Full deployment history for this project.
🛡️ Sentinel: [HIGH] Fix XSS Vulnerability in JSON-LD Rendering Properly escape `<` characters in `JSON.stringify` output when passed to `dangerouslySetInnerHTML` in `components/json-ld.tsx`. This prevents potential XSS via script injection within script tags. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ Sentinel: Fix XSS Vulnerability in JSON-LD Rendering Escaped the HTML output of `JSON.stringify()` within `<script type="application/ld+json">` elements in `components/json-ld.tsx` to prevent XSS script breakout attempts. Replaced `<` with `\u003c` in `dangerouslySetInnerHTML` injections across the four JSON-LD generation functions (`SiteJsonLd`, `BreadcrumbJsonLd`, `ProductJsonLd`, and `ItemListJsonLd`). Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Fix XSS vulnerabilities in JSON-LD scripts Escaped HTML `<` characters to `\\u003c` in components/json-ld.tsx to prevent arbitrary script injection via `dangerouslySetInnerHTML`. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ Sentinel: [HIGH] Fix Cross-Site Scripting (XSS) in JSON-LD output Escaped HTML tags from JSON-LD strings parsed by dangerouslySetInnerHTML by converting '<' to '\\u003c'. This prevents user-supplied data from prematurely terminating the script tag, mitigating XSS risks. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ Sentinel: Add security headers Added standard security headers to Next.js configuration to provide baseline protection against XSS, clickjacking, and other common web vulnerabilities. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ Sentinel: [HIGH] Fix timing attack vulnerability in administrative endpoint - Fixed a timing attack vulnerability in `/api/etsy/sync/route.ts` where the `ADMIN_SECRET` was compared using a standard equality operator. - Implemented a secure, constant-time comparison using `crypto.timingSafeEqual` and SHA-256 hashes to prevent length and byte-by-byte timing leakage. - Added a new entry to the Sentinel journal detailing the vulnerability and its prevention. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
perf: cache categories derived from static JSON Optimizes `getCategories()` by using a lazy-initialized module-level variable to cache the result. Since the categories are derived from static JSON data that never changes at runtime, this prevents expensive set allocation, string mapping, and sorting operations on every function call (O(1) instead of O(n log n)). Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🎨 Palette: Improve interactive element focus rings Changed `focus:` and `group-focus:` utilities to `focus-visible:` and `group-focus-visible:` on the homepage interactive elements. This ensures focus rings are shown strictly for keyboard users while eliminating the distracting visual ring when elements are clicked with a mouse, maintaining accessibility while improving mouse user UX. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #10 from mbarbine/palette-ux-shop-filters-402054651375332491 🎨 Palette: Improve accessibility of shop filters and product count
🎨 Palette: Improve accessibility of shop filters and product count - Added `focus-visible` styling to shop category filter buttons so keyboard users can navigate them easily. - Added `role="status"` and `aria-live="polite"` to the product count element so screen readers announce when products are filtered client-side. - Added a critical learning to `.Jules/palette.md` regarding screen reader feedback for dynamic filtering. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #8 from mbarbine/sentinel-fix-etsy-sync-auth-740332298146167863 🛡️ Sentinel: [CRITICAL] Add authentication to admin endpoint
Add authentication check to Etsy sync API endpoint Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #7 from mbarbine/feature/discovery-and-mcp-enhancements-6420565710255127848 Enhance discovery, LLMs, and MCP files. Build dynamic route handlers.
Enhance discovery, LLMs, and MCP files. Build dynamic route handlers. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #5 from mbarbine/palette-product-card-focus-12295807286972002220 🎨 Palette: Add keyboard focus-within support to Product Card
🎨 Palette: Add keyboard focus-within support to Product Card 💡 What: Added `focus-within` and `group-focus-within` Tailwind utility classes to the Product Card component. 🎯 Why: Previously, mouse users saw a helpful overlay with "View Details" and an Etsy link upon hovering over a product. However, keyboard users tabbing through the interface never triggered this overlay because the interactive elements were hidden behind `group-hover:opacity-100` without a corresponding `focus-within` state. This makes the UI equitable for keyboard navigators. ♿ Accessibility: Ensures that keyboard focus states trigger the exact same visual reveals, animations, and feedback as mouse hover states on interactive card components. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #4 from mbarbine/palette-ux-header-focus-12015092376518312195 🎨 Palette: Add keyboard focus states to header buttons
🎨 Palette: Add keyboard focus states to header buttons - Added `focus-visible` styling to the desktop language switcher. - Added `focus-visible` styling to the mobile menu toggle. - Allows keyboard users to see which element is focused. - Created `.gitignore` to prevent committing `node_modules` and `.next`. - Documented learning in `.Jules/palette.md`. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #2 from mbarbine/etsy-storefront-build Launch REFLUX Official Merch Store with i18n and Spotify integration
Merge pull request #3 from mbarbine/v0/mbarbine-5b9f150e Launch official REFLUX merch store and update band history
feat: update band history with Wikipedia-sourced facts and register site Add founding members and session musicians, fix timeline, and register site. Co-authored-by: Michael Barbine <3211492+mbarbine@users.noreply.github.com>
update base URLs to https://reflux.platphormnews.com Co-authored-by: Michael Barbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #2 from mbarbine/etsy-storefront-build Launch REFLUX Official Merch Store with i18n and Spotify integration
fix: restructure product card link handling Remove unnecessary 'use client' and simplify click propagation. Co-authored-by: Michael Barbine <3211492+mbarbine@users.noreply.github.com>
fix: resolve middleware redirect loop and Next.js routing issues Fix middleware and page redirects to prevent loop and ensure proper routing. Co-authored-by: Michael Barbine <3211492+mbarbine@users.noreply.github.com>