3 Commits

Author	SHA1	Message	Date
Zareian	28b8527760	Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable ... - accounts admin: phone/is_guest read-only for non-superusers, device_id filter lookups refused, auth.User/Group admin writable only by superusers - campaigns: delivery log needs view permission - phone/OTP/birth date: any Unicode digit normalised or rejected with 400; unknown gradeId is 400 - shared demo guest is never turned into a person's account by logging in - /api/home with unknown gradeId is no longer cached (LocMemCache flood reset throttle counters) - /api/progress/nodes: one query, huge unit is 400 - BazaarCredential token filter lookups refused Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-05 09:34:42 +03:30
Zareian	683bd40169	cleanup: trim bloated multi-line comments across the project	2026-08-26 03:22:20 +03:30
Zareian	a9200772a3	Add campaigns/ Add supervisor/ Add messaging features/ Separate SMS	2026-08-25 03:39:41 +03:30