Siddharth Kumar Sah
4577d5c30e
fix: simplify public health to static response, add 403 test
...
Remove DB probe from public health endpoint - it only needs to confirm
the process is alive. Add test for non-admin user getting 403 on admin
health endpoint.
2026-03-28 19:08:17 +08:00
Siddharth Kumar Sah
818e5877a7
fix: move health diagnostics behind admin auth
...
Public GET /api/v1/health now returns only status and version.
Full diagnostics (uptime, storage, database, queue) moved to
GET /api/v1/admin/health which requires admin authentication.
2026-03-28 19:08:17 +08:00
Siddharth Kumar Sah
b08e006512
fix(tests): remove temp DB cleanup that races with other test files
...
The integration test cleanup was deleting the shared temp directory
(rmSync on dirname(DB_PATH)), which causes SQLITE_IOERR_FSTAT in
other test files that still reference the same database. The temp
directory uses a random UUID under /tmp and is cleaned up by the OS.
2026-03-28 12:49:23 +08:00
Siddharth Kumar Sah
849878e72f
feat(api): register docs route in server and test helper
2026-03-27 13:50:03 +08:00
Siddharth Kumar Sah
6a13065706
feat(api): add logo upload/serve/delete routes with tests
...
Add branding API at /api/v1/settings/logo supporting:
- POST: admin uploads PNG/SVG/JPEG (max 500KB), auto-converts to 128x128 PNG
- GET: public endpoint serves custom logo (404 if none)
- DELETE: admin removes custom logo
Includes 13 integration tests covering upload, conversion, size/type
validation, auth enforcement, resize, and idempotent deletion.
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
ab370a74fe
feat(api): add teams CRUD routes and update auth team references
2026-03-26 01:10:51 +08:00
Siddharth Kumar Sah
432cc92471
feat: harden auth, security headers, SVG sanitization, and pipeline ownership
...
- Add password strength validation (8+ chars, uppercase, lowercase, number)
- Add username validation rules
- Optimize API key lookup with SHA-256 prefix (O(1) vs O(n) scan)
- Require password change on default admin first login
- Revoke API keys on password change
- Add session cleanup cron (hourly expired session purge)
- Add Permissions-Policy, HSTS, and CSP security headers in production
- Strengthen SVG sanitizer: block XInclude, foreignObject, processing
instructions, javascript/data/file URI schemes
- Add userId ownership to pipelines with authorization checks
- Add keyPrefix column to api_keys table
- Update integration tests for new auth behavior
2026-03-24 21:38:06 +08:00
Siddharth Kumar Sah
80e536bcf8
chore: remove dead code, add test infrastructure, update docs
...
- Delete 3 dead files: use-batch-processor.ts, use-i18n.ts, smart-crop.ts (AI package)
- Remove dead getJobProgress function and unused runPythonScript wrapper
- Remove 6 unused imports across API and web apps
- Remove unused shared types (ImageFormat, AppConfig, ApiError, HealthResponse, JobProgress)
and constants (SUPPORTED_INPUT_FORMATS/OUTPUT_FORMATS, DEFAULT_OUTPUT_FORMAT)
- Remove unused store method (setOriginalBlobUrl) and clean AI package re-exports
- Add test infrastructure: vitest config, unit/integration/e2e tests, fixtures, screenshots
- Add Docker test infrastructure: Dockerfile.test, docker-compose.test.yml
- Add download_models.py for pre-baking AI model weights in Docker
- Add filename sanitization utility (apps/api/src/lib/filename.ts)
- Update .gitignore to exclude coverage/, *.tsbuildinfo, .superpowers/, test artifacts
- Update .dockerignore to exclude test/coverage/IDE artifacts from builds
- Update docs: remove smart crop from AI docs (uses Sharp directly), update bridge docs
2026-03-23 11:46:45 +08:00
Siddharth Kumar Sah