Commit Graph

27 Commits

Author SHA1 Message Date
d343037bbd Security: Fix critical vulnerabilities and implement security hardening
CRITICAL SECURITY FIXES:
- Fixed certificate validation bypass vulnerability in BTCPayServerService
  * Removed unsafe ServerCertificateCustomValidationCallback
  * Added environment-specific SSL configuration
  * Production now enforces proper SSL validation

- Fixed overly permissive CORS policy
  * Replaced AllowAnyOrigin() with specific trusted origins
  * Created separate CORS policies for Development/Production/API
  * Configured from appsettings for environment-specific control

- Implemented CSRF protection across admin panel
  * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions
  * Protected 10 admin controllers with anti-forgery tokens
  * Prevents Cross-Site Request Forgery attacks

CONFIGURATION IMPROVEMENTS:
- Created appsettings.Development.json for dev-specific settings
- Added Security:AllowInsecureSSL flag (Development only)
- Added CORS:AllowedOrigins configuration arrays
- Created comprehensive security roadmap (ROADMAP.md)

ALSO FIXED:
- TeleBot syntax errors (Program.cs, MessageFormatter.cs)
- Added enterprise-full-stack-developer output style

Impact: All Phase 1 critical security vulnerabilities resolved
Status: Ready for security review and deployment preparation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-19 11:56:12 +01:00
SilverLabs DevTeam
36b393dd2e Update BTCPay integration with production credentials and deployment documentation
- Updated API key and Store ID to production values
- Added comprehensive deployment documentation
- Fixed invoice creation to use GBP (fiat) currency
- Documented successful production deployment status
- Added manual deployment instructions
- Updated CLAUDE.md with latest integration fixes

Production Status:
- BTCPay connection working with v2.2.1
- Store "Shop" configured with ID: CvdvHoncGLM7TdMYRAG6Z15YuxQfxeMWRYwi9gvPhh5R
- Invoice creation functional (wallets need BTCPay-side configuration)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-19 11:17:43 +01:00
SilverLabs DevTeam
6f0efa6252 Fix BTCPay Server integration for production deployment
- Fixed invoice creation to use GBP (fiat) instead of cryptocurrency amounts
- BTCPay Server now handles automatic crypto conversion
- Updated payment flow to use checkout links instead of raw wallet addresses
- Added comprehensive logging for debugging payment issues
- Created diagnostic endpoints for testing BTCPay connection and payments
- Added documentation for deployment and troubleshooting

The key issue was that BTCPay v2 manages wallet addresses internally and provides checkout links for customers to complete payments, rather than exposing raw crypto addresses.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-19 10:21:04 +01:00
SilverLabs DevTeam
54618348ab Update LittleShop configuration and deployment files
- Modified CLAUDE.md documentation
- Updated Dockerfile configuration
- Updated Program.cs and production settings
- Added deployment scripts for Hostinger
- Added Hostinger environment configuration

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-18 19:27:58 +01:00
SilverLabs DevTeam
a419bd7a78 Implement product variations, enhanced order workflow, mobile responsiveness, and product import system
## Product Variations System
- Add ProductVariation model with quantity-based pricing (1 for £10, 2 for £19, 3 for £25)
- Complete CRUD operations for product variations
- Enhanced ProductService to include variations in all queries
- Updated OrderItem to support ProductVariationId for variation-based orders
- Graceful error handling for duplicate quantity constraints
- Admin interface with variations management (Create/Edit/Delete)
- API endpoints for programmatic variation management

## Enhanced Order Workflow Management
- Redesigned OrderStatus enum with clear workflow states (Accept → Packing → Dispatched → Delivered)
- Added workflow tracking fields (AcceptedAt, PackingStartedAt, DispatchedAt, ExpectedDeliveryDate)
- User tracking for accountability (AcceptedByUser, PackedByUser, DispatchedByUser)
- Automatic delivery date calculation (dispatch date + working days, skips weekends)
- On Hold workflow for problem resolution with reason tracking
- Tab-based orders interface focused on workflow stages
- One-click workflow actions from list view

## Mobile-Responsive Design
- Responsive orders interface: tables on desktop, cards on mobile
- Touch-friendly buttons and spacing for mobile users
- Horizontal scrolling tabs with condensed labels on mobile
- Color-coded status borders for quick visual recognition
- Smart text switching based on screen size

## Product Import/Export System
- CSV import with product variations support
- Template download with examples
- Export existing products to CSV
- Detailed import results with success/error reporting
- Category name resolution (no need for GUIDs)
- Photo URLs import support

## Enhanced Dashboard
- Product variations count and metrics
- Stock alerts (low stock/out of stock warnings)
- Order workflow breakdown (pending, accepted, dispatched counts)
- Enhanced layout with more detailed information

## Technical Improvements
- Fixed form binding issues across all admin forms
- Removed external CDN dependencies for isolated deployment
- Bot Wizard form with auto-personality assignment
- Proper authentication scheme configuration (Cookie + JWT)
- Enhanced debug logging for troubleshooting

## Self-Contained Deployment
- All external CDN references replaced with local libraries
- Ready for air-gapped/isolated network deployment
- No external internet dependencies

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-18 01:39:31 +01:00
6b6961e61a Test: Verify large payload support after proxy configuration 2025-09-17 17:16:47 +01:00
e1b377a042 Initial commit of LittleShop project (excluding large archives)
- BTCPay Server integration
- TeleBot Telegram bot
- Review system
- Admin area
- Docker deployment configuration

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-17 15:07:38 +01:00
sysadmin
bcca00ab39 "Royal-Mail-shipping-integration-and-test-improvements" 2025-09-08 03:53:28 +01:00
sysadmin
be4d797c6c BTCPay-infrastructure-recovery 2025-09-04 21:28:47 +01:00
sysadmin
b4cee007c4 BTCPay-Server-integration-and-HAProxy-setup 2025-09-01 09:37:38 +01:00
sysadmin
ee4a5c3578 Product-enhancements-and-validation-fixes 2025-09-01 08:03:00 +01:00
sysadmin
c8a55c143b WebPush-and-photo-upload-fixes 2025-09-01 06:01:05 +01:00
sysadmin
5eb7647faf PWA-implementation 2025-09-01 04:49:05 +01:00
sysadmin
cccb4e4d03 "BotUI-Baseline" 2025-08-28 12:33:32 +01:00
sysadmin
9175e5bb96 "Clean-up-UI-remove-navigation-title-and-section-emojis" 2025-08-28 12:27:11 +01:00
sysadmin
9714e9d37b "Complete-product-UX-improvements-with-navigation-and-category-enhancements" 2025-08-28 12:18:45 +01:00
sysadmin
7e364b2a44 "Improve-product-UI-with-individual-bubbles-and-fix-admin-authentication" 2025-08-28 00:22:27 +01:00
sysadmin
5748ed4a09 "Fix-order-details-for-customers" 2025-08-27 23:35:30 +01:00
sysadmin
1829e5c940 "Fix-security-and-config-from-TestAgent" 2025-08-27 22:41:18 +01:00
sysadmin
bbf5acbb6b final 2025-08-27 22:19:39 +01:00
sysadmin
5c6abe5686 update 2025-08-27 22:19:10 +01:00
sysadmin
027a3fd0c4 Implement bidirectional customer conversations with customer-based grouping and order tagging 2025-08-27 19:18:46 +01:00
sysadmin
3f4789730c Complete customer communication system with automatic message delivery working correctly 2025-08-27 18:51:19 +01:00
sysadmin
eae5be3e7c Add customer communication system 2025-08-27 18:02:39 +01:00
sysadmin
1f7c0af497 Add LittleShop.Client SDK library with complete API wrapper
Features:
- Complete .NET client SDK for LittleShop API
- JWT authentication with automatic token management
- Catalog service for products and categories
- Order service with payment creation
- Retry policies using Polly for resilience
- Error handling middleware
- Dependency injection support
- Comprehensive documentation and examples

SDK Components:
- Authentication service with token refresh
- Strongly-typed models for all API responses
- HTTP handlers for retry and error handling
- Extension methods for easy DI registration
- Example console application demonstrating usage

Test Updates:
- Fixed test compilation errors
- Updated test data builders for new models
- Corrected service constructor dependencies
- Fixed enum value changes (PaymentStatus, OrderStatus)

Documentation:
- Complete project README with features and usage
- Client SDK README with detailed examples
- API endpoint documentation
- Security considerations
- Deployment guidelines

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
2025-08-20 18:15:35 +01:00
sysadmin
a281bb2896 Implement complete e-commerce functionality with shipping and order management
Features Added:
- Standard e-commerce properties (Price, Weight, shipping fields)
- Order management with Create/Edit views and shipping information
- ShippingRates system for weight-based shipping calculations
- Comprehensive test coverage with JWT authentication tests
- Sample data seeder with 5 orders demonstrating full workflow
- Photo upload functionality for products
- Multi-cryptocurrency payment support (BTC, XMR, USDT, etc.)

Database Changes:
- Added ShippingRates table
- Added shipping fields to Orders (Name, Address, City, PostCode, Country)
- Renamed properties to standard names (BasePrice to Price, ProductWeight to Weight)
- Added UpdatedAt timestamps to models

UI Improvements:
- Added Create/Edit views for Orders
- Added ShippingRates management UI
- Updated navigation menu with Shipping option
- Enhanced Order Details view with shipping information

Sample Data:
- 3 Categories (Electronics, Clothing, Books)
- 5 Products with various prices
- 5 Shipping rates (Royal Mail options)
- 5 Orders in different statuses (Pending to Delivered)
- 3 Crypto payments demonstrating payment flow

Security:
- All API endpoints secured with JWT authentication
- No public endpoints - client apps must authenticate
- Privacy-focused design with minimal data collection

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
2025-08-20 17:37:24 +01:00
sysadmin
df71a80eb9 Initial-implementation 2025-08-20 13:20:19 +01:00