5d2bced39f
docs: update project docs and clean up redundant files
...
- PROGRESS.md: update to 2026-05-29 with security hardening (T-005),
4-frontend architecture, AI provider refactoring, discovery features,
landing page/referral/quota, desktop layout, admin AI management
- AGENTS.md: add AI provider list (Alibaba/NVIDIA, removed Claude/DeepL/Local),
DB-driven config, CSRF/rate-limit/CORS notes, admin_ai reload quirk
- .env.example: sync with actual config, replace deprecated providers
with current Sensenova/OpencodeGo/NVIDIA/Spark/Alibaba
- docs/PROJECT_STATUS.md: archive (fully superseded by PROGRESS.md)
- Remove generated JS files (_bing_search.js, _batch_search.js)
- Remove empty directories (data/corpus, data/models)
- Remove backend/.coverage (test artifact)
- Fix services/.gitignore to cover _bing_search.js
- Include pending AI provider DB admin feature (admin_ai, AIProvider model,
AIProviders.vue, migration) and T-008 test report
2026-05-29 11:15:33 +08:00
c04fa2c19f
T-005: Security hardening - CORS, Rate Limit, CSRF
...
- CORS: Restrict allowed origins to specific frontend URLs, limit methods and headers
- Rate Limit: Add fine-grained endpoint-specific rate limits for sensitive operations
- Login: 5 requests/minute
- Register: 3 requests/hour
- Password change: 3 requests/5 minutes
- Payment: 20 requests/minute
- Admin: 30 requests/minute
- CSRF: Add CSRF protection middleware with double-submit cookie pattern
- New app/core/csrf.py module with CSRFMiddleware
- Require CSRF tokens on sensitive endpoints (auth, payment, profile)
- Skip webhook endpoints for CSRF validation
- Fix pydantic-settings import in config.py
2026-05-29 10:26:23 +08:00
c397740748
feat: WeChat Pay integration, translation quota management, login UX fixes
...
- WeChat Pay APIv3 integration (JSAPI + Native) with cert-based auth
- TranslationQuota model + admin management UI (配额 tab)
- Alibaba MT provider now checks quota before translation
- Fix: admin tabs scrollable on mobile, remove header-card
- Fix: profile/login navigation - logout stays on profile, login returns to profile
- Fix: login form now visible by default (no extra click to show)
- Fix: home page translate link uses navigateTo (was switchTab to non-tabBar page)
- Add .coverage and apiclient_key.pem to gitignore
2026-05-20 18:30:12 +08:00
TradeMate Dev