2 Commits

Include renames

Author	SHA1	Message	Date
Z User	7a13dad693	feat: Stripe integration — checkout + webhook + subscription lifecycle ... - src/lib/stripe/index.ts: Stripe client (checkout session + webhook event) - POST /api/aos/stripe/checkout: create subscription checkout for a license - POST /api/aos/stripe/webhook: handle events: - checkout.session.completed → link Stripe customer/subscription to license - invoice.paid → activate license (remove trial) - customer.subscription.deleted → cancel license + schedule instance deletion - invoice.payment_failed → suspend license (dunning) - Middleware: stripe/webhook is public (Stripe calls it without auth) - stripe package installed (v23)	2026-10-28 22:48:33 +00:00
Z User	17ceefe32a	feat: auth system (middleware + login) + remove .env from git + fix hardcoded token ... CRITICAL SECURITY FIXES: - src/middleware.ts: protects all routes except public ones (health, license check, seed-prod) Redirects unauthenticated users to /login, returns 401 for API routes - src/app/login/page.tsx: login page with password input - src/app/api/auth/login: HMAC-signed session cookie (7-day expiry) - src/app/api/auth/logout: clears session cookie - Top bar: Abmelden (logout) button now functional - .env removed from git tracking (secrets no longer in repo) - seed-prod: hardcoded admin token replaced with env MCP_API_TOKEN or random UUID - ADMIN_PASSWORD env var required for login (set in Dokploy env) Public routes (no auth needed): /api/health, /api/aos/seed-prod, /api/aos/licenses/check, /api/aos/licenses/validate /api/v1/* (token-auth'd), /api/mcp (token-auth'd), /login	2026-10-28 22:38:39 +00:00