External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
167 Commits 10 Branches 89 Tags
170395ae40c4a8ff4f4f47b05df7261ab93588ac
Commit Graph
11 Commits
Author SHA1 Message Date
Siddharth Kumar Sah 627ff8a82c chore: remove internal docs from repo, update public documentation 
Remove docs/superpowers/, .claude/ config, and PRD.md from version
control (kept locally via .gitignore). Update README, CHANGELOG,
VitePress docs, and .env.example to reflect recent features: Files
page, teams, admin settings, persistent storage, and various API
improvements.
 2026-03-26 01:11:40 +08:00
Siddharth Kumar Sah 6a13065706 feat(api): add logo upload/serve/delete routes with tests 
Add branding API at /api/v1/settings/logo supporting:
- POST: admin uploads PNG/SVG/JPEG (max 500KB), auto-converts to 128x128 PNG
- GET: public endpoint serves custom logo (404 if none)
- DELETE: admin removes custom logo

Includes 13 integration tests covering upload, conversion, size/type
validation, auth enforcement, resize, and idempotent deletion.
 2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah ab370a74fe feat(api): add teams CRUD routes and update auth team references 2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah 432cc92471 feat: harden auth, security headers, SVG sanitization, and pipeline ownership 
- Add password strength validation (8+ chars, uppercase, lowercase, number)
- Add username validation rules
- Optimize API key lookup with SHA-256 prefix (O(1) vs O(n) scan)
- Require password change on default admin first login
- Revoke API keys on password change
- Add session cleanup cron (hourly expired session purge)
- Add Permissions-Policy, HSTS, and CSP security headers in production
- Strengthen SVG sanitizer: block XInclude, foreignObject, processing
  instructions, javascript/data/file URI schemes
- Add userId ownership to pipelines with authorization checks
- Add keyPrefix column to api_keys table
- Update integration tests for new auth behavior
 2026-03-24 21:38:06 +08:00
Siddharth Kumar Sah 80e536bcf8 chore: remove dead code, add test infrastructure, update docs 
- Delete 3 dead files: use-batch-processor.ts, use-i18n.ts, smart-crop.ts (AI package)
- Remove dead getJobProgress function and unused runPythonScript wrapper
- Remove 6 unused imports across API and web apps
- Remove unused shared types (ImageFormat, AppConfig, ApiError, HealthResponse, JobProgress)
  and constants (SUPPORTED_INPUT_FORMATS/OUTPUT_FORMATS, DEFAULT_OUTPUT_FORMAT)
- Remove unused store method (setOriginalBlobUrl) and clean AI package re-exports
- Add test infrastructure: vitest config, unit/integration/e2e tests, fixtures, screenshots
- Add Docker test infrastructure: Dockerfile.test, docker-compose.test.yml
- Add download_models.py for pre-baking AI model weights in Docker
- Add filename sanitization utility (apps/api/src/lib/filename.ts)
- Update .gitignore to exclude coverage/, *.tsbuildinfo, .superpowers/, test artifacts
- Update .dockerignore to exclude test/coverage/IDE artifacts from builds
- Update docs: remove smart crop from AI docs (uses Sharp directly), update bridge docs
 2026-03-23 11:46:45 +08:00
Siddharth Kumar Sah b3f590c8b3 fix: add SSE progress endpoint to public paths 
The /api/v1/jobs/ endpoint was blocked by auth middleware.
EventSource doesn't support custom headers so auth tokens can't be
sent. The jobId is a random UUID (unguessable capability token), same
security model as the download endpoint.
 2026-03-23 09:16:44 +08:00
Siddharth Kumar Sah 4807bd2726 feat: add semantic-release for automated versioning and help dialog 
- Set up semantic-release with zero-touch CI pipeline on push to main
- Add version sync script to keep all package.json files and APP_VERSION
  constant in sync automatically
- Consolidate Docker publishing into single tag-triggered workflow that
  pushes to both Docker Hub and ghcr.io with semver tags
- Add help dialog with keyboard shortcuts, getting started guide, and
  resource links
- Sync all versions to 0.2.1 to match Docker Hub latest
 2026-03-22 21:25:14 +08:00
Siddharth Kumar Sah ce03aad10f feat: production Docker, Playwright tests, settings API, and bug fixes 
- Add user management endpoints (register, list, delete, change password)
- Add API key management (create, list, delete)
- Add settings persistence endpoints (get, put)
- Wire settings dialog to real backend (People, API Keys, System, Security)
- Fix login auth flow (window.location.href for full reload)
- Fix download URLs returning 401 (make public since UUIDs are unguessable)
- Fix border tool shadowColor validation (accept 6-8 hex digits)
- Fix remove-bg alpha matting fallback (retry without on failure)
- Fix AI tool silent fallbacks (report errors instead of no-ops)
- Add checkerboard background to before/after slider for transparency
- Add progress bars to all AI tool components
- Add Playwright E2E test suite (131 tests across 9 test files)
- Rewrite Dockerfile for production (tsx runtime, pre-baked AI models)
- Add .dockerignore for faster builds
- Add proper accessible labels to login form
 2026-03-22 19:28:57 +08:00
Siddharth Kumar Sah de829003ad fix: resolve 3 critical UX bugs - home upload, auth, and form submit 
1. Home page file drop now shows quick-action tool selector
2. Auth disabled by default in dev (Docker still defaults to true)
3. Tool settings wrapped in forms - Enter key triggers processing
 2026-03-22 11:04:20 +08:00
Siddharth Kumar Sah 4069f4db42 feat: add Swagger/OpenAPI documentation at /api/docs 
Registers @fastify/swagger and @fastify/swagger-ui, adds /api/docs to
public auth paths, and wires up static serving + cleanup cron in
index.ts.
 2026-03-22 03:09:33 +08:00
Siddharth Kumar Sah 3cb7123070 feat: add authentication with default admin user 
Implement custom auth using crypto.scrypt password hashing and UUID
session tokens. Includes login/logout/session endpoints, preHandler
middleware that skips public routes, and automatic default admin
creation on first startup.
 2026-03-22 02:55:10 +08:00