F4ilji
0a5f99e6ae
refactor(vikon): remove hardcoded module IDs and use config everywhere
2026-07-05 11:40:02 +05:00
F4ilji
8cf195efb0
refactor(vikon): fetch parts from VIKON API instead of hardcoded config
2026-07-05 11:32:54 +05:00
F4ilji
1d423adc12
feat(vikon): add part selection UI to Vue dashboard
2026-07-05 02:52:50 +05:00
F4ilji
b259809960
feat(vikon): add updatePart endpoint with request validation
2026-07-05 02:50:41 +05:00
F4ilji
8e5f26da8d
feat(vikon): add file sync from VIKON file manager (FM)
2026-07-04 20:41:49 +05:00
F4ilji
7d6b1a2342
fix(vikon): return actual error message in updateModule response
2026-07-04 19:16:43 +05:00
F4ilji
11b145861d
fix(vikon): use vikon_core redirect_uri in oauthCallback to match VIKON server registration
2026-07-04 18:28:34 +05:00
F4ilji
5600f21937
fix(vikon): rename authorize() to getAuthUrl() to avoid parent conflict
2026-07-04 17:46:14 +05:00
F4ilji
3dc29d44d8
fix(vikon): DNS bypass, OAuth callback, ABITUR init, token cache, ZIP security
...
- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel
2026-07-04 17:44:50 +05:00
F4ilji
94e17dfbbc
fix(vikon): use api_domain for OAuth authorize URL (not auth_domain)
...
Original vikon_core used db-nica.ru for /oauth2/authorize, not auth.db-nica.ru.
This was causing 'Client authentication failed' error.
2026-07-04 13:33:39 +05:00
F4ilji
f4f8bc8e77
feat(vikon): rewrite VikonIntegration from scratch — OAuth + core update
...
- HttpTask: Laravel Http facade with SSL enabled, retry, timeout
- ValidateTokenTask: token check via auth.db-nica.ru
- RefreshTokenTask: token refresh via db-nica.ru
- FilesystemTask: path traversal protection, blocked extensions (PHP/ASP/etc)
- AuthenticateAction: OAuth2 code→token exchange
- CheckAccessAction: token validation + filesystem writability check
- CheckVersionAction: version comparison against remote API
- UpdateCoreAction: ZIP download, Zip Slip protection, atomic sync with rollback
- VikonController: thin controller, 7 endpoints with Session-based token storage
- Routes: access-check, dashboard.auth, throttle:30,1 middleware
- Vue 3 Composition API frontend with progress bar
- Config: all secrets in .env via config/vikon.php
- vikon_core kept as fallback (not deleted)
2026-07-04 12:53:28 +05:00
F4ilji
47aac647ac
feat(vikon): remove broken VikonIntegration container - starting fresh
2026-07-04 12:40:41 +05:00
F4ilji
169a2f5654
changes
2026-04-08 14:14:38 +05:00
F4ilji