Commit graph

17 commits

Author SHA1 Message Date
SnapAPI Security Hardening
ba888bb580 feat: harden SSRF protection with comprehensive security improvements
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 10m4s
- Block IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, etc.)
- Block IPv6 unspecified address (::)
- Add CSS injection sanitization for hideSelectors (no {}<>;)
- Add waitForSelector validation (max 200 chars, no javascript:/script)
- Add CSS parameter hardening (block @import, url() with non-data: schemes)
- Add 21 new security tests following TDD approach
- All 387 tests passing

Fixes potential SSRF bypasses and CSS injection vulnerabilities
2026-03-05 09:04:59 +01:00
0999474fbd feat: add css parameter for custom CSS injection in screenshots
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 10m33s
2026-03-04 21:06:50 +01:00
96d21aa63b feat: add darkMode and hideSelectors screenshot parameters
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m31s
- darkMode: emulates prefers-color-scheme: dark before navigation
- hideSelectors: injects CSS to hide elements before capture
  - POST: accepts string or string array
  - GET: accepts comma-separated string
  - Validation: max 10 selectors, each max 200 chars
- OpenAPI docs updated for both GET and POST endpoints
- 13 new tests added (service + route)
2026-03-04 12:06:26 +01:00
9575d312fe fix: cancelled tier, remove key logging, add billing rate limits
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 10m13s
- Add 'cancelled' tier (0 req/month) for downgraded subscriptions
- Remove full API key from recovery endpoint logs (security)
- Add IP-based rate limiting (10/15min) to billing endpoints
- Bump version to 0.7.0
- 4 new tests (338 total)
2026-03-04 09:06:16 +01:00
05c91e6747 test: add unit tests for browser pool and screenshot services
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 10m56s
2026-03-03 15:07:02 +01:00
9fe59d4867 feat: add WCAG 2.1 AA accessibility landmarks and skip-to-content link
Some checks failed
Build & Deploy to Staging / Build & Deploy to Staging (push) Has been cancelled
- Wrap nav in <header> landmark on all pages
- Wrap content in <main id='main-content'> on all pages
- Add skip-to-content link (visually hidden, visible on focus)
- Add skip-link CSS styles
- Add 65 accessibility tests covering all 16 full-layout pages
- All 288 tests passing
2026-03-03 15:04:55 +01:00
SnapAPI Test Agent
c32436631a feat: Add Stripe Customer Portal for API Key Recovery
Some checks failed
Build & Deploy to Staging / Build & Deploy to Staging (push) Has been cancelled
- Add POST /v1/billing/portal endpoint for customer portal access
- Add GET /v1/billing/recover endpoint for API key recovery
- Implement getKeyByEmail() and getCustomerIdByEmail() service functions
- Add comprehensive test coverage for new endpoints and services
- Create dedicated recovery page at /recovery.html with forms
- Add 'Lost your API key?' link on landing page near pricing
- Update OpenAPI documentation for new endpoints
- Return masked API keys for security (snap_xxxx...xxxx format)
- Log full keys for manual email sending (email service TBD)
- Include proper error handling and input validation
2026-02-25 08:06:38 +00:00
SnapAPI Test Agent
a20828b09c Add comprehensive route-level unit tests
Some checks failed
Build & Deploy to Staging / Build & Deploy to Staging (push) Has been cancelled
- Add playground.test.ts with 14 tests for playground endpoint
- Add screenshot.test.ts with 17 tests for screenshot endpoint
- Add health.test.ts with 7 tests for health endpoint
- Add watermark.test.ts with 14 tests for watermark service

Total: 52 new tests covering:
- Input validation and error handling
- Authentication and authorization scenarios
- Caching behavior and cache bypass
- Parameter normalization and limits
- SSRF protection and blocked URLs
- Service error conditions (timeouts, queue full)
- Browser pool integration
- Watermark image processing logic

All tests pass and use proper mocking of dependencies.
2026-02-25 08:05:53 +00:00
f696cb36db fix: lazy Stripe init (unblocks test suite) + add auth/keys unit tests
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m47s
- billing.ts: Stripe now initialized lazily via getStripe() instead of at module load
  This prevents test suite crash when STRIPE_SECRET_KEY env var is not set
- Add src/middleware/__tests__/auth.test.ts (6 tests): key extraction from
  Bearer header, X-API-Key header, query param; 401/403 responses; priority order
- Add src/services/__tests__/keys.test.ts (6 tests): getTierLimit for all tiers
- Total: 61 tests passing, 0 failures
2026-02-24 16:26:54 +00:00
cda259a3c6 Add comprehensive test framework with vitest and TDD tests
Some checks failed
Build & Deploy to Staging / Build & Deploy to Staging (push) Has been cancelled
- Set up vitest test framework with proper configuration
- Added test scripts to package.json (test, test:watch, test:ui)
- Created comprehensive SSRF validation tests (30 tests)
  - Tests for protocol validation (HTTP/HTTPS only)
  - Private IP blocking (127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x)
  - Kubernetes service DNS blocking (.svc, .cluster.local, etc.)
  - URL length validation (max 2048 chars)
  - DNS resolution error handling
  - Edge cases with ports, query params, userinfo
- Created cache service tests (19 tests)
  - Cache hit/miss operations
  - Deterministic key generation
  - TTL expiry behavior
  - Size limits and LRU eviction
  - Cache bypass logic
  - Statistics tracking
- Created integration test suite (marked as skip for CI)
  - Health endpoint tests
  - Playground endpoint tests with rate limiting
  - Authentication tests for screenshot endpoints
  - CORS header validation
  - Error handling and security headers
- All unit tests pass (49 total tests)
- Following strict Red/Green TDD methodology
2026-02-24 16:23:06 +00:00
b07b9cfd25 fix: return 400 for invalid protocols and unresolvable hostnames (was 500)
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m41s
2026-02-24 14:00:55 +00:00
5ec8c92413 fix: reject URLs longer than 2048 chars (BUG-011 DoS prevention)
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m12s
2026-02-24 11:05:43 +00:00
OpenClaw Agent
44e31e355c Add GET endpoint support, response caching, and update landing page
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m11s
- Add GET /v1/screenshot endpoint with query parameter support
- Support API key authentication via ?key= query parameter
- Implement in-memory LRU cache with configurable TTL (5min) and size limits (100MB)
- Add X-Cache headers (HIT/MISS) to indicate cache status
- Add cache bypass option via ?cache=false parameter
- Update OpenAPI documentation with GET endpoint and caching info
- Add GET/Embed code examples to landing page hero section
- Add Response Caching and GET Request Support feature cards
- Update features grid layout to accommodate new features
2026-02-24 08:05:43 +00:00
609e7d0808 fix: hot-swap browser restart to prevent QUEUE_FULL with single browser
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 9m21s
Root cause: With BROWSER_COUNT=1, the hourly browser restart set
restarting=true, drained all pages, closed the browser, THEN launched
a new one. During that window (seconds), all requests queued and
timed out after 30s with QUEUE_FULL errors.

Fix: Launch the new browser BEFORE closing the old one (hot-swap).
This ensures zero downtime during browser recycling, even with a
single browser instance.
2026-02-24 07:51:05 +00:00
d20fbbfe2e perf: switch to domcontentloaded default, optimize browser pool, fix swagger paths
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 7m59s
Performance fixes:
- Default waitUntil changed from networkidle2 to domcontentloaded (saves ~500ms+)
- Add waitUntil parameter so users can choose (load/domcontentloaded/networkidle0/networkidle2)
- Optimize page recycle: use DOM reset instead of about:blank navigation
- Add Chromium flags to disable unnecessary features (background networking, extensions, sync, etc.)

Swagger fixes:
- Fix apis glob to include dist/*.js (was only matching src/*.ts, empty at runtime)
- Document new waitUntil parameter on POST /v1/screenshot
- Add OpenAPI docs for /status endpoint
2026-02-20 12:39:06 +00:00
e49c4073f8 fix: stagger browser restarts to prevent simultaneous QUEUE_FULL
Some checks failed
Deploy to Staging / build-and-deploy (push) Failing after 10m37s
- Only allow one browser to restart at a time in acquirePage()
- Stagger initial lastRestartTime by RESTART_AFTER_MS/BROWSER_COUNT per instance
2026-02-20 08:03:01 +00:00
b58f634318 feat: initial codebase v0.4.1
Some checks failed
Deploy to Staging / build-and-deploy (push) Failing after 9m44s
- Extract complete codebase from running staging pod
- Add Dockerfile with multi-stage build for Node.js + Puppeteer
- Configure CI/CD workflows for staging and production deployment
- Include all source files, configs, and public assets
2026-02-19 17:05:16 +00:00