- CheckAccessAction: pull_updates/assist/getModulesTreeAsync (not checkAccessJson) - CheckVersionAction: pull_updates/assist/getUpdateVersionJson (not getLatestVersion) These are the actual endpoints used by the original vikon_core update.js
- HttpTask::post() now sends application/x-www-form-urlencoded (not JSON) - AuthenticateAction sends to db-nica.ru (not auth.db-nica.ru) matching original vikon_core - Original code: remoteRequest($apiDomen . 'oauth2/authorize/token', ...)
- HttpTask: Laravel Http facade with SSL enabled, retry, timeout - ValidateTokenTask: token check via auth.db-nica.ru - RefreshTokenTask: token refresh via db-nica.ru - FilesystemTask: path traversal protection, blocked extensions (PHP/ASP/etc) - AuthenticateAction: OAuth2 code→token exchange - CheckAccessAction: token validation + filesystem writability check - CheckVersionAction: version comparison against remote API - UpdateCoreAction: ZIP download, Zip Slip protection, atomic sync with rollback - VikonController: thin controller, 7 endpoints with Session-based token storage - Routes: access-check, dashboard.auth, throttle:30,1 middleware - Vue 3 Composition API frontend with progress bar - Config: all secrets in .env via config/vikon.php - vikon_core kept as fallback (not deleted)
F4ilji