Replaced the loop over `body.order` which generated an N+1 issue
with a single bulk query fetching all relevant `SubscriptionPlan`
records via the `.in_()` clause.
Added an in-memory dictionary map of `plan_id` to `SubscriptionPlan`
objects to allow `O(1)` lookups while updating the order.
Benchmark speedup: 14.71x faster on 500 records.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Added tests to `tests/test_api_advanced_filters.py` to cover missing edge cases and error handling for the `PUT /api/saved-searches/{id}` endpoint. New test coverage includes duplicate name conflicts (409), validation errors for names exceeding max length (422), empty names (422), empty filters (422), and payloads containing only invalid filter keys (422).
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Replaced the loop over duplicate hashes that resulted in O(N) database queries
per page with a single efficient `in_` batch query to retrieve both originals
and duplicates. The records are then grouped in memory using dictionaries.
This resolves the N+1 performance bottleneck and reduces response time from
an average of 1.65 seconds to ~0.45 seconds locally for 500 groups.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Adds unit tests for the notify_settings_updated function in
app/utils/settings_sync.py to verify that exceptions during Redis publish,
settings reload, and OCR language check are properly caught and logged as
warnings without raising up the call stack.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Replaced the N+1 query in `list_shared_links` which fetched `FileRecord` for each link. It now uses a single query with an `outerjoin` to fetch `original_filename` alongside the `SharedLink` object.
Measured a significant improvement from ~0.4547s to ~0.0579s per 1000 links.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Added a strict regex validation allowlist for table names in `preview_migration` before using them in raw SQL queries. This ensures that only alphanumeric characters and underscores are allowed, preventing potential SQL injection even if the source of table names were to be manipulated.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Enhance the coverage and robustness of the `generate_api_token` helper
in `app/api/api_tokens.py` by introducing three unit tests.
The new tests verify:
- The exact character length of the generated string based on `TOKEN_BYTES`.
- The character set strictly adheres to URL-safe characters and the expected `TOKEN_PREFIX`.
- `secrets.token_urlsafe` is explicitly called with `TOKEN_BYTES`.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Adds `--` separator to `rclone copy`, `mkdir`, and `link` commands in `upload_with_rclone.py`. This explicitly tells rclone to stop processing options and treat subsequent arguments strictly as positional arguments, preventing malicious user-controlled paths (starting with `-`) from being executed as arbitrary command flags.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Added the `--` argument before positional arguments in rclone subprocess calls (link, mkdir, copy) in `app/tasks/upload_with_rclone.py`. This ensures that filenames or destinations starting with a hyphen are treated as paths rather than unintended command-line flags.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add NODE_NO_WARNINGS=1 to all eas.json build profiles (development,
preview, production) to suppress [DEP0169] url.parse() deprecation
warnings emitted by EAS CLI when the build image's system Node is 22+
- Add NODE_NO_WARNINGS=1 env to both EAS Cloud Workflow jobs
(.eas/workflows/create-builds.yml) with explanatory comments
- Fix outdated Node.js prerequisite in docs/MobileApp.md (was "18 or
later", now "20.19.4 or later" with nvm guidance)
- Add troubleshooting sections in docs/MobileApp.md and mobile/README.md
covering both the "Session expired Local session" error (Apple ID
session expiry + App Store Connect API key recommendation) and the
[DEP0169] Node.js deprecation warning
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Replace all hardcoded English strings in the admin file manager
template with _() translation calls and add 47 new admin_files.*
keys to en.json.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Add 108 admin_plans.* translation keys to en.json and update
admin_plans.html to use _() for all static text and window.__i18nAdminPlans
for dynamic Alpine.js / JavaScript strings.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Rewrite README.md to reflect current state of the project:
- Updated Overview with all 12 storage, 7 AI, 6 OCR providers
- Comprehensive Features section (mobile, CLI, browser ext, pipelines, etc.)
- Updated Workflow with all ingestion channels and distribution targets
- Expanded Documentation index with all doc links organized by category
- Updated Tech Stack table (Meilisearch, MkDocs, Expo, etc.)
- Added Kubernetes/Helm quick start
- Added status-view screenshot
- Updated dependency licenses table
- Updated docs/UserGuide.md with cross-references to Mobile App, CLI,
Browser Extension, and API docs
- Expanded docs/Troubleshooting.md from 175 to 300+ lines with new
sections for Search, Pipelines, Mobile App, CLI, Performance, and
updated all existing sections with current information
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
google-labs-jules[bot]