|
*/
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const ROOT = path.resolve(__dirname, '..');
|
|
const DIST = path.join(ROOT, 'dist');
|
|
|
|
const FILES = [
|
|
'index.php',
|
|
'menu.php',
|
|
'main.js',
|
|
'styles.css',
|
|
'robots.txt',
|
|
'config.php', // holds the live FB_PAGE_ACCESS_TOKEN — see README before sharing dist/ anywhere but the server
|
|
];
|
|
|
|
const DIRS = ['admin', 'assets', 'bin', 'inc'];
|
|
|
|
function copyDir(src, dest) {
|
|
fs.cpSync(src, dest, {
|
|
recursive: true,
|
|
filter: (source) => path.basename(source) !== '.DS_Store',
|
|
});
|
|
}
|
|
|
|
// Fresh start every run so a file removed from the source tree doesn't
|
|
// linger in dist/ from a previous build.
|
|
fs.rmSync(DIST, { recursive: true, force: true });
|
|
fs.mkdirSync(DIST, { recursive: true });
|
|
|
|
const missing = [];
|
|
|
|
for (const file of FILES) {
|
|
const src = path.join(ROOT, file);
|
|
if (!fs.existsSync(src)) {
|
|
missing.push(file);
|
|
continue;
|
|
}
|
|
fs.copyFileSync(src, path.join(DIST, file));
|
|
}
|
|
|
|
for (const dir of DIRS) {
|
|
const src = path.join(ROOT, dir);
|
|
if (!fs.existsSync(src)) {
|
|
missing.push(dir + '/');
|
|
continue;
|
|
}
|
|
copyDir(src, path.join(DIST, dir));
|
|
}
|
|
|
|
// db/ ships with just .htaccess (denies direct web access to the sqlite
|
|
// file) — never the live fitz.sqlite itself. inc/db.php creates the
|
|
// schema on first run if the file isn't there, so shipping the dev
|
|
// database would just overwrite whatever is already live on the server.
|
|
const dbHtaccess = path.join(ROOT, 'db', '.htaccess');
|
|
if (fs.existsSync(dbHtaccess)) {
|
|
fs.mkdirSync(path.join(DIST, 'db'), { recursive: true });
|
|
fs.copyFileSync(dbHtaccess, path.join(DIST, 'db', '.htaccess'));
|
|
} else {
|
|
missing.push('db/.htaccess');
|
|
}
|
|
|
|
if (missing.length) {
|
|
console.warn('Warning: expected but not found, skipped:\n ' + missing.join('\n '));
|
|
}
|
|
|
|
console.log(`Deploy folder built at ${path.relative(ROOT, DIST)}/`);
|