Barış Keser df344bdb4f feat(backend): session-based admin panel with RBAC + Discord/break-glass login ...

- Replace ?password= query auth with hardened PHP sessions (HttpOnly/Secure/
  SameSite cookie, CSRF tokens, login rate-limiting, session-fixation guard).
- Login served at site root /; password-in-URL removed everywhere.
- Two login paths: Discord OAuth (dedicated admin redirect_uri, separate from
  the launcher loopback flow) and a one-time break-glass local account.
- Roles moderator/admin/kurucu resolved live from DB on every request; founder
  637985724007841812 auto-seeded as kurucu and lockout-proof. No role = no
  panel access at all.
- New permission-gated endpoints: mod upload/delete, account delete, role
  grant/revoke, announcements (require_perm()).
- Disable user self-delete of accounts (DELETE /api/accounts -> 403); only
  admins delete via the panel.
- New src/admin_auth.php module + cli/admin_migrate.php seeder.

2026-06-14 13:05:32 +03:00

..

.htaccess

chore(backend): refine Apache deploy config (.htaccess, apache.conf.sample, deploy-apache.sh)

2026-06-14 00:24:02 +03:00

index.php

feat(backend): session-based admin panel with RBAC + Discord/break-glass login

2026-06-14 13:05:32 +03:00