Commit graph

9 commits

Author SHA1 Message Date
OpenClaw
9541ae1826 Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix
Some checks failed
Deploy to Production / Deploy to Server (push) Failing after 20s
- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger
2026-02-16 08:27:42 +00:00
DocFast Bot
ebdeb74094 BUG-037: Filter webhook by product_id prod_TygeG8tQPtEAdE
Shared Stripe account - only process checkout events for DocFast product.
Retrieves session with expanded line_items to check product ID.
2026-02-15 10:44:09 +00:00
DocFast Bot
e9d16bf2a3 Migrate from JSON to PostgreSQL, update SLA to 99.5%
- Replace JSON file storage with PostgreSQL (pg package)
- Add db.ts service for connection pool and schema init
- Rewrite keys.ts, verification.ts, usage.ts for async PostgreSQL
- Update all routes for async function signatures
- Add migration script (scripts/migrate-to-postgres.mjs)
- Update docker-compose.yml with DATABASE_* env vars
- Change SLA from 99.9% to 99.5% in landing page
2026-02-15 10:18:25 +00:00
OpenClaw
bb1881af61 feat: add checkout.session.completed webhook handler for pro key provisioning
Safety net: provisions pro API key on successful checkout via webhook,
in case user doesn't reach the success page. Idempotent with existing
createProKey logic. Gracefully handles missing STRIPE_WEBHOOK_SECRET.
2026-02-15 09:52:48 +00:00
OpenClaw
aa23d4ae2a Add checkout.session.completed webhook handler for Pro key creation
- Extract customer email from session.customer_details?.email
- Check if Pro key already exists for that email (idempotent)
- Create Pro key only if one does not exist
- Add comprehensive logging for debugging
- Ensures webhook and success page work together without duplicates
2026-02-15 09:52:25 +00:00
6a38ba4adc fix: critical security issues - webhook bypass, SSRF, XSS 2026-02-14 16:19:48 +00:00
7f04789997 Add proper API docs page, fix Stripe lazy init, update docs links 2026-02-14 14:31:44 +00:00
467a97ae1c fix: self-service signup, unified key store, persistent data volume
- Added /v1/signup/free endpoint for instant API key provisioning
- Built unified key store (services/keys.ts) with file-based persistence
- Refactored auth middleware to use key store (no more hardcoded env keys)
- Refactored usage middleware to check key tier from store
- Updated billing to use key store for Pro key provisioning
- Landing page: replaced mailto: link with signup modal
- Landing page: Pro checkout button now properly calls /v1/billing/checkout
- Added Docker volume for persistent key storage
- Success page now renders HTML instead of raw JSON
- Tested: signup → key → PDF generation works end-to-end
2026-02-14 14:20:05 +00:00
c12c1176b0 Add Stripe billing integration + update free tier to 100 PDFs/mo 2026-02-14 13:53:19 +00:00