ashim-hq
9a2371053a
feat: add licensing page with AGPL-3.0 and commercial license tiers
2026-04-23 19:34:25 +08:00
ashim-hq
d588f5fd93
feat: redesign navbar with Features, Download, API, Pricing, Docs, About, Contact links, GitHub star button, and Book a Demo CTA
2026-04-23 18:32:26 +08:00
ashim-hq
0c40c4dcfc
fix: add suppressHydrationWarning to body for Dark Reader compatibility
2026-04-23 18:29:48 +08:00
ashim-hq
8f6600f55e
feat: add Why Choose SnapOtter section, expand hero animation phrases
2026-04-23 18:28:05 +08:00
ashim-hq
3e6001ec09
feat: add no signups, unlimited use, works offline to hero phrases
2026-04-23 18:25:36 +08:00
ashim-hq
44f015a8ce
fix: remove artificial limits from Pipelines description, now unlimited
2026-04-23 18:24:01 +08:00
ashim-hq
6f728fe629
feat: add Three Ways to Use and Industry Use Cases sections
2026-04-23 18:22:22 +08:00
ashim-hq
97a8d54ba7
fix: rewrite enterprise subtitle to be clearer and not misleading
2026-04-23 18:19:03 +08:00
ashim-hq
13a15edc26
fix: remove AI badge from tool cards
2026-04-23 18:18:45 +08:00
ashim-hq
c6196daf54
feat: remove Value Props section
2026-04-23 18:17:47 +08:00
ashim-hq
dbbc35040d
feat: add mouse-responsive parallax to hero background, gradient separator on navbar
2026-04-23 18:15:17 +08:00
ashim-hq
e6d6019d0a
fix: add subtle frosted background to navbar for readability over word cloud
2026-04-23 18:12:44 +08:00
ashim-hq
82e5e9cf90
fix: make navbar transparent to blend with hero, push word cloud below navbar
2026-04-23 18:11:05 +08:00
ashim-hq
b3a19fffea
feat: add tool name word cloud background to hero section
2026-04-23 18:09:28 +08:00
ashim-hq
1a353123d8
feat: add clear tagline to hero section
2026-04-23 18:07:27 +08:00
ashim-hq
60a821357c
feat: restore animated phrase rotation without blinking cursor bar
2026-04-23 18:05:43 +08:00
ashim-hq
8ff4155186
feat: replace typing cursor with static subtitle, add gradient mesh hero background
2026-04-23 18:04:53 +08:00
ashim-hq
c9f648708e
fix: remove all em dashes from landing page copy
2026-04-23 17:58:43 +08:00
ashim-hq
c9d536c561
feat: add Lucide icons to all 47 tools with BentoPDF-style card layout
2026-04-23 17:57:11 +08:00
ashim-hq
49f18847f0
feat: update hero headline, replace bento grid with searchable 47-tool showcase
2026-04-23 17:51:32 +08:00
ashim-hq
a6b79a7972
fix: redesign bento grid with hero AI card, fix navbar icon bug, suppress hydration warning
2026-04-23 17:45:51 +08:00
ashim-hq
984aebc601
feat: add OG image and complete meta tags
2026-04-23 17:31:17 +08:00
ashim-hq
b307005469
feat: assemble all sections into landing page
2026-04-23 17:30:11 +08:00
ashim-hq
a8988c0742
feat: add API Callout, Open Source, and Footer sections
2026-04-23 17:28:41 +08:00
ashim-hq
f7348ee82d
feat: add Enterprise and How It Works sections
2026-04-23 17:26:44 +08:00
ashim-hq
42fc8c5c80
feat: add Value Props and Bento Grid sections
2026-04-23 17:25:11 +08:00
ashim-hq
64f3e3f792
feat: add Navbar and Hero sections
2026-04-23 17:23:09 +08:00
ashim-hq
d22e4c2596
feat: add FadeIn and TypingCursor utility components
2026-04-23 17:21:22 +08:00
ashim-hq
2260d696bc
feat: scaffold Next.js landing page app at apps/landing
2026-04-23 17:19:48 +08:00
Ashim and GitHub
136a4dd641
Merge pull request #93 from ashim-hq/test/comprehensive-coverage
...
test: comprehensive test coverage expansion (+965 tests, 48/48 tools)
2026-04-23 17:12:53 +08:00
ashim-hq
babca4cf97
test: comprehensive test coverage expansion (+965 tests)
...
Add 42 new test files covering all untested tool routes, image engine
internals, AI sidecar bridge, Zustand stores, and cross-format
compatibility. Expand e2e-docker suite with 7 spec files covering all
48 tools against a real Docker container.
Unit tests:
- Image engine: format detection, MIME mapping, metadata parsing, pipeline
- AI bridge: sidecar lifecycle, all 11 tool functions (mocked)
- Web stores: 14 Zustand stores (collage, settings, features, analytics, etc.)
- API helpers: format decoders, page range, file validation
Integration tests:
- 25 tool routes that had zero dedicated tests
- Cross-format matrix: 17 input formats x 3 tools
- Edge cases: zero-byte files, corrupted headers, path traversal, XSS, SQL injection
- Concurrent request handling and pipeline edge cases
E2E-Docker (Playwright against real container):
- 7 spec files: essential, adjustment, conversion, creative, utility, AI, pipeline
- Custom buildMultipart helper for multi-file tool uploads
- AI tools gracefully skip when sidecar not installed
Fixtures:
- Organized test media: formats/ (18 formats) + content/ (17 content types)
- Reduced from 3.1 GB unorganized samples to 33 MB structured fixtures
Bug fix:
- color-adjustments: gamma exposure used invalid single-param gamma() for
positive values; fixed to use two-param gamma(gammaIn, gammaOut) form
2026-04-23 17:12:02 +08:00
ashim-hq
7047ce5fae
fix: prevent admin escalation when AUTH_ENABLED=false
...
When auth was disabled, users could log out, reach the login page,
and authenticate with the default admin/admin credentials to gain
full admin privileges — defeating the purpose of AUTH_ENABLED=false.
Defense-in-depth fix across five layers:
- Skip ensureDefaultAdmin() when auth is disabled (no admin user seeded)
- Return 403 from POST /api/auth/login when auth is disabled
- Return synthetic anonymous user from GET /api/auth/session when auth is disabled
- Hide logout button in settings when auth is disabled
- Redirect /login and /change-password to / via AuthGuard when auth is disabled
Closes #90
2026-04-23 14:45:04 +08:00
ashim-hq
d6a977e149
fix: use full page reload after consent to avoid AuthGuard race condition
2026-04-23 11:19:31 +08:00
ashim-hq
d543141d19
fix: prevent hydration effect from overwriting user consent actions
2026-04-23 11:14:48 +08:00
ashim-hq
e46356c4d5
fix: hydrate analytics store from session data on login
2026-04-23 10:08:24 +08:00
ashim-hq
7275e4bfaa
fix: AuthGuard checks analytics store for real-time consent state
2026-04-23 10:06:46 +08:00
ashim-hq
3ef52d0aa9
feat: set PostHog and Sentry default keys for analytics
2026-04-23 00:29:22 +08:00
ashim-hq
c2130148c4
fix: add statement-breakpoint separators to analytics migration
2026-04-22 19:15:38 +08:00
ashim-hq
6e319efadd
feat: add analytics init, identify, search tracking, consent header, settings toggle
2026-04-22 19:14:16 +08:00
ashim-hq
f115275796
feat: add analytics consent page and auth flow integration
2026-04-22 19:10:52 +08:00
ashim-hq
9f66ad85bf
feat: add Sentry error tracking with PII scrubbing
2026-04-22 19:10:28 +08:00
ashim-hq
544f81c48d
feat: add frontend analytics wrapper and consent store
2026-04-22 19:07:50 +08:00
ashim-hq
a3f707a361
feat: instrument tool_used, pipeline_executed, ai_bundle_action events
2026-04-22 19:07:17 +08:00
ashim-hq
39b011eccb
docs: update privacy policy to reflect analytics
2026-04-22 19:06:01 +08:00
ashim-hq
075f017dbf
feat: add backend analytics wrapper, config/consent API routes
2026-04-22 19:03:23 +08:00
ashim-hq
4904e8d140
feat: add analytics env vars, DB schema columns, instance ID generation
2026-04-22 19:00:15 +08:00
Ashim and GitHub
5a45bcbc8f
feat: production-grade RBAC with editor role, custom roles, API key scoping, and audit log ( #89 )
...
* feat(rbac): add editor role, 3 new permissions, ownership helper
* feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema
* feat(rbac): wire requirePermission into all routes, add editor role support
* refactor(rbac): replace ad-hoc role checks with permission-based ownership
* feat(rbac): add audit log DB writes + query endpoint
Dual-write audit events to stdout (existing) and SQLite audit_log table.
Add GET /api/v1/audit-log with pagination, action filter, and date range
filtering, gated behind audit:read permission.
* feat(rbac): add API key permission scoping with ceiling enforcement
* feat(rbac): add escalation prevention and last-admin protection
* feat(rbac): add editor role to UI, API key permission scoping in settings
* test(rbac): add full permission matrix integration test
* test(rbac): add editor role E2E tests
* feat(rbac): add custom roles with CRUD API and DB-backed permission lookup
* feat(rbac): add API key expiration
* feat(rbac): add roles management UI and API key expiration to settings
* feat(rbac): add audit log UI to settings
* fix: remove any cast in API key permission validation
* test(rbac): add unit tests for username validation rules
* test(rbac): add unit tests for effective permissions and ownership
* test(rbac): add comprehensive route permission matrix (all routes × all roles)
* test(rbac): add auth route edge case tests (login failures, session expiry, password side effects)
* test(rbac): add escalation prevention tests (register, update, self-demote, last-admin)
* test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation)
* test(rbac): add API key edge cases (name validation, delete behavior, key revocation)
* test(rbac): add audit log edge cases (all events, pagination clamping, structure)
* test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions)
* test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
2026-04-22 18:10:04 +08:00
Ashim and GitHub
2d7a61c18f
feat: allow multi-file selection for automation pipeline ( #88 )
...
* feat: allow multi-file selection for automation pipeline
Add two ways to import server-stored files into the pipeline:
1. Files page: "Pipeline" bulk action button and "Open in Pipeline"
button in file details panel — navigates to /automate with selected
file IDs via React Router state.
2. Automate page: "Import from Library" button opens a modal with
thumbnails, search, and multi-select checkboxes to pick files from
the user's server-stored library.
Both paths download the selected files and load them into the existing
useFileStore, reusing the batch pipeline processing infrastructure.
Closes #35
* fix: resolve 8 pre-existing test failures across unit and integration suites
- file-validation.ts: Return valid:false when Sharp fails to read
metadata for standard formats (PNG, JPEG, BMP) instead of silently
accepting corrupt buffers. CLI-decoded formats already skip Sharp.
- pipeline.ts: Enforce hard cap of 20 steps via .max() instead of
relying on MAX_PIPELINE_STEPS env var (default 0 = unlimited).
Tighten name limit to 100 chars and description to 500 chars to
match test expectations.
- env.ts: Change MAX_LOGO_SIZE_KB default from 2048 to 500 to match
the branding upload size limit the tests verify.
2026-04-22 00:02:00 +08:00
ashim-hq
9a015c8501
fix: AVIF sidecar crash, edit-metadata silent no-op, passport batch blank images, color-palette hex overflow, OCR log noise
...
- Convert all AI bridge inputs to PNG before writing to disk so PIL can
read AVIF/WebP/TIFF (7 bridge files; face-detection and OCR already
had this pattern)
- Add title/author aliases to edit-metadata schema so common field names
actually write EXIF tags instead of being silently stripped by Zod
- Port extend/pad crop logic from passport-photo single endpoint to the
batch pipeline so crop regions extending beyond the image get filled
with background color instead of producing all-white output
- Clamp quantized color channels to 255 in color-palette to prevent
Math.round(255/16)*16=256 from producing invalid hex like #100100100
- Compare OCR fallback warning against expected engine name per tier
instead of comparing engine name against tier name (always mismatch)
2026-04-21 23:54:25 +08:00
Ashim and GitHub
6fcf43016d
Merge pull request #86 from ashim-hq/fix/issue-72-auth-false-admin
...
fix: prevent admin escalation when AUTH_ENABLED=false
2026-04-21 23:42:18 +08:00
ashim-hq