Commit Graph

7 Commits

Author SHA1 Message Date
Elie Habib
a9224254a5 fix: security hardening — CORS, auth bypass, origin validation & bump v2.2.7
- Tighten CORS regex to block worldmonitorEVIL.vercel.app spoofing
- Move sidecar /api/local-env-update behind token auth + add key allowlist
- Add postMessage origin/source validation in LiveNewsPanel
- Replace postMessage wildcard '*' targetOrigin with specific origin
- Add isDisallowedOrigin() check to 25 API endpoints missing it
- Migrate gdelt-geo & EIA from custom CORS to shared _cors.js
- Add CORS to firms-fires, stock-index, youtube/live endpoints
- Tighten youtube/embed.js ALLOWED_ORIGINS regex
- Remove 'unsafe-inline' from CSP script-src
- Add iframe sandbox attribute to YouTube embed
- Validate meta-tags URL query params with regex allowlist
2026-02-15 20:33:20 +04:00
Elie Habib
ac935d505e fix: migrate all Vercel edge functions to CORS allowlist & bump v2.2.5
Replace Access-Control-Allow-Origin: * with shared getCorsHeaders()
across 20 API edge functions to restrict access to worldmonitor.app,
tech.worldmonitor.app, and authorized Vercel preview URLs.

Version bump to 2.2.5 across package.json, tauri.conf.json, Cargo.toml.
2026-02-15 19:13:54 +04:00
Elie Habib
c353cf2070 Reduce egress costs, add PWA support, fix Polymarket and Railway relay
Egress optimization:
- Add s-maxage + stale-while-revalidate to all API endpoints for Vercel CDN caching
- Add vercel.json with immutable caching for hashed assets
- Add gzip compression to sidecar responses >1KB
- Add gzip to Railway RSS responses (4 paths previously uncompressed)
- Increase polling intervals: markets/crypto 60s→120s, ETF/macro/stablecoins 60s→180s
- Remove hardcoded Railway URL from theater-posture.js (now env-var only)

PWA / Service Worker:
- Add vite-plugin-pwa with autoUpdate strategy
- Cache map tiles (CacheFirst), fonts (StaleWhileRevalidate), static assets
- NetworkOnly for all /api/* routes (real-time data must be fresh)
- Manual SW registration (web only, skip Tauri)
- Add offline fallback page
- Replace manual manifest with plugin-generated manifest

Polymarket fix:
- Route dev proxy through production Vercel (bypasses JA3 blocking)
- Add 4th fallback tier: production URL as absolute fallback

Desktop/Sidecar:
- Dual-backend cache (_upstash-cache.js): Redis cloud + in-memory+file desktop
- Settings window OK/Cancel redesign
- Runtime config and secret injection improvements
2026-02-14 19:53:04 +04:00
Elie Habib
1bcb098b01 Add curated events fallback for major tech conferences
The dev.events RSS feed is limited to 100 items sorted by "date added"
(not event date), causing major events like STEP Dubai to be pushed out
when newer events are added. Added a curated events list as fallback
for important conferences that may fall off the RSS feed:

- STEP Dubai 2026 (Feb 11-12) - 8,000+ attendees, AI economy focus
- GITEX Global 2026 (Dec 7-11) - World's largest tech show
- TOKEN2049 Dubai 2026 (Apr 29-30)
- Collision 2026 (Jun 22-25) - Toronto
- Web Summit 2026 (Nov 2-5) - Lisbon

Curated events are deduplicated with feed data to avoid duplicates.
2026-01-25 22:59:22 +04:00
Elie Habib
e2518ad6da Add limit and days filters for tech events API
- API now supports ?limit=N and ?days=N parameters
- Map layer: 50 events within 90 days (reduces clutter)
- Panel: 100 events within 180 days (more context)
2026-01-23 10:02:11 +04:00
Elie Habib
47844fc198 Integrate dev.events RSS into Tech Events panel
- Fetch both Techmeme ICS and dev.events RSS in parallel
- Parse dev.events RSS for upcoming developer conferences/meetups
- Merge events from both sources with deduplication
- Extract location from dev.events descriptions for map markers
- Events now show from both sources in the Tech Events panel
2026-01-23 09:41:03 +04:00
Elie Habib
f652b22301 Add tech events feature with Techmeme ICS integration
- Add /api/tech-events endpoint parsing Techmeme events ICS feed
- Create TechEventsPanel with view modes (upcoming/conferences/earnings/all)
- Add tech events map layer with conference location markers
- Implement 500+ city geocoding database for worldwide coverage
- Purple markers with yellow glow for events within 14 days
- Click-to-zoom from panel items to map locations
- Integrated in tech variant (disabled in full variant)
2026-01-23 08:25:29 +04:00