failj/ntspi-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
532 Commits 3 Branches 0 Tags
master
Commit Graph
15 Commits
Author SHA1 Message Date
F4ilji 720aa4d0ae feat(logging): migrate VikonIntegration to vikon channel 2026-07-05 23:13:51 +05:00
F4ilji b9ff255878 fix(vikon): use cURL streaming for ZIP downloads to avoid memory/timeout issues 2026-07-05 13:26:10 +05:00
F4ilji 3d9982e5be fix(vikon): handle numeric status codes from VIKON API (1=completed, -1=failed) 2026-07-05 10:46:02 +05:00
F4ilji 2bf2f4a861 fix(vikon): send POST data as form-urlencoded to match VIKON API expectations 2026-07-05 10:31:40 +05:00
F4ilji 15f72b4de1 feat(vikon): add restoreAfterFail for crash recovery in FilesystemTask 2026-07-05 02:47:40 +05:00
F4ilji 4764d4e2d9 feat(vikon): add PollPartStatusTask for part update polling 2026-07-05 02:41:23 +05:00
F4ilji a624b83f18 feat(vikon): add atomicSwap to FilesystemTask for crash-safe updates 2026-07-05 02:35:25 +05:00
F4ilji b115cb93fd fix(vikon): increase nginx fastcgi_read_timeout to 600s, PHP set_time_limit 600 2026-07-04 21:40:51 +05:00
F4ilji 3dc29d44d8 fix(vikon): DNS bypass, OAuth callback, ABITUR init, token cache, ZIP security 
- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel
 2026-07-04 17:44:50 +05:00
F4ilji 967db81d3c fix(vikon): use correct token introspect endpoint for update system 
Original vikon_core security.php validates tokens via:
  POST db-nica.ru/oauth2/resource/token/introspect
  Body: client_id=542&access_token=XXX

Our code was incorrectly using:
  GET auth.db-nica.ru/api/profile_applicant/check_access_token
  Header: Authorization: Bearer XXX

This was the WRONG endpoint — the profile check is for abitur forms,
not for the update system.
 2026-07-04 13:54:56 +05:00
F4ilji a963647770 fix(vikon): use form-encoded POST + correct domain for OAuth token exchange 
- HttpTask::post() now sends application/x-www-form-urlencoded (not JSON)
- AuthenticateAction sends to db-nica.ru (not auth.db-nica.ru) matching original vikon_core
- Original code: remoteRequest($apiDomen . 'oauth2/authorize/token', ...)
 2026-07-04 13:46:49 +05:00
F4ilji ba99b2a093 fix(vikon): switch validateFileTypes from blacklist to whitelist 
Based on actual file analysis of sveden/abitur/vsoko modules:
- html, css, js, map (content + assets)
- png, jpg, gif, svg, ico, bmp (images)
- ttf, woff, woff2, eot (fonts)
- pdf, doc, docx (documents)
- vikon (module-specific)

No PHP/ASP/executables in allowed list — any non-whitelisted file is blocked.
 2026-07-04 13:21:54 +05:00
F4ilji f4f8bc8e77 feat(vikon): rewrite VikonIntegration from scratch — OAuth + core update 
- HttpTask: Laravel Http facade with SSL enabled, retry, timeout
- ValidateTokenTask: token check via auth.db-nica.ru
- RefreshTokenTask: token refresh via db-nica.ru
- FilesystemTask: path traversal protection, blocked extensions (PHP/ASP/etc)
- AuthenticateAction: OAuth2 code→token exchange
- CheckAccessAction: token validation + filesystem writability check
- CheckVersionAction: version comparison against remote API
- UpdateCoreAction: ZIP download, Zip Slip protection, atomic sync with rollback
- VikonController: thin controller, 7 endpoints with Session-based token storage
- Routes: access-check, dashboard.auth, throttle:30,1 middleware
- Vue 3 Composition API frontend with progress bar
- Config: all secrets in .env via config/vikon.php
- vikon_core kept as fallback (not deleted)
 2026-07-04 12:53:28 +05:00
F4ilji 47aac647ac feat(vikon): remove broken VikonIntegration container - starting fresh 2026-07-04 12:40:41 +05:00
F4ilji 169a2f5654 changes 2026-04-08 14:14:38 +05:00