No description
  • TypeScript 67.5%
  • HTML 24.8%
  • Shell 3.1%
  • JavaScript 1.6%
  • PHP 1.2%
  • Other 1.8%
Find a file
openclawd 2186747940
All checks were successful
Build & Deploy to Staging / Build & Deploy to Staging (push) Successful in 18m58s
security(deps): fix npm audit vulnerabilities (nodemailer CRLF, path-to-regexp ReDoS)
Resolves 7 npm audit findings (3 moderate, 4 high) via `npm audit fix`
— no --force needed, all bumps satisfied by existing semver ranges:

  basic-ftp        5.2.0   -> 5.2.2    (high: FTP command injection via CRLF)
  brace-expansion  1.1.12  -> 1.1.13   (moderate: ReDoS / mem exhaustion)
  nodemailer       8.0.3   -> 8.0.5    (high: SMTP command injection via
                                        CRLF in EHLO/HELO transport name,
                                        GHSA-vvjj-xcjg-gr5g, and envelope.size
                                        injection GHSA-c7w3-x93f-qmm8)
  path-to-regexp   8.3.0   -> 8.4.2    (high: ReDoS, GHSA-j3q9-mxjg-w52f and
                                        GHSA-27v5-c462-wpq7)
  picomatch        4.0.3   -> 4.0.4    (high: method injection + ReDoS)
  vite             0.115.0 -> 0.124.0  (high: path traversal / FS bypass,
                                        dev-only, transitive via vitest)
  yaml             2.x     -> patched  (moderate: stack overflow, dev-only)

Only package-lock.json changed — no source changes required, no API
breaks. nodemailer 8.0.5 is fully backwards-compatible with our usage
in src/services/email.ts.

Adds src/__tests__/no-vulnerable-deps.test.ts as a TDD regression guard:
runs `npm audit --omit=dev --json` and asserts
metadata.vulnerabilities.high === 0 && critical === 0. Network failures
are skipped rather than failing CI. Red→Green verified locally (stashed
lockfile -> 2 high failures; restored -> 0).

Test count: 901 -> 902 (new regression guard). npm audit: 4 high -> 0.
2026-04-10 20:09:44 +02:00
.forgejo/workflows fix: make test suite runnable without DB/Chrome, add tests to CI 2026-02-25 07:07:12 +00:00
deploy Add landing page, tests, Docker deployment, nginx config 2026-02-14 13:01:07 +00:00
dist Document rate limit headers in OpenAPI spec 2026-03-18 11:06:22 +01:00
infrastructure Add comprehensive backup and restore infrastructure 2026-02-15 11:06:42 +00:00
public fix(privacy): self-host Inter font, remove Google Fonts 2026-04-10 11:13:26 +02:00
scripts Add rate limit headers to OpenAPI generation script 2026-03-18 11:08:05 +01:00
sdk feat: add Go, PHP, and Laravel SDKs 2026-02-21 13:29:48 +00:00
src security(deps): fix npm audit vulnerabilities (nodemailer CRLF, path-to-regexp ReDoS) 2026-04-10 20:09:44 +02:00
templates/partials Consolidate build system and add JS minification (fixes BUG-084) 2026-02-22 07:02:59 +00:00
tests Add AuthenticatedRequest type, eliminate apiKeyInfo 'as any' casts 2026-03-08 20:03:15 +01:00
.dockerignore chore: bump to v0.5.2, update sitemap dates, add .dockerignore, update deps 2026-03-02 08:12:30 +01:00
.gitignore chore: remove coverage artifact and gitignore coverage/ 2026-03-19 20:12:45 +01:00
DEPLOYMENT.md Add CI/CD deployment pipeline with Forgejo Actions 2026-02-15 11:02:43 +00:00
docker-compose.yml feat: add SMTP auth support for K3s migration 2026-02-18 12:47:33 +00:00
Dockerfile fix: swagger apis path to src/ + update stale signup/verify test refs 2026-03-18 20:11:17 +01:00
logrotate-docfast Fix: nginx duplicate MIME type, update version to 0.2.1, improve log rotation 2026-02-16 08:36:55 +00:00
nginx-docfast.conf fix: QA audit bugs BUG-051/052/056/057/059/062/063/064/065/066/068 2026-02-17 08:15:03 +00:00
package-lock.json security(deps): fix npm audit vulnerabilities (nodemailer CRLF, path-to-regexp ReDoS) 2026-04-10 20:09:44 +02:00
package.json chore: update @types/pg, add keys.ts branch coverage tests (13 total) 2026-03-21 08:10:27 +01:00
README.md docs: comprehensive README with all endpoints, options, and setup 2026-02-28 11:09:59 +01:00
tsconfig.json Initial MVP: DocFast PDF API 2026-02-14 12:38:06 +00:00
VERSION Add version file - test CI/CD pipeline trigger 2026-02-15 11:03:52 +00:00
vitest.config.ts add @vitest/coverage-v8 for test coverage reporting 2026-03-12 14:13:32 +01:00

DocFast API

Fast, reliable HTML/Markdown/URL to PDF conversion API. EU-hosted, GDPR compliant.

Website: https://docfast.dev Docs: https://docfast.dev/docs Status: https://docfast.dev/status

Features

  • HTML → PDF — Full documents or fragments with optional CSS
  • Markdown → PDF — GitHub-flavored Markdown with syntax highlighting
  • URL → PDF — Render any public webpage as PDF (SSRF-protected)
  • Invoice Templates — Built-in professional invoice template
  • PDF Options — Paper size, orientation, margins, headers/footers, page ranges, scaling

Quick Start

1. Get an API Key

Sign up at https://docfast.dev — free demo available, Pro plan at €9/month for 5,000 PDFs.

2. Generate a PDF

curl -X POST https://docfast.dev/v1/convert/html \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Hello World</h1><p>Your first PDF.</p>"}' \
  -o output.pdf

API Endpoints

Convert HTML to PDF

curl -X POST https://docfast.dev/v1/convert/html \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Hello</h1>", "format": "A4", "margin": {"top": "20mm"}}' \
  -o output.pdf

Convert Markdown to PDF

curl -X POST https://docfast.dev/v1/convert/markdown \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"markdown": "# Hello\n\nWorld", "css": "body { font-family: sans-serif; }"}' \
  -o output.pdf

Convert URL to PDF

curl -X POST https://docfast.dev/v1/convert/url \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "format": "A4", "landscape": true}' \
  -o output.pdf

Invoice Template

curl -X POST https://docfast.dev/v1/templates/invoice/render \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "invoiceNumber": "INV-001",
    "date": "2026-02-14",
    "from": {"name": "Your Company", "email": "you@example.com"},
    "to": {"name": "Client", "email": "client@example.com"},
    "items": [{"description": "Consulting", "quantity": 10, "unitPrice": 150, "taxRate": 20}]
  }' \
  -o invoice.pdf

Demo (No Auth Required)

Try the API without signing up:

curl -X POST https://docfast.dev/v1/demo/html \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1>Demo PDF</h1><p>No API key needed.</p>"}' \
  -o demo.pdf

Demo PDFs include a watermark and are rate-limited.

PDF Options

All conversion endpoints accept these options:

Option Type Default Description
format string "A4" Paper size: A4, Letter, Legal, A3, etc.
landscape boolean false Landscape orientation
margin object {top:"0",right:"0",bottom:"0",left:"0"} Margins in CSS units (px, mm, in, cm)
printBackground boolean true Include background colors/images
filename string "document.pdf" Suggested filename in Content-Disposition
css string — Custom CSS (for HTML fragments and Markdown)
scale number 1 Scale (0.1–2.0)
pageRanges string — Page ranges, e.g. "1-3, 5"
width string — Custom page width (overrides format)
height string — Custom page height (overrides format)
headerTemplate string — HTML template for page header
footerTemplate string — HTML template for page footer
displayHeaderFooter boolean false Show header/footer
preferCSSPageSize boolean false Use CSS @page size over format

Authentication

Pass your API key via either:

  • Authorization: Bearer <key> header
  • X-API-Key: <key> header

Development

# Install dependencies
npm install

# Run in development mode
npm run dev

# Run tests
npm test

# Build
npm run build

# Start production server
npm start

Environment Variables

Variable Required Description
DATABASE_URL Yes PostgreSQL connection string
STRIPE_SECRET_KEY Yes Stripe API key for billing
STRIPE_WEBHOOK_SECRET Yes Stripe webhook signature secret
SMTP_HOST Yes SMTP server hostname
SMTP_PORT Yes SMTP server port
SMTP_USER Yes SMTP username
SMTP_PASS Yes SMTP password
BASE_URL No Base URL (default: https://docfast.dev)
PORT No Server port (default: 3100)
BROWSER_COUNT No Puppeteer browser instances (default: 2)
PAGES_PER_BROWSER No Pages per browser (default: 8)
LOG_LEVEL No Pino log level (default: info)

Architecture

  • Runtime: Node.js + Express
  • PDF Engine: Puppeteer (Chromium) with browser pool
  • Database: PostgreSQL (via pg)
  • Payments: Stripe
  • Email: SMTP (nodemailer)

License

Proprietary — Cloonar Technologies GmbH