Siddharth Kumar Sah
655398e184
test(api): add integration tests for API docs endpoint
...
Also update GitHub Pages REST API doc to link to /api/docs.
2026-03-27 13:50:03 +08:00
Siddharth Kumar Sah
849878e72f
feat(api): register docs route in server and test helper
2026-03-27 13:50:03 +08:00
Siddharth Kumar Sah
6a13065706
feat(api): add logo upload/serve/delete routes with tests
...
Add branding API at /api/v1/settings/logo supporting:
- POST: admin uploads PNG/SVG/JPEG (max 500KB), auto-converts to 128x128 PNG
- GET: public endpoint serves custom logo (404 if none)
- DELETE: admin removes custom logo
Includes 13 integration tests covering upload, conversion, size/type
validation, auth enforcement, resize, and idempotent deletion.
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
acfff754b5
feat(api): add tool filtering and DB-backed cleanup settings
...
Add feature flag support to skip disabled/experimental tools at startup
by reading disabledTools and enableExperimentalTools from the settings
table. Refactor cleanup.ts to read tempFileMaxAgeHours from DB settings
(with env var fallback) and respect the startupCleanup setting.
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
585d66f0c9
refactor: rename Tool.alpha to Tool.experimental
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
ab370a74fe
feat(api): add teams CRUD routes and update auth team references
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
432cc92471
feat: harden auth, security headers, SVG sanitization, and pipeline ownership
...
- Add password strength validation (8+ chars, uppercase, lowercase, number)
- Add username validation rules
- Optimize API key lookup with SHA-256 prefix (O(1) vs O(n) scan)
- Require password change on default admin first login
- Revoke API keys on password change
- Add session cleanup cron (hourly expired session purge)
- Add Permissions-Policy, HSTS, and CSP security headers in production
- Strengthen SVG sanitizer: block XInclude, foreignObject, processing
instructions, javascript/data/file URI schemes
- Add userId ownership to pipelines with authorization checks
- Add keyPrefix column to api_keys table
- Update integration tests for new auth behavior
2026-03-24 21:38:06 +08:00
Siddharth Kumar Sah
e5086ada6e
feat: extract auto-orient utility and expand test coverage
...
Extract EXIF auto-orientation logic into a shared auto-orient module
used by both single-tool and batch routes. This ensures camera photos
display correctly after processing regardless of entry point.
Also expands e2e and integration tests significantly.
2026-03-24 20:37:14 +08:00
Siddharth Kumar Sah
80e536bcf8
chore: remove dead code, add test infrastructure, update docs
...
- Delete 3 dead files: use-batch-processor.ts, use-i18n.ts, smart-crop.ts (AI package)
- Remove dead getJobProgress function and unused runPythonScript wrapper
- Remove 6 unused imports across API and web apps
- Remove unused shared types (ImageFormat, AppConfig, ApiError, HealthResponse, JobProgress)
and constants (SUPPORTED_INPUT_FORMATS/OUTPUT_FORMATS, DEFAULT_OUTPUT_FORMAT)
- Remove unused store method (setOriginalBlobUrl) and clean AI package re-exports
- Add test infrastructure: vitest config, unit/integration/e2e tests, fixtures, screenshots
- Add Docker test infrastructure: Dockerfile.test, docker-compose.test.yml
- Add download_models.py for pre-baking AI model weights in Docker
- Add filename sanitization utility (apps/api/src/lib/filename.ts)
- Update .gitignore to exclude coverage/, *.tsbuildinfo, .superpowers/, test artifacts
- Update .dockerignore to exclude test/coverage/IDE artifacts from builds
- Update docs: remove smart crop from AI docs (uses Sharp directly), update bridge docs
2026-03-23 11:46:45 +08:00
Siddharth Kumar Sah