3 Commits

Author	SHA1	Message	Date
diana.dolgolyova	7497ede2fd	fix: auto-issue CSRF cookie for existing sessions ... Sessions from before CSRF was added lack the bh-csrf-token cookie, causing 403 on first save. Middleware now auto-generates the cookie if the user is authenticated but missing it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 17:57:49 +03:00
diana.dolgolyova	6cbdba2197	feat: add CSRF protection for admin API routes ... Double-submit cookie pattern: login sets bh-csrf-token cookie, proxy.ts validates X-CSRF-Token header on POST/PUT/DELETE to /api/admin/*. New adminFetch() helper in src/lib/csrf.ts auto-includes the header. All admin pages migrated from fetch() to adminFetch(). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 17:53:02 +03:00
diana.dolgolyova	26cb9a9772	feat: redesign news & master classes sections, migrate middleware to proxy ... - News: magazine layout with featured hero article + compact list, click-to-open modal - Master classes: fashion lookbook portrait cards with full-bleed images and overlay content - Rename middleware.ts to proxy.ts (Next.js 16 convention) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 18:49:13 +03:00