treamz/wa-dev-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
73 Commits 1 Branch 0 Tags 3.7 MiB
c65b3f5006
Commit Graph

12 Commits

Author SHA1 Message Date
treamz
dabc26d70f Sync prod: owner-реестр результатов, общая фабрика лимитов, crash-guard ffmpeg/gs, водяной знак PDF 
Незакоммиченная работа сессии 2026-09-05 (уже на проде):
- lib/owner.js — реестр владельцев файлов-результатов, owner-check во всех download-роутах (IDOR)
- lib/limits.js — createLimiter(): skip для админа, ipKeyGenerator (фикс ERR_ERL_KEY_GEN_IPV6)
- video: обработчики 'error' у ffmpeg/ffprobe (spawn ENOENT больше не роняет сервер), таймауты
- pdf: runGhostscript/gsUnavailable, водяной знак с кириллицей (fontkit + TTF)
- снятие лимитов размера/количества для админа в pdf/video
- журнал сессии docs/sessions/2026-09-05-0231.md
 2026-09-22 20:37:39 +03:00
treamz
626a28f750 Security audit fixes synced from VPS prod: SSRF/IDOR/WS-auth/session/rate-limits/crash-guards + session journal 2026-07-24 23:34:29 +03:00
treamz
87f8c55da0 Sync prod working changes: new tools (regex/favicon), queue/session/storage/ws libs, video/compress/pdf/redirects updates 2026-07-24 16:45:55 +03:00
treamz
378c1a075e Add PDF tools: merge, split, rotate, delete, watermark, compress, convert, protect 
- 15 API endpoints for PDF operations (pdf-lib, pdf-parse, Ghostscript)
- Frontend with 8 operation tabs
- Merge multiple PDFs, split by page ranges
- Rotate/delete/reorder pages
- Add watermark text, page numbers
- Compress via Ghostscript (screen/ebook/printer quality)
- PDF to PNG/JPG, Images to PDF
- Password protection, text extraction
- Added to sidebar, dashboard (Utils category), DB
 2026-03-22 01:10:37 +03:00
treamz
5c7066b7d3 Security hardening: helmet, rate limits, session fixes, admin auth 
Critical fixes:
- helmet middleware (X-Frame-Options, HSTS, X-Content-Type, CSP, etc)
- Remove /admin from PUBLIC_PREFIXES (double auth: session + admin role)
- Session cookie: httpOnly, sameSite=lax, 1-day expiry (was 30 days)
- Session regeneration on login (prevent session fixation)
- Blocked user check on login

Rate limiting:
- /auth/login: 10 req / 15 min (brute force protection)
- /auth/register: 10 req / 15 min (spam protection)
- /parse, /metadata, /text, /preview: 20 req / min (DDoS via server)

Input sanitization:
- Strip HTML tags from display_name (stored XSS prevention)
 2026-03-22 00:39:38 +03:00
treamz
64bf816e34 Status page: public monitoring at /status 
- Real-time checks: web server, MariaDB, FFmpeg, disk usage
- Auto-refresh every 30 seconds
- Overall status banner (operational/degraded/outage)
- Server info: Node version, uptime, memory, PID
- Public page (no auth required)
- Responsive, theme-aware design
 2026-03-22 00:35:15 +03:00
treamz
6ac3366ea9 Security: lock down API — only landing endpoints public 
- Only /api/settings, /api/tools, /api/content/advantages|dashboard public
- All other /api/* require authentication (401)
- Moved API mount after auth middleware, public endpoints before
 2026-03-22 00:28:32 +03:00
treamz
1837f42a91 AdminJS admin panel + dynamic content API 
- AdminJS at /admin with auth (admin role only)
- Manage: users, categories, tools, content blocks, settings
- DB tables: settings, categories, tools, content_blocks
- Users table: added role (user/admin) and is_blocked fields
- API: /api/settings, /api/tools, /api/content/:section
- Sidebar: admin link visible only for admin users
- Removed /logs from public routes (now in AdminJS)
- Video converter: fixed ffmpeg codecs for RPi5 (h264_v4l2m2m)
- Dependencies: sequelize, @adminjs/sequelize, mariadb
 2026-03-21 23:46:41 +03:00
treamz
44c85f6e44 Add video converter: convert, compress, extract audio, GIF 
- New tool: /video with 4 modes (convert formats, compress, extract audio, GIF)
- Backend: ffmpeg-based processing with progress tracking
- Supports MP4, WebM, MOV, AVI, MKV input, up to 200MB
- Frontend: drag-drop upload, mode tabs, progress bar, download
- Added to sidebar, dashboard (Images category), WA_CATEGORIES
- Total tools: 14
 2026-03-21 23:28:11 +03:00
treamz
f8616e32b4 Auth + Landing + Categories 
- Local auth: registration/login with email+password (bcrypt, MariaDB)
- Landing page: marketing page at / with hero, categories, advantages, CTA
- Tool categories: Images (4), Code (3), Web (3), Utilities (2)
- Sidebar: category dividers, user avatar with logout
- Protected routes: all tools require auth, landing/login/register public
- New files: lib/db.js, routes/auth.js, login.html, register.html, landing.html
- Dependencies: bcrypt, mysql2
 2026-03-21 22:54:31 +03:00
treamz
5b528d243a Refactor: modular architecture, security, config 
- Split monolithic server.js (1111 lines) into route modules
- Add .env config (port, session secret, quality, limits)
- Add SSRF protection for parser/proxy/redirect endpoints
- Add optional password auth middleware
- Add structured logger (replaces raw fs.appendFileSync)
- Add graceful shutdown with timeout
- Add extended /health endpoint (uptime, memory, pid)
- Add ecosystem.config.js for PM2 (memory limit, restart policy)
- Make compress quality configurable (was hardcoded 60)
- Expand SVG AI icons library (7 -> 20 icons)
- Add dotenv dependency
 2026-03-21 22:18:54 +03:00
treamz
54d220e0f4 Initial commit: WA Dev Tools service 2026-03-21 22:06:15 +03:00