ashim-hq
13a15edc26
fix: remove AI badge from tool cards
2026-04-23 18:18:45 +08:00
ashim-hq
c6196daf54
feat: remove Value Props section
2026-04-23 18:17:47 +08:00
ashim-hq
dbbc35040d
feat: add mouse-responsive parallax to hero background, gradient separator on navbar
2026-04-23 18:15:17 +08:00
ashim-hq
e6d6019d0a
fix: add subtle frosted background to navbar for readability over word cloud
2026-04-23 18:12:44 +08:00
ashim-hq
82e5e9cf90
fix: make navbar transparent to blend with hero, push word cloud below navbar
2026-04-23 18:11:05 +08:00
ashim-hq
b3a19fffea
feat: add tool name word cloud background to hero section
2026-04-23 18:09:28 +08:00
ashim-hq
1a353123d8
feat: add clear tagline to hero section
2026-04-23 18:07:27 +08:00
ashim-hq
60a821357c
feat: restore animated phrase rotation without blinking cursor bar
2026-04-23 18:05:43 +08:00
ashim-hq
8ff4155186
feat: replace typing cursor with static subtitle, add gradient mesh hero background
2026-04-23 18:04:53 +08:00
ashim-hq
c9f648708e
fix: remove all em dashes from landing page copy
2026-04-23 17:58:43 +08:00
ashim-hq
c9d536c561
feat: add Lucide icons to all 47 tools with BentoPDF-style card layout
2026-04-23 17:57:11 +08:00
ashim-hq
49f18847f0
feat: update hero headline, replace bento grid with searchable 47-tool showcase
2026-04-23 17:51:32 +08:00
ashim-hq
a6b79a7972
fix: redesign bento grid with hero AI card, fix navbar icon bug, suppress hydration warning
2026-04-23 17:45:51 +08:00
ashim-hq
984aebc601
feat: add OG image and complete meta tags
2026-04-23 17:31:17 +08:00
ashim-hq
b307005469
feat: assemble all sections into landing page
2026-04-23 17:30:11 +08:00
ashim-hq
a8988c0742
feat: add API Callout, Open Source, and Footer sections
2026-04-23 17:28:41 +08:00
ashim-hq
f7348ee82d
feat: add Enterprise and How It Works sections
2026-04-23 17:26:44 +08:00
ashim-hq
42fc8c5c80
feat: add Value Props and Bento Grid sections
2026-04-23 17:25:11 +08:00
ashim-hq
64f3e3f792
feat: add Navbar and Hero sections
2026-04-23 17:23:09 +08:00
ashim-hq
d22e4c2596
feat: add FadeIn and TypingCursor utility components
2026-04-23 17:21:22 +08:00
ashim-hq
2260d696bc
feat: scaffold Next.js landing page app at apps/landing
2026-04-23 17:19:48 +08:00
Ashim and GitHub
136a4dd641
Merge pull request #93 from ashim-hq/test/comprehensive-coverage
...
test: comprehensive test coverage expansion (+965 tests, 48/48 tools)
2026-04-23 17:12:53 +08:00
ashim-hq
babca4cf97
test: comprehensive test coverage expansion (+965 tests)
...
Add 42 new test files covering all untested tool routes, image engine
internals, AI sidecar bridge, Zustand stores, and cross-format
compatibility. Expand e2e-docker suite with 7 spec files covering all
48 tools against a real Docker container.
Unit tests:
- Image engine: format detection, MIME mapping, metadata parsing, pipeline
- AI bridge: sidecar lifecycle, all 11 tool functions (mocked)
- Web stores: 14 Zustand stores (collage, settings, features, analytics, etc.)
- API helpers: format decoders, page range, file validation
Integration tests:
- 25 tool routes that had zero dedicated tests
- Cross-format matrix: 17 input formats x 3 tools
- Edge cases: zero-byte files, corrupted headers, path traversal, XSS, SQL injection
- Concurrent request handling and pipeline edge cases
E2E-Docker (Playwright against real container):
- 7 spec files: essential, adjustment, conversion, creative, utility, AI, pipeline
- Custom buildMultipart helper for multi-file tool uploads
- AI tools gracefully skip when sidecar not installed
Fixtures:
- Organized test media: formats/ (18 formats) + content/ (17 content types)
- Reduced from 3.1 GB unorganized samples to 33 MB structured fixtures
Bug fix:
- color-adjustments: gamma exposure used invalid single-param gamma() for
positive values; fixed to use two-param gamma(gammaIn, gammaOut) form
2026-04-23 17:12:02 +08:00
Ashim and GitHub
9ff23f38fb
Merge pull request #92 from ashim-hq/fix/auth-false-escalation-90
...
fix: prevent admin escalation when AUTH_ENABLED=false
2026-04-23 14:46:20 +08:00
ashim-hq
7047ce5fae
fix: prevent admin escalation when AUTH_ENABLED=false
...
When auth was disabled, users could log out, reach the login page,
and authenticate with the default admin/admin credentials to gain
full admin privileges — defeating the purpose of AUTH_ENABLED=false.
Defense-in-depth fix across five layers:
- Skip ensureDefaultAdmin() when auth is disabled (no admin user seeded)
- Return 403 from POST /api/auth/login when auth is disabled
- Return synthetic anonymous user from GET /api/auth/session when auth is disabled
- Hide logout button in settings when auth is disabled
- Redirect /login and /change-password to / via AuthGuard when auth is disabled
Closes #90
2026-04-23 14:45:04 +08:00
ashim-hq
19df740880
docs: add Code of Conduct and community guide for GitHub Discussions
...
Establishes Contributor Covenant 2.1 as the project Code of Conduct with
reporting to ashim.hq@gmail.com . Adds a community guide with the 5-category
Discussions layout, a pinned Welcome post draft, and seed post ideas.
2026-04-23 12:57:47 +08:00
ashim-hq
949ac5d15a
docs: add SECURITY.md with vulnerability reporting, hardening checklist, and shared responsibility model
2026-04-23 12:49:44 +08:00
Ashim and GitHub
47376b1664
Merge pull request #91 from ashim-hq/feat/analytics
...
feat: production-grade opt-in product analytics with PostHog and Sentry
2026-04-23 12:40:08 +08:00
ashim-hq
d973ab61ee
fix: robust auth setup and login helpers for E2E analytics tests
2026-04-23 12:08:03 +08:00
ashim-hq
d6a977e149
fix: use full page reload after consent to avoid AuthGuard race condition
2026-04-23 11:19:31 +08:00
ashim-hq
d543141d19
fix: prevent hydration effect from overwriting user consent actions
2026-04-23 11:14:48 +08:00
ashim-hq
fc059c751d
test: comprehensive analytics test suite — unit, API, E2E, air-gapped
2026-04-23 10:58:56 +08:00
ashim-hq
de7b353871
fix: analytics E2E tests for post-auth-setup consent state
...
The auth setup project accepts analytics consent for the admin user
before tests run. The E2E tests incorrectly expected the consent page
to appear on subsequent logins. Fixed by:
- analytics-consent: verify home loads without consent redirect instead
of expecting the consent page to appear
- analytics-privacy-policy: use getByRole("link") for PostHog/Sentry
links to avoid matching multiple elements with getByText
- analytics-no-data-leak: use page.evaluate with in-browser auth token
to toggle analytics via API instead of separate login calls that hit
the rate limiter; handle both "/" and "/analytics-consent" post-login
2026-04-23 10:51:58 +08:00
ashim-hq
e46356c4d5
fix: hydrate analytics store from session data on login
2026-04-23 10:08:24 +08:00
ashim-hq
7275e4bfaa
fix: AuthGuard checks analytics store for real-time consent state
2026-04-23 10:06:46 +08:00
ashim-hq
9724e5229c
test: add comprehensive E2E Playwright tests for analytics feature
...
Covers consent flow, API endpoints, privacy/no-data-leak verification,
disabled-server behavior, settings toggle, and privacy policy page.
2026-04-23 09:59:41 +08:00
ashim-hq
3ef52d0aa9
feat: set PostHog and Sentry default keys for analytics
2026-04-23 00:29:22 +08:00
ashim-hq
9ad94f3d54
docs: update README analytics statement
2026-04-22 19:16:01 +08:00
ashim-hq
c2130148c4
fix: add statement-breakpoint separators to analytics migration
2026-04-22 19:15:38 +08:00
ashim-hq
6e319efadd
feat: add analytics init, identify, search tracking, consent header, settings toggle
2026-04-22 19:14:16 +08:00
ashim-hq
f115275796
feat: add analytics consent page and auth flow integration
2026-04-22 19:10:52 +08:00
ashim-hq
9f66ad85bf
feat: add Sentry error tracking with PII scrubbing
2026-04-22 19:10:28 +08:00
ashim-hq
544f81c48d
feat: add frontend analytics wrapper and consent store
2026-04-22 19:07:50 +08:00
ashim-hq
a3f707a361
feat: instrument tool_used, pipeline_executed, ai_bundle_action events
2026-04-22 19:07:17 +08:00
ashim-hq
39b011eccb
docs: update privacy policy to reflect analytics
2026-04-22 19:06:01 +08:00
ashim-hq
075f017dbf
feat: add backend analytics wrapper, config/consent API routes
2026-04-22 19:03:23 +08:00
ashim-hq
4904e8d140
feat: add analytics env vars, DB schema columns, instance ID generation
2026-04-22 19:00:15 +08:00
ashim-hq
03df555e10
feat: add shared analytics types, events, consent logic, and i18n strings
2026-04-22 18:58:16 +08:00
Ashim and GitHub
5a45bcbc8f
feat: production-grade RBAC with editor role, custom roles, API key scoping, and audit log ( #89 )
...
* feat(rbac): add editor role, 3 new permissions, ownership helper
* feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema
* feat(rbac): wire requirePermission into all routes, add editor role support
* refactor(rbac): replace ad-hoc role checks with permission-based ownership
* feat(rbac): add audit log DB writes + query endpoint
Dual-write audit events to stdout (existing) and SQLite audit_log table.
Add GET /api/v1/audit-log with pagination, action filter, and date range
filtering, gated behind audit:read permission.
* feat(rbac): add API key permission scoping with ceiling enforcement
* feat(rbac): add escalation prevention and last-admin protection
* feat(rbac): add editor role to UI, API key permission scoping in settings
* test(rbac): add full permission matrix integration test
* test(rbac): add editor role E2E tests
* feat(rbac): add custom roles with CRUD API and DB-backed permission lookup
* feat(rbac): add API key expiration
* feat(rbac): add roles management UI and API key expiration to settings
* feat(rbac): add audit log UI to settings
* fix: remove any cast in API key permission validation
* test(rbac): add unit tests for username validation rules
* test(rbac): add unit tests for effective permissions and ownership
* test(rbac): add comprehensive route permission matrix (all routes × all roles)
* test(rbac): add auth route edge case tests (login failures, session expiry, password side effects)
* test(rbac): add escalation prevention tests (register, update, self-demote, last-admin)
* test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation)
* test(rbac): add API key edge cases (name validation, delete behavior, key revocation)
* test(rbac): add audit log edge cases (all events, pagination clamping, structure)
* test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions)
* test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
2026-04-22 18:10:04 +08:00
Ashim and GitHub
2d7a61c18f
feat: allow multi-file selection for automation pipeline ( #88 )
...
* feat: allow multi-file selection for automation pipeline
Add two ways to import server-stored files into the pipeline:
1. Files page: "Pipeline" bulk action button and "Open in Pipeline"
button in file details panel — navigates to /automate with selected
file IDs via React Router state.
2. Automate page: "Import from Library" button opens a modal with
thumbnails, search, and multi-select checkboxes to pick files from
the user's server-stored library.
Both paths download the selected files and load them into the existing
useFileStore, reusing the batch pipeline processing infrastructure.
Closes #35
* fix: resolve 8 pre-existing test failures across unit and integration suites
- file-validation.ts: Return valid:false when Sharp fails to read
metadata for standard formats (PNG, JPEG, BMP) instead of silently
accepting corrupt buffers. CLI-decoded formats already skip Sharp.
- pipeline.ts: Enforce hard cap of 20 steps via .max() instead of
relying on MAX_PIPELINE_STEPS env var (default 0 = unlimited).
Tighten name limit to 100 chars and description to 500 chars to
match test expectations.
- env.ts: Change MAX_LOGO_SIZE_KB default from 2048 to 500 to match
the branding upload size limit the tests verify.
2026-04-22 00:02:00 +08:00
ashim-hq