mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
feat: production Docker, Playwright tests, settings API, and bug fixes
- Add user management endpoints (register, list, delete, change password) - Add API key management (create, list, delete) - Add settings persistence endpoints (get, put) - Wire settings dialog to real backend (People, API Keys, System, Security) - Fix login auth flow (window.location.href for full reload) - Fix download URLs returning 401 (make public since UUIDs are unguessable) - Fix border tool shadowColor validation (accept 6-8 hex digits) - Fix remove-bg alpha matting fallback (retry without on failure) - Fix AI tool silent fallbacks (report errors instead of no-ops) - Add checkerboard background to before/after slider for transparency - Add progress bars to all AI tool components - Add Playwright E2E test suite (131 tests across 9 test files) - Rewrite Dockerfile for production (tsx runtime, pre-baked AI models) - Add .dockerignore for faster builds - Add proper accessible labels to login form
This commit is contained in:
Siddharth Kumar Sah
@@ -0,0 +1,120 @@
|
||||
/**
|
||||
* API Key management routes.
|
||||
*
|
||||
* POST /api/v1/api-keys — Generate a new API key
|
||||
* GET /api/v1/api-keys — List the current user's API keys
|
||||
* DELETE /api/v1/api-keys/:id — Delete an API key
|
||||
*/
|
||||
import { randomBytes, randomUUID } from "node:crypto";
|
||||
import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
|
||||
import { eq, and } from "drizzle-orm";
|
||||
import { db, schema } from "../db/index.js";
|
||||
import { hashPassword, requireAuth } from "../plugins/auth.js";
|
||||
|
||||
export async function apiKeyRoutes(app: FastifyInstance): Promise<void> {
|
||||
// POST /api/v1/api-keys — Generate a new API key
|
||||
app.post(
|
||||
"/api/v1/api-keys",
|
||||
async (request: FastifyRequest, reply: FastifyReply) => {
|
||||
const user = requireAuth(request, reply);
|
||||
if (!user) return;
|
||||
|
||||
const body = request.body as { name?: string } | null;
|
||||
const name = body?.name?.trim() || "Default API Key";
|
||||
|
||||
if (name.length > 100) {
|
||||
return reply.status(400).send({
|
||||
error: "Key name must be 100 characters or fewer",
|
||||
code: "VALIDATION_ERROR",
|
||||
});
|
||||
}
|
||||
|
||||
// Generate a raw API key: "si_" prefix + 48 random bytes as hex
|
||||
const rawKey = `si_${randomBytes(48).toString("hex")}`;
|
||||
const keyHash = await hashPassword(rawKey);
|
||||
const id = randomUUID();
|
||||
|
||||
db.insert(schema.apiKeys)
|
||||
.values({
|
||||
id,
|
||||
userId: user.id,
|
||||
keyHash,
|
||||
name,
|
||||
})
|
||||
.run();
|
||||
|
||||
// Return the raw key ONCE — it cannot be retrieved again
|
||||
return reply.status(201).send({
|
||||
id,
|
||||
key: rawKey,
|
||||
name,
|
||||
createdAt: new Date().toISOString(),
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
// GET /api/v1/api-keys — List user's API keys (never returns the key itself)
|
||||
app.get(
|
||||
"/api/v1/api-keys",
|
||||
async (request: FastifyRequest, reply: FastifyReply) => {
|
||||
const user = requireAuth(request, reply);
|
||||
if (!user) return;
|
||||
|
||||
const keys = db
|
||||
.select({
|
||||
id: schema.apiKeys.id,
|
||||
name: schema.apiKeys.name,
|
||||
createdAt: schema.apiKeys.createdAt,
|
||||
lastUsedAt: schema.apiKeys.lastUsedAt,
|
||||
})
|
||||
.from(schema.apiKeys)
|
||||
.where(eq(schema.apiKeys.userId, user.id))
|
||||
.all();
|
||||
|
||||
return reply.send({
|
||||
apiKeys: keys.map((k) => ({
|
||||
id: k.id,
|
||||
name: k.name,
|
||||
createdAt: k.createdAt.toISOString(),
|
||||
lastUsedAt: k.lastUsedAt?.toISOString() ?? null,
|
||||
})),
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
// DELETE /api/v1/api-keys/:id — Delete an API key
|
||||
app.delete(
|
||||
"/api/v1/api-keys/:id",
|
||||
async (
|
||||
request: FastifyRequest<{ Params: { id: string } }>,
|
||||
reply: FastifyReply,
|
||||
) => {
|
||||
const user = requireAuth(request, reply);
|
||||
if (!user) return;
|
||||
|
||||
const { id } = request.params;
|
||||
|
||||
// Ensure the key belongs to the requesting user
|
||||
const existing = db
|
||||
.select()
|
||||
.from(schema.apiKeys)
|
||||
.where(and(eq(schema.apiKeys.id, id), eq(schema.apiKeys.userId, user.id)))
|
||||
.get();
|
||||
|
||||
if (!existing) {
|
||||
return reply.status(404).send({
|
||||
error: "API key not found",
|
||||
code: "NOT_FOUND",
|
||||
});
|
||||
}
|
||||
|
||||
db.delete(schema.apiKeys)
|
||||
.where(eq(schema.apiKeys.id, id))
|
||||
.run();
|
||||
|
||||
return reply.send({ ok: true });
|
||||
},
|
||||
);
|
||||
|
||||
app.log.info("API key routes registered");
|
||||
}
|
||||
@@ -0,0 +1,115 @@
|
||||
/**
|
||||
* Application settings routes (key-value store).
|
||||
*
|
||||
* GET /api/v1/settings — Get all settings as a key-value object
|
||||
* PUT /api/v1/settings — Save settings (admin only)
|
||||
* GET /api/v1/settings/:key — Get a specific setting
|
||||
*/
|
||||
import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
|
||||
import { eq } from "drizzle-orm";
|
||||
import { db, schema } from "../db/index.js";
|
||||
import { requireAuth, requireAdmin } from "../plugins/auth.js";
|
||||
|
||||
export async function settingsRoutes(app: FastifyInstance): Promise<void> {
|
||||
// GET /api/v1/settings — Get all settings as a key-value object
|
||||
app.get(
|
||||
"/api/v1/settings",
|
||||
async (request: FastifyRequest, reply: FastifyReply) => {
|
||||
const user = requireAuth(request, reply);
|
||||
if (!user) return;
|
||||
|
||||
const rows = db.select().from(schema.settings).all();
|
||||
|
||||
const settings: Record<string, string> = {};
|
||||
for (const row of rows) {
|
||||
settings[row.key] = row.value;
|
||||
}
|
||||
|
||||
return reply.send({ settings });
|
||||
},
|
||||
);
|
||||
|
||||
// PUT /api/v1/settings — Save settings (admin only)
|
||||
app.put(
|
||||
"/api/v1/settings",
|
||||
async (request: FastifyRequest, reply: FastifyReply) => {
|
||||
const admin = requireAdmin(request, reply);
|
||||
if (!admin) return;
|
||||
|
||||
const body = request.body as Record<string, unknown> | null;
|
||||
|
||||
if (!body || typeof body !== "object" || Array.isArray(body)) {
|
||||
return reply.status(400).send({
|
||||
error: "Request body must be a JSON object with key-value pairs",
|
||||
code: "VALIDATION_ERROR",
|
||||
});
|
||||
}
|
||||
|
||||
const now = new Date();
|
||||
let updatedCount = 0;
|
||||
|
||||
for (const [key, value] of Object.entries(body)) {
|
||||
if (typeof key !== "string" || key.length === 0) continue;
|
||||
|
||||
const strValue = typeof value === "string" ? value : JSON.stringify(value);
|
||||
|
||||
// Upsert: insert or update on conflict
|
||||
const existing = db
|
||||
.select()
|
||||
.from(schema.settings)
|
||||
.where(eq(schema.settings.key, key))
|
||||
.get();
|
||||
|
||||
if (existing) {
|
||||
db.update(schema.settings)
|
||||
.set({ value: strValue, updatedAt: now })
|
||||
.where(eq(schema.settings.key, key))
|
||||
.run();
|
||||
} else {
|
||||
db.insert(schema.settings)
|
||||
.values({ key, value: strValue })
|
||||
.run();
|
||||
}
|
||||
|
||||
updatedCount++;
|
||||
}
|
||||
|
||||
return reply.send({ ok: true, updatedCount });
|
||||
},
|
||||
);
|
||||
|
||||
// GET /api/v1/settings/:key — Get a specific setting
|
||||
app.get(
|
||||
"/api/v1/settings/:key",
|
||||
async (
|
||||
request: FastifyRequest<{ Params: { key: string } }>,
|
||||
reply: FastifyReply,
|
||||
) => {
|
||||
const user = requireAuth(request, reply);
|
||||
if (!user) return;
|
||||
|
||||
const { key } = request.params;
|
||||
|
||||
const row = db
|
||||
.select()
|
||||
.from(schema.settings)
|
||||
.where(eq(schema.settings.key, key))
|
||||
.get();
|
||||
|
||||
if (!row) {
|
||||
return reply.status(404).send({
|
||||
error: `Setting "${key}" not found`,
|
||||
code: "NOT_FOUND",
|
||||
});
|
||||
}
|
||||
|
||||
return reply.send({
|
||||
key: row.key,
|
||||
value: row.value,
|
||||
updatedAt: row.updatedAt.toISOString(),
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
app.log.info("Settings routes registered");
|
||||
}
|
||||
@@ -9,7 +9,7 @@ const settingsSchema = z.object({
|
||||
cornerRadius: z.number().min(0).max(500).default(0),
|
||||
padding: z.number().min(0).max(200).default(0),
|
||||
shadowBlur: z.number().min(0).max(50).default(0),
|
||||
shadowColor: z.string().regex(/^#[0-9a-fA-F]{6}$/).default("#00000080"),
|
||||
shadowColor: z.string().regex(/^#[0-9a-fA-F]{6,8}$/).default("#00000080"),
|
||||
});
|
||||
|
||||
export function registerBorder(app: FastifyInstance) {
|
||||
|
||||
Reference in New Issue
Block a user