280 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
OpenClaw Subagent	0a4fcd2e50	chore: update @types/pg, add keys.ts branch coverage tests (13 total)	2026-03-21 08:10:27 +01:00
OpenClaw Subagent	50b4ee3fd4	test: add releasePage error recovery path tests (TDD) ... 4 new tests in browser-releasepage.test.ts covering: - Fallback to newPage when recyclePage fails with waiter queued - Waiter re-queued when browser is restarting during recycle failure - Double failure (recyclePage + newPage) waiter recovery - Page return to pool after successful render with no waiters 849 tests total (84 files), all passing.	2026-03-20 20:07:44 +01:00
OpenClaw Subagent	ab89085a0b	chore: update marked 17.0.5, add global error handler tests (TDD)	2026-03-20 17:07:56 +01:00
OpenClaw Subagent	eea9489efc	docs: add X-Render-Time header to OpenAPI spec	2026-03-20 11:09:20 +01:00
OpenClaw Subagent	4a2103c60e	chore: update puppeteer 24.40.0, add SSRF DNS pinning tests (TDD) ... - Updated puppeteer 24.39.1 → 24.40.0 - Added 7 TDD tests for renderUrlPdf SSRF protection branches: - HTTP request rewrite to pinned IP with Host header - HTTPS request passthrough (cert compatibility) - Blocking requests to non-target hosts - Blocking cloud metadata endpoint (169.254.169.254) - No interception when hostResolverRules absent - No interception when invalid MAP format - Request interception setup verification - Tests: 834 passing (82 files), ZERO failures	2026-03-20 08:11:34 +01:00
OpenClaw Subagent	789d36ea04	chore: remove coverage artifact and gitignore coverage/	2026-03-19 20:12:45 +01:00
OpenClaw Subagent	e6638fb929	test: improve billing webhook branch coverage ... Added edge case tests for: - Line 231-233: checkout.session.completed webhook catch block when session.retrieve fails - Line 165: /success route !customerId check with various falsy values - Line 315: getOrCreateProPrice() else branch when no product exists All 827 tests pass.	2026-03-19 20:12:28 +01:00
OpenClaw Subagent	6d1d8f405f	fix: add aria-modal and aria-label='Close' to modal dialogs (TDD)	2026-03-19 14:06:08 +01:00
OpenClaw Subagent	b58695bdb8	fix: remove contradictory vi.unmock breaking recover DB fallback tests ... The test file had both vi.unmock and vi.mock for the same module. vi.unmock takes precedence in Vitest, so getAllKeys was the real function instead of a mock, causing mockReturnValueOnce to fail.	2026-03-19 11:07:22 +01:00
OpenClaw Subagent	2e8a240654	fix: remove unnecessary 'as any' casts and add proper types to templates ... - Replace (req as any).requestId with req.requestId in index.ts, recover.ts, email-change.ts - Replace (err as any).status with proper Record<string, unknown> narrowing in error handler - Add InvoiceData, ReceiptData, ContactInfo, InvoiceItem, ReceiptItem interfaces to templates.ts - Replace all 'any' params in template functions with proper types - Add type-safety regression tests (grep-based) - 818 tests pass, tsc --noEmit: 0 errors	2026-03-19 08:12:30 +01:00
OpenClaw Subagent	4057bd9d91	chore: update nodemailer 8.0.2→8.0.3, swagger-ui-dist 5.32.0→5.32.1	2026-03-18 20:12:23 +01:00
OpenClaw Subagent	392fc029fe	fix: swagger apis path to src/ + update stale signup/verify test refs ... - swagger.ts: changed apis glob from dist/routes/*.js to src/routes/*.ts so OpenAPI spec includes demo endpoints during tests (fixes 6 test failures) - Dockerfile: copy src/ to final stage for runtime swagger-jsdoc - Updated stale /v1/signup/verify test refs to /v1/signup/free (endpoint was removed when free tier was discontinued)	2026-03-18 20:11:17 +01:00
OpenClaw Subagent	9e1d4d86fb	fix: sanitize path traversal in filename (TDD)	2026-03-18 17:03:56 +01:00
OpenClaw Subagent	f0cb83a901	Add rate limit headers to OpenAPI generation script ... - Update generate-openapi.mjs to include header components - Ensure public/openapi.json has rate limit headers - Update rate limits description in generation script	2026-03-18 11:08:05 +01:00
OpenClaw Subagent	70eb6908e3	Document rate limit headers in OpenAPI spec ... - Add reusable header components (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After) - Reference headers in 200 responses on all conversion and demo endpoints - Add Retry-After header to 429 responses - Update Rate Limits section in API description to mention response headers - Add comprehensive tests for header documentation (21 new tests) - All 809 tests passing	2026-03-18 11:06:22 +01:00
OpenClaw Subagent	a3bba8f0d5	fix: add global error handler + try/catch in recover & email-change routes (BUG-112)	2026-03-17 17:10:36 +01:00
OpenClaw Subagent	2dfb0ac784	chore: update nanoid 5.1.7, terser 5.46.1	2026-03-17 11:06:03 +01:00
OpenClaw Subagent	f7a999276b	test: add HTTP rewrite and block-other-host SSRF branch tests for browser.ts	2026-03-15 11:13:49 +01:00
OpenClaw Subagent	bbc106f518	test: improve health.ts and browser.ts coverage ... - health.ts: Added tests for timeout race, version regex edge cases, non-Error catch blocks - browser.ts: Added comprehensive edge case test for buildPdfOptions with all fields - Branch coverage: health.ts improved from 50% to 83.33% - Function coverage: health.ts improved from 75% to 100% - Overall function coverage improved from 84.46% to 84.95% - Total tests: 772 → 776 (+4 new tests)	2026-03-15 08:06:39 +01:00
OpenClaw Subagent	1363c61e39	test: improve billing.ts and demo.ts branch coverage	2026-03-14 17:13:36 +01:00
OpenClaw Subagent	3aae96fd8a	test: improve keys.ts branch coverage — cache-hit paths for createProKey, downgradeByCustomer, findKeyByCustomerId	2026-03-14 14:18:50 +01:00
OpenClaw Subagent	f5ec837e20	test: improve branch coverage for billing.ts and keys.ts ... billing.ts branches: 78.66% → 82.66% - isDocFastSubscription expanded product object (not just string) - isDocFastSubscription error handling path - getOrCreateProPrice: new product + price creation - getOrCreateProPrice: existing product, no active prices keys.ts: - createProKey UPSERT ON CONFLICT path (DB-only key) - downgradeByCustomer customer not found in cache or DB - updateKeyEmail DB fallback not-found path - updateEmailByCustomer DB fallback not-found path 14 new tests, all 743 passing.	2026-03-14 11:09:01 +01:00
OpenClaw Subagent	2bdf93d09f	feat(tests): improve pdfRateLimit middleware test coverage ... - Add tests for per-key queue fairness rejection path (MAX_QUEUED_PER_KEY) - Add tests for cleanupExpiredEntries behavior and automatic cleanup - Cover edge cases with unknown API keys - Tests improve branch coverage for lines around 103, 116-117, 149	2026-03-14 08:12:20 +01:00
OpenClaw Subagent	14181d17a7	fix: override yauzl to 3.2.1 to resolve moderate vulnerability ... yauzl <3.2.1 has an off-by-one error (GHSA-gmq8-994r-jv83). Transitive dependency via puppeteer → @puppeteer/browsers → extract-zip. npm overrides pins yauzl@3.2.1 without changing puppeteer version. npm audit now reports 0 vulnerabilities.	2026-03-14 08:02:50 +01:00
OpenClaw Subagent	8f70a32f77	test: improve coverage for health.ts and email-change.ts ... - Add test for health.ts: client.query() error path with client.release(true) - Add test for email-change.ts: sendVerificationEmail failure (fire-and-forget) - Add test for email-change.ts verify: invalid API key (403 response) Coverage improvements: - health.ts: 87.09% → 100% lines (covered lines 84-85) - email-change.ts: 94.33% → 100% lines, 80% → 100% functions (covered lines 112, 176-177) - Overall: 92.73% → 93.13% lines (+0.40%) - Total tests: 722 → 725 (+3)	2026-03-13 20:08:14 +01:00
OpenClaw Subagent	99b67f2584	test: improve keys.ts coverage — cache-hit paths for createFreeKey, updateKeyEmail, updateEmailByCustomer	2026-03-13 17:10:13 +01:00
OpenClaw Subagent	97ad01b133	chore: bump puppeteer, improve recover.ts coverage	2026-03-13 14:08:44 +01:00
OpenClaw Subagent	bb3286b1ad	test: improve browser.ts coverage (scheduleRestart, HTTPS SSRF, releasePage error paths)	2026-03-13 11:06:42 +01:00
OpenClaw Subagent	44707d9247	test: improve usage.ts coverage (getUsageForKey, retry exhaustion)	2026-03-13 08:06:46 +01:00
OpenClaw Subagent	bbd7e53060	test: add 404 handler coverage for index.ts	2026-03-13 08:05:41 +01:00
OpenClaw Subagent	4e0ea6425b	chore: bump vitest 4.0.18 → 4.1.0, @types/node 25.4.0 → 25.5.0 ... - Fix recover-db-fallback test: remove conflicting vi.unmock before vi.mock (vitest 4.1 changed unmock/mock ordering behavior) - All 705 tests pass, 0 vulnerabilities	2026-03-12 20:15:29 +01:00
OpenClaw Subagent	ae8b32e1c4	test: improve db.ts and keys.ts coverage	2026-03-12 20:08:23 +01:00
OpenClaw Subagent	db35a0e521	test: add integration tests for admin.ts and pages.ts routes ... - admin-integration.test.ts: 14 tests covering /v1/usage/me, /v1/usage, /v1/concurrency, /admin/cleanup, auth middleware (401/403/503) - pages-integration.test.ts: 10 tests covering favicon, openapi.json, docs, landing page, static pages, status, /api Both files now at 100% function/statement/branch/line coverage. All 696 tests pass.	2026-03-12 17:10:05 +01:00
OpenClaw Subagent	fb68cf5546	add @vitest/coverage-v8 for test coverage reporting	2026-03-12 14:13:32 +01:00
OpenClaw Subagent	39fb8e01e7	Revert "add coverage reporting + improve test coverage for undertested files" ... This reverts commit 0a17e27fcd.	2026-03-12 14:12:23 +01:00
OpenClaw Subagent	0a17e27fcd	add coverage reporting + improve test coverage for undertested files	2026-03-12 14:09:54 +01:00
OpenClaw	55172856b1	chore: upgrade vitest 3.2.4 → 4.0.18 ... Breaking changes addressed: - vi.fn() mock factories: arrow → regular functions for constructor support - Exclude dist/ from test resolution (vitest 4 simplified defaults) - 672 tests pass, 0 tsc errors	2026-03-12 11:21:03 +01:00
DocFast CEO	7fffd404e9	chore: upgrade express-rate-limit 7.5.1 → 8.3.1 (IPv6 security fix) ... - Fixes IPv6 rate limit bypass vulnerability (GHSA-46wh-pxpv-q5gq) - IPv6 addresses now masked to /56 subnet by default - Updated custom keyGenerators to use ipKeyGenerator() helper - 5 new TDD tests for v8 features (ipKeyGenerator, IPv6 masking) - 672 tests passing, 0 TS errors, 0 npm audit vulnerabilities	2026-03-11 20:06:44 +01:00
DocFast Bot	603cbd7061	Migrate from Express 4 to Express 5 ... - Upgraded express from ^4.22.1 to ^5.2.1 - Added comprehensive Express 5 migration tests with TDD approach - All 667 tests passing (663 existing + 4 new migration tests) - No breaking changes detected in the codebase - Express 5's native async error handling now active - TypeScript compilation successful with @types/express ^5.0.6 Express 5 features now available: - Automatic async error catching in route handlers - Improved performance and stricter path matching - Default export import style already in use	2026-03-11 17:08:07 +01:00
DocFast CEO	a55c306514	chore: update dependencies (express 4.22, helmet 8.1, nanoid 5.1, swagger-ui-dist 5.32, tsx 4.21, typescript 5.9, vitest 3.2, @types/*)	2026-03-11 14:07:11 +01:00
Hoid	cc7de5ef49	feat: add periodic database cleanup every 6 hours (TDD) ... - Cleans expired verifications and orphaned usage rows - Previously only ran once on startup (13d+ uptime = accumulation) - Interval uses .unref() to not block graceful shutdown - Stopped during shutdown before pool.end() - Idempotent start (safe to call multiple times) - 6 TDD tests added (periodic-cleanup.test.ts) - 663 tests total, all passing	2026-03-11 11:06:09 +01:00
Hoid	75c6a6ce58	chore: upgrade marked 15→17 (ReDoS fix, list rendering improvements)	2026-03-11 08:07:05 +01:00
OpenClaw Agent	af3391d05a	chore: update puppeteer 24.39.0, nodemailer 8.0.2	2026-03-10 20:09:05 +01:00
DocFast CEO	b491052f69	refactor: extract billing HTML templates into billing-templates.ts (TDD) ... - Extract renderSuccessPage() and renderAlreadyProvisionedPage() from billing.ts - Share common styles via SHARED_STYLES constant - 11 TDD tests: content rendering, XSS escaping, structure validation - billing.ts: 369 → 334 lines (-35 lines, inline HTML removed) - 647 tests passing (59 files), 0 tsc errors	2026-03-10 17:03:44 +01:00
DocFast CEO	25cb5e2e94	refactor: extract findKeyInCacheOrDb to DRY up DB fallback pattern (TDD) ... - New shared helper findKeyInCacheOrDb(column, value) for DB lookups - Refactored downgradeByCustomer, updateKeyEmail, updateEmailByCustomer, and findKeyByCustomerId to use the shared helper - Eliminated ~60 lines of duplicated SELECT/row-mapping code - 3 TDD tests added (keys-db-fallback-helper.test.ts) - 636 tests passing, 0 tsc errors	2026-03-10 14:06:44 +01:00
DocFast CEO	4e00feb860	refactor: extract buildPdfOptions to DRY up renderPdf/renderUrlPdf (TDD) ... - Extract shared PDF options construction into buildPdfOptions() - Both renderPdf and renderUrlPdf now use the shared builder - 5 TDD tests added (pdf-options-builder.test.ts) - 633 tests passing, 0 tsc errors	2026-03-10 14:04:19 +01:00
DocFast Backend Agent	b1a09f7b3f	refactor(demo): Use handlePdfRoute to reduce boilerplate ... - Refactored demo routes to use shared handlePdfRoute utility - Added handleDemoPdfRoute wrapper to preserve attachment disposition - Preserved watermark injection and demo.pdf default filename - Added comprehensive TDD tests for Content-Disposition behavior - Reduced demo.ts from 269 to 238 lines (31 lines removed) - All 628 tests pass including 6 new behavioral tests Fixes duplicated error handling, validation, and concurrency logic while maintaining existing demo route behavior.	2026-03-10 11:06:34 +01:00
DocFast CEO	7ae20ea280	refactor: extract static page routes into routes/pages.ts (TDD) ... - Created src/routes/pages.ts with pagesRouter consolidating all page-serving routes: /, /docs, /impressum, /privacy, /terms, /examples, /status, /favicon.ico, /openapi.json, /api - Reduced index.ts from 391 to 314 lines (20% reduction) - Removed unused imports (createRequire, APP_VERSION, swaggerSpec) from index.ts - 4 TDD tests verifying router exports and route definitions - 622 tests passing, 0 tsc errors	2026-03-10 08:04:22 +01:00
DocFast CEO	76b2179be9	refactor: extract shared PDF route handler to eliminate convert route duplication ... - New src/utils/pdf-handler.ts with handlePdfRoute() helper - Handles: content-type validation, PDF option validation, slot acquire/release, error mapping, response headers - Refactored convert.ts from 388 to 233 lines (40% reduction) - 10 TDD tests for the new helper (RED→GREEN verified) - All 618 tests passing, zero tsc --noEmit errors	2026-03-09 20:07:27 +01:00
DocFast CEO	54316d45cf	fix: resolve all TypeScript strict-mode errors in test files ... - convert-sanitized: use 'as Record' cast for optional mock call args - error-responses: fix module path (database.js → db.js) and mock return type - recover-initial-db-fallback: fix mock return type (undefined → true) - render-timing: remove non-existent .prepare property check - usage-flush: cast mock request objects to any for test setup Zero tsc --noEmit errors. 608 tests passing.	2026-03-09 17:12:22 +01:00