Commit Graph

17 Commits

Author SHA1 Message Date
20c16ab1e0 security: fix 3 critical vulnerabilities + dependency audit
CRITICAL FIXES:
- Remove hardcoded DB password from api/db.ts (was: 9qPRdCGGqM4o)
- Remove hardcoded API key from api/routes/wp-monitor.ts
- Add mandatory env var validation for DB_USER, DB_PASS, DB_NAME
- Add mandatory env var validation for WP_MONITOR_API_KEY
- Add connection timeouts to MySQL pool (10s/15s/30s)

VERIFIED:
- .env never committed to Git (credentials not exposed in repo)
- .gitignore working correctly

DEPENDENCIES:
- Fix qs vulnerability (GHSA-w7fw-mjwx-w883)
- npm audit: 1 low → 0 vulnerabilities

Related: AUDIT-REPORT.md vulnerabilities 1.1, 1.2, 1.3
Next: Implement rate limiting, CORS restrictions, input validation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-14 03:38:09 +00:00
a19e07d83c fix: remove HEAD-based site checker that caused false DOWN status
The checkAllSitesAvailability() function did HEAD requests from EasyPanel
to check sites. Many WordPress sites block HEAD or return errors, causing
all sites to show as DOWN while keeping valid response times from the
CWP collector. The CWP collector (collect-sites.sh) is the single source
of truth for site status.

Removed:
- checkSiteAvailability() and checkAllSitesAvailability() from monitoring service
- POST /api/monitor/check-sites endpoint
- api/scripts/check-sites.ts cron script

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-10 17:48:41 +00:00
12e1552d02 feat: add financial panel, compact services list, add Syncthing
- New /financial page with sales/expenses cards, monthly bar chart and
  expense distribution pie chart (Recharts)
- New API endpoint GET /api/financial with queries on tblinvoices and
  tblexpenses
- Compact services grid (2-col dots layout) in Monitor page
- Add Syncthing to critical services monitoring
- Add Financeiro nav link to Dashboard, Monitor and Financial headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 22:50:12 +00:00
10fc8f5ccc feat: add SSH metrics collection with ssh2 library and auto-scheduler
Replace sshpass with ssh2 Node.js library for reliable SSH connections.
Add all 6 servers (CWP, EasyPanel, MCP Hub, Meet, WhatsApp, WhatSMS).
Add 5-minute auto-collection scheduler in production mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 22:14:22 +00:00
37164cf2ac feat: filtrar leads com lembrete futuro tambem no FollowUp
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 21:51:44 +00:00
24d63cf233 feat: rebrand Dashboard + mobile nav + filtrar leads com lembrete futuro
- Renomear "Plan EAL" para "Dashboard Descomplicar" (header + footer)
- Adicionar menu hamburger mobile com navegacao Dashboard/Monitor
- Excluir leads com lembrete futuro da seccao "Contactar" (NOT EXISTS tblreminders)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 21:50:54 +00:00
e99fb8b274 fix: correct dist path for static serving 2026-02-04 23:44:55 +00:00
4af01c0f36 fix: serve static files in production
- Added static file serving in Express for production
- Added SPA fallback for client-side routing
- Created Dockerfile with NODE_ENV=production
- Frontend now properly served at dash.descomplicar.pt

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 23:43:36 +00:00
75f29ee6d5 fix: Monitor page now uses real API data
- Changed fetch URL from /api/monitor.php to /api/monitor
- Updated MonitorData interface to match API response structure
- Fixed stats calculation (MySQL returning strings instead of numbers)
- Updated mock data with realistic values from production DB

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 23:34:43 +00:00
bd21a8d511 fix: TypeScript errors in server-metrics service 2026-02-04 23:21:03 +00:00
f4160b60f9 fix: Remaining TypeScript strict mode errors in routes 2026-02-04 23:19:32 +00:00
7be99098f5 fix: TypeScript strict mode errors in server and services 2026-02-04 23:18:15 +00:00
1972937841 fix: Escape cron syntax in JSDoc comments to prevent early termination 2026-02-04 23:16:55 +00:00
1b05c051da fix: Remove special characters from scripts for TypeScript compilation 2026-02-04 23:15:45 +00:00
13608a69bf feat: WordPress Monitor API + Site Availability Checker
- Add POST /api/wp-monitor endpoint for WP plugin data
- Add GET /api/wp-monitor for listing monitored sites
- Add checkSiteAvailability() function for HTTP health checks
- Add checkAllSitesAvailability() for batch checking
- Add /api/scripts/check-sites.ts for cron execution
- Add POST /api/monitor/check-sites for manual trigger

DeskCRM Task: #1556

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 23:12:32 +00:00
853b2f526e fix: API funcionando com dados reais + dotenv config
- Adiciona dotenv para carregar variáveis de ambiente
- Configura DB_HOST para servidor remoto (176.9.3.158)
- Cria endpoint /api/diagnostic para testes
- Actualiza título: "Plan EAL" → "Dashboard Descomplicar"
- Adiciona tsconfig.json para pasta /api
- Fix: Carrega .env antes de inicializar MySQL pool

Tarefa: #1556

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-04 03:46:34 +00:00
a766f3a765 feat: add Node.js/Express API with real data from Desk CRM
-  API completa em /api com TypeScript
-  Google Calendar integration (pessoal + profissional)
-  Queries diretas à BD: tasks, leads, projectos, billing, pipeline
-  Endpoints: /api/dashboard, /api/monitor, /api/health
-  Vite proxy configurado (/api → localhost:3001)
-  App.tsx usa /api/dashboard (não mais dados mock)
-  Migração completa do PHP (index.php + monitor.php)
-  CHANGELOG.md criado para tracking
-  Scripts npm: dev (paralelo), dev:api, dev:ui, start

Dependencies:
- express, cors, mysql2, googleapis
- concurrently, tsx (dev)

Breaking: PHP backend será descontinuado
See: CHANGELOG.md, api/README.md

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-04 03:26:24 +00:00