summaryrefslogtreecommitdiff
path: root/apps/web/app/api
Commit message (Collapse)AuthorAgeFilesLines
* feat: scoped mark-all-read, share enhancements, notification z-indexFuwn2026-02-102-2/+18
| | | | | | | | | - Mark all as read now scopes to current feed/folder instead of all - Added undo button to mark-all-read toast notification - Share notes can be toggled between public and private visibility - Track share view count and display in shares list - Activity-based share expiry: views reset the expiry timer - Fixed notification panel z-index layering behind content area
* refactor: use Supabase Auth display name instead of custom columnFuwn2026-02-102-2/+3
| | | | | | Migrate existing display names from user_profiles to auth.users user_metadata. Drop display_name column from user_profiles. Frontend now reads from auth user metadata and updates via auth.updateUser().
* fix: P2 security hardening and tier limit parityFuwn2026-02-102-51/+19
| | | | | | Webhook routes switched from admin client to server client (RLS). Added DNS-resolution SSRF protection for webhook URLs with private IP blocking. Added tier limit parity check script.
* fix: P0 correctness and security fixesFuwn2026-02-0911-10/+11
| | | | | | - Add missing 'developer' case to check_custom_feed_limit trigger (was falling through to else 1) - Scope user_entry_states join to authenticated user in /api/v1/entries (admin client bypasses RLS) - Replace in-memory rate limiting with Supabase-backed solution (UNLOGGED table + check_rate_limit RPC + pg_cron cleanup)
* security: harden API routesFuwn2026-02-086-15/+66
| | | | | | | | | | | | | | | | - Add rate limiting to /api/share (30/min), /api/export (5/hr), /api/account/data (3/day) - Add client-side 30s throttle to forgot-password form - Remove immediate tier upgrade on plan change; let invoice.paid webhook handle tier promotion to prevent free upgrades on payment failure - Add SSRF validation to webhook URLs: block localhost, private IPs, link-local, and metadata endpoints - Log Stripe webhook signature verification errors instead of swallowing silently - Mask webhook secret in GET response (show first/last 4 chars only) - Add error logging to API key last_used_at update - Remove internal error message leaking from checkout session route
* fix: invoice.paid handler now retrieves subscription for correct tier resolutionFuwn2026-02-081-16/+13
|
* debug: add webhook signature verification loggingFuwn2026-02-081-1/+5
|
* feat: enable promotion codes on Stripe checkoutFuwn2026-02-081-0/+1
|
* feat: add Vercel BotID protection and fix billing origin fallbackFuwn2026-02-087-8/+49
| | | | | | | | | Set up BotID bot detection on sensitive API routes (share, billing, account, webhook-config). Adds client instrumentation, server-side checkBotId() guards, and withBotId next config wrapper. Also fix checkout/portal session routes to fall back to request origin when NEXT_PUBLIC_APP_URL is not set, and center SVG icon properly.
* feat: share with highlighted excerpt and fix auth redirect URLsFuwn2026-02-081-1/+38
| | | | | | | | | Add "share" button to text selection toolbar so users can share an entry with a highlighted passage visible to visitors. The public share page renders the highlight and scrolls to it on load. Also fix magic link and password reset redirects to use NEXT_PUBLIC_APP_URL instead of window.location.origin so emails link to the production domain.
* fix: share clipboard write for Safari transient activationFuwn2026-02-081-11/+6
| | | | | | | - Use ClipboardItem with Promise to preserve user gesture context - Fall back to showing share URL in toast if clipboard is unavailable - Derive app origin from request URL when NEXT_PUBLIC_APP_URL is unset - Add onError handlers to share/unshare mutations
* fix: resolve 6 pre-ship audit bugsFuwn2026-02-072-24/+39
| | | | | | | | | | | | | | - Webhook entry identifier: use entry GUID instead of feed identifier - Optimistic rollback: add previousTimeline snapshot and onError handler to both useToggleEntryReadState and useToggleEntrySavedState - Rate limiter memory leak: delete Map entries when window expires, use else-if to avoid re-setting after delete - Entries API limit param: use Number.isFinite guard instead of falsy coercion that treats 0 as default - PWA manifest: add PNG raster icon routes (192x192, 512x512) for devices that don't support SVG icons - Billing webhook: throw on DB errors and return 500 so Stripe retries failed events instead of silently losing them
* security: remove unsafe-eval CSP, fix host header injection, harden API routesFuwn2026-02-074-15/+32
| | | | | | | | - Remove unsafe-eval from script-src CSP (not needed in production) - Replace Host/Origin header fallback with NEXT_PUBLIC_APP_URL in share and checkout routes to prevent host header injection - Add .catch() to request.json() in share POST and PATCH routes - Add rate limiting (3/min) to account deletion endpoint
* fix: api key prefix rename, revoke fix, and webhook validationFuwn2026-02-072-12/+36
| | | | | | Rename API key prefix from asn_ to asa_, fix key revoke by aligning response property names with frontend interface, and add server/client validation to prevent enabling webhooks without a URL.
* style: lowercase all user-facing strings and add custom eslint ruleFuwn2026-02-0717-55/+55
| | | | | | | | Comprehensive sweep of all user-facing text to enforce lowercase convention, including acronyms (api, rest, http, opml, json, totp, mfa, qr, hmac). Added asa-lowercase/lowercase-strings eslint rule that reports uppercase in notify() calls, error messages, jsx text, and checked attributes (placeholder, alt, title).
* feat: asa.news RSS reader with developer tier, REST API, and webhooksFuwn2026-02-0717-0/+1488
Full-stack RSS reader SaaS: Supabase + Next.js + Go worker. Includes three subscription tiers (free/pro/developer), API key auth, read-only REST API, webhook push notifications, Stripe billing with proration, and PWA support.
generated by cgit v1.2.3 (git 2.25.1) at 2026-03-13 00:29:33 +0000