- Add RequestSizeLimitMiddleware that checks Content-Length header
before request body is read: non-multipart requests capped at
MAX_REQUEST_BODY_SIZE (default 1 MB), multipart uploads capped at
MAX_UPLOAD_SIZE (default 1 GB). Returns HTTP 413 on violation.
- Register middleware in app/main.py
- Add max_request_body_size setting to app/config.py
- Fix ui_upload in files.py to check Content-Length early and read
in 64 KB chunks (bounded memory usage), removing the post-write
os.path.getsize check
- Document MAX_REQUEST_BODY_SIZE in .env.demo and ConfigurationGuide.md
- Mark SECURITY_AUDIT.md item #4 as resolved
- Add 9 tests in test_request_size_limit.py
- Update test_upload_file_too_large to use patch.object instead of
the now-unused os.path.getsize mock
Closes#173
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Updated browser-extension/README.md with web clipping features
- Updated docs/BrowserExtension.md with dual-mode architecture
- Added documentation for clip mode data flow and API endpoints
- Updated permissions explanation for new clipping capabilities
- Added troubleshooting for clip-specific issues
- Documented version 1.1.0 features and changes
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Document GitHub Actions configuration for mock and real OAuth
- Add security best practices for OAuth secrets
- Include troubleshooting guide
- Provide complete workflow examples
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Refactors .github/workflows/tests.yaml so that flake8, black, mypy,
pylint, and bandit each run as their own job in parallel with the test
job. This ensures a failure in one tool never blocks the others, and
contributors see full feedback from every tool on every CI run.
- Upgrades actions/checkout to v4 and actions/setup-python to v5
- All linter jobs are enforced (no continue-on-error)
- Test artifacts (junit.xml, coverage.xml) always uploaded
- Bandit JSON report always uploaded as artifact
- Adds docs/CIWorkflow.md with maintainer documentation
- Updates CONTRIBUTING.md with CI workflow table and link
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add complete browser extension with popup UI and background workers
- Support Chrome, Firefox, Edge, and other Chromium-based browsers
- Include context menu integration for quick file sending
- Add comprehensive documentation for users and administrators
- Update main README and API docs to include browser extension
- Implement secure configuration storage in browser extension storage
- Add SSRF-protected URL upload endpoint integration
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Added endpoints for previewing original and processed PDF files.
- Implemented on-demand text extraction from original and processed PDFs.
- Updated file detail page to show original and processed file paths with existence status.
- Introduced GPT metadata display with a collapsible JSON view.
- Enhanced front-end with PDF.js for in-browser PDF rendering and improved user experience.
- Added integration tests for new features including metadata display and file previews.
- Update generate_build_metadata.sh to sync VERSION from latest git tag
- Change BUILD_DATE format from date-only to ISO 8601 with time (YYYY-MM-DDTHH:MM:SSZ)
- Fix VERSION file from 0.5.0 to 0.9.1 (matching latest git tag v0.9.1)
- Change version fallback from hardcoded '0.5.0-dev' to 'unknown' in config.py
- Update release.yml to commit all build metadata files (not just VERSION)
- Update BuildMetadata.md documentation to reflect automated versioning
- Add tests for build_date with time format and version unknown fallback
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Security headers are now disabled by default since most deployments use a reverse proxy (Traefik, Nginx) that already adds these headers. Enable with SECURITY_HEADERS_ENABLED=true for direct deployments.
Changes:
- Set security_headers_enabled default to False in app/config.py
- Update all documentation to reflect new default
- Comment out examples in .env.demo (now showing disabled state)
- Update SECURITY_AUDIT.md to reflect reverse proxy as default deployment
- Tests still pass (3 passed, 8 skipped as expected with headers disabled)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Fix test count in SECURITY_AUDIT.md (11 tests, not 24)
- Add deprecation note for ALLOW-FROM in X-Frame-Options
- Update documentation to recommend CSP frame-ancestors instead
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add prominent documentation that splitting uses page boundaries
- Update docstring with IMPORTANT note about page-level splitting
- Add test to validate split PDFs are valid and readable
- Update ConfigurationGuide.md to emphasize page-based approach
- Update SECURITY_AUDIT.md with implementation details
- Ensures users understand no risk of corrupted PDFs
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add MAX_UPLOAD_SIZE config (default 1GB) to prevent resource exhaustion
- Add MAX_SINGLE_FILE_SIZE config for optional PDF file splitting
- Implement automatic PDF splitting when files exceed single file limit
- Update upload endpoint to use configured limits instead of hardcoded 500MB
- Add comprehensive tests for upload limits and file splitting
- Document configuration in ConfigurationGuide.md and SECURITY_AUDIT.md
- Reference SECURITY_AUDIT.md in error messages for user guidance
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Create comprehensive audit documentation
- Document all vulnerabilities, fixes, and testing
- Include security recommendations for future development
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Settings management represents a significant new feature warranting a minor version bump:
- Database-backed configuration with 102 settings
- Fernet encryption for sensitive values
- Setup wizard for first-time installations
- Complete admin UI and REST API
- OAuth admin group support
Version updated: 0.3.3 → 0.5.0
Keep 0.3.3 release notes intact (drag-and-drop feature from main branch).
Add 0.5.0 as new current release with settings features.
Updated files:
- VERSION: 0.5.0
- CHANGELOG.md: Added 0.5.0 release, kept 0.3.3 intact
- MILESTONES.md: Added v0.5.0 section, adjusted future versions
- TODO.md: Updated current version
- ROADMAP.md: Updated current status
- app/config.py: Default version 0.5.0-dev
- docs/BuildMetadata.md: Updated reference
- ANALYSIS_SUMMARY.md: Updated version
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
VERSION:
- Update from 0.1.0-test to 0.3.3
CHANGELOG.md:
- Create comprehensive changelog for all releases
- Document v0.3.3 features: settings management, encryption, setup wizard
- List all new files, changes, fixes, and security improvements
TODO.md:
- Update version reference to v0.3.3
- Mark settings management features as complete
- Add completed items for 2026-02-08
- Update last review date
MILESTONES.md:
- Update last updated date
- Mark v0.3.3 as Released (2026-02-08)
- Add comprehensive release notes with all features
- Update version history table
- Update current release to v0.3.3 with new features listed
ROADMAP.md:
- Update to reflect v0.3.3 current status
- Add settings management features to current status
- Update last updated date
Other files:
- app/config.py: Update default version to 0.3.3-dev
- docs/BuildMetadata.md: Update default version reference
- ANALYSIS_SUMMARY.md: Update current version
All documentation now reflects v0.3.3 release with complete feature list.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Remove HTML 'required' attributes - all fields optional
- Add source detection (DB/ENV/DEFAULT) for each setting
- Display color-coded badges showing setting source
- Update template with precedence order explanation
- Pre-fill form with current values from DB/ENV/defaults
- Update documentation with source badge explanations
- Test and verify form prefilling works correctly
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Added comprehensive documentation in User Guide for new file detail features
- Updated API documentation with reprocess and preview endpoints
- Documented retry button functionality and use cases
- Documented process flow visualization feature
- Documented file preview feature with examples
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]