Eliminates XSS token theft by storing JWT in httpOnly Secure cookie
instead of localStorage. Backend sets cookie on login and clears on
logout. Token extraction uses cookie-first with Authorization header
fallback for backward compatibility with existing tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Hash passwords with SHA-256 on frontend before transmission to prevent
raw password exposure in network traffic and server logs
- Switch login endpoint from OAuth2 form-data to JSON body
- Auto-create admin user on startup from ADMIN_USERNAME/ADMIN_PASSWORD
env vars, solving login failure after registration was disabled
- Update auth tests to match new SHA-256 + JSON login flow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove nginx from docker-compose.prod.yml (NPM handles reverse proxy)
- Add Next.js rewrites to proxy /api/* to backend (backend fully hidden)
- Bind frontend to 127.0.0.1:3000 only (NPM proxies externally)
- Replace hardcoded localhost:8000 in history page with api client
- Make CORS origins configurable via environment variable
- Restrict CORS methods to GET/POST/PUT/DELETE
- Add Gitea Actions deploy workflow with secrets-based env management
- Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- Add BACKEND_URL build arg to frontend Dockerfile for standalone builds
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add tailwind.config.ts with shadcn/ui theme colors
- Update globals.css with CSS variables for dark/light mode
- Add utils.ts with cn() helper function
- Add components.json for shadcn/ui CLI
- Update postcss.config.mjs with autoprefixer
- Exclude playwright config from tsconfig to fix build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add API client utility (frontend/src/lib/api.ts) with JWT authentication
- Add Sidebar component with navigation menu (Korean labels)
- Add Header component with logout functionality
- Update globals.css with Tailwind CSS configuration
- Update layout.tsx with Inter font and Korean language
- Update page.tsx with dashboard layout and auth check
- Add login page with form validation and error handling
- Fix .gitignore to not exclude frontend/src/lib/
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
