mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
AshimandGitHub
5a45bcbc8f
* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
Key Features
- 45+ image tools - Resize, crop, compress, convert, watermark, color adjust, vectorize, create GIFs, find duplicates, generate passport photos, and more
- Local AI - Remove backgrounds, upscale images, restore and colorize old photos, erase objects, blur faces, enhance faces, extract text (OCR). All on your hardware - no internet required
- Pipelines - Chain tools into reusable workflows. Batch process up to 200 images at once
- REST API - Every tool available via API with API key auth. Interactive docs at
/api/docs - Single container - One
docker run, no Redis, no Postgres, no external services - Multi-arch - Runs on AMD64 and ARM64 (Intel, Apple Silicon, Raspberry Pi)
- Your data stays yours - No telemetry, no tracking, no external calls. Images never leave your machine
Quick Start
docker run -d --name ashim -p 1349:1349 -v ashim-data:/data ghcr.io/ashim-hq/ashim:latest
Open http://localhost:1349 in your browser.
Have an NVIDIA GPU? Click here for GPU acceleration.
Add --gpus all for GPU-accelerated background removal, upscaling, and OCR:
docker run -d --name ashim -p 1349:1349 --gpus all -v ashim-data:/data ghcr.io/ashim-hq/ashim:latest
Requires an NVIDIA GPU and Container Toolkit. Falls back to CPU if no GPU is found. See Docker Tags for benchmarks and Docker Compose examples.
Default credentials:
| Field | Value |
|---|---|
| Username | admin |
| Password | admin |
You will be asked to change your password on first login.
For Docker Compose, persistent storage, and other setup options, see the Getting Started Guide. For GPU acceleration and tag details, see Docker Tags.
Documentation
Feedback
Found a bug or have a feature idea? Open a GitHub Issue. We don't accept pull requests, but your feedback directly shapes the project. See CONTRIBUTING.md for details.
License
This project is dual-licensed under the AGPLv3 and a commercial license.
- AGPLv3 (free): You may use, modify, and distribute this software under the AGPLv3. If you run a modified version as a network service, you must make your source code available under the AGPLv3. This applies to personal use, open-source projects, and any use that complies with AGPLv3 terms.
- Commercial license (paid): For use in proprietary software or SaaS products where AGPLv3 source-disclosure is not suitable, a commercial license is available. Contact us for pricing and terms.