- Extract duplicated PDF text extraction into _extract_text_from_pdf helper
- Clarify empty metadata dict comment for embed_metadata_into_pdf retry
- Make test assertion for file_id passing more explicit
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add file_id parameter to process_document to skip duplicate hash check on reprocess
- Pass file_id from reprocess_single_file and bulk_reprocess_files endpoints
- Extend retry-subtask endpoint to support pipeline steps (process_document,
process_with_azure_document_intelligence, extract_metadata_with_gpt,
embed_metadata_into_pdf) in addition to upload tasks
- Add retry button for failed main pipeline steps in file detail UI
- Add comprehensive tests for reprocessing and pipeline step retry
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Created app/utils/file_queries.py with apply_status_filter function
- Updated app/api/files.py to use shared function
- Updated app/views/files.py to use shared function
- Removed unused 'or_' import from app/api/files.py
- Added comprehensive tests in tests/test_file_queries.py
- All tests pass (10 new tests, 14 existing tests verified)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Security headers are now disabled by default since most deployments use a reverse proxy (Traefik, Nginx) that already adds these headers. Enable with SECURITY_HEADERS_ENABLED=true for direct deployments.
Changes:
- Set security_headers_enabled default to False in app/config.py
- Update all documentation to reflect new default
- Comment out examples in .env.demo (now showing disabled state)
- Update SECURITY_AUDIT.md to reflect reverse proxy as default deployment
- Tests still pass (3 passed, 8 skipped as expected with headers disabled)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add prominent documentation that splitting uses page boundaries
- Update docstring with IMPORTANT note about page-level splitting
- Add test to validate split PDFs are valid and readable
- Update ConfigurationGuide.md to emphasize page-based approach
- Update SECURITY_AUDIT.md with implementation details
- Ensures users understand no risk of corrupted PDFs
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Use BytesIO for size checking instead of temporary disk writes (major performance improvement)
- Add constant and comment for PDF overhead multiplier in tests
- Address code review feedback
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add MAX_UPLOAD_SIZE config (default 1GB) to prevent resource exhaustion
- Add MAX_SINGLE_FILE_SIZE config for optional PDF file splitting
- Implement automatic PDF splitting when files exceed single file limit
- Update upload endpoint to use configured limits instead of hardcoded 500MB
- Add comprehensive tests for upload limits and file splitting
- Document configuration in ConfigurationGuide.md and SECURITY_AUDIT.md
- Reference SECURITY_AUDIT.md in error messages for user guidance
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Remove trailing whitespace from blank lines
- Apply black formatting to test file
- All tests still pass
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Import and use sanitize_filename utility in ui_upload endpoint
- Enhance sanitize_filename to handle Windows-style paths (backslashes)
- Add protection against path traversal patterns (..)
- Replace all path separators with underscores
- Add comprehensive security tests for Windows-style paths and mixed separators
- All existing tests pass with improved security
This addresses the "Uncontrolled data used in path expression" code scanning alert
by ensuring all user-provided filenames are properly sanitized before being used
in any file operations or stored in the database.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Run Black formatter and isort on all app/ files
- Remove unused imports (F401) across multiple files
- Add # noqa: F401 for intentional re-exports in celery_worker.py,
tasks/__init__.py, utils.py, frontend.py, views/base.py
- Fix f-strings without placeholders (F541) in azure.py, notification.py,
check_credentials.py, upload_to_onedrive.py, settings.py
- Fix bare except (E722) in upload_to_sftp.py
- Fix block comment format (E265) in models.py
- Move imports to top of file to fix E402 in celery_app.py, celery_worker.py
- Fix line-too-long (E501) by wrapping strings in multiple files
- Remove unused variable (F841) in upload_to_nextcloud.py
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Remove invalid type attribute from iframe elements
- Add dedicated download endpoint with attachment disposition
- Update download links to use new endpoint instead of preview
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Auto-refresh files table after successful uploads using custom event
- Add inline preview support for PDFs, images, and text files
- Set Content-Disposition header to inline for preview endpoint
- Add download button as secondary action in file details view
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Use Optional[int] type hint for timeout parameter in oauth_helper
- Replace bare Exception with specific ValueError and JSONDecodeError
- Strengthen rclone remote name validation (must start with alphanumeric)
- Fix path traversal validation to check against workdir for absolute paths
- Add comprehensive comments for security validations
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Remove unused imports from all modified files
- Fix flake8 violations (unused variables, f-strings without placeholders)
- Apply Black formatting consistently
- Shorten long line in google_drive.py
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add Redis and RabbitMQ services to CI workflow
- Fix Jinja2 template error by passing file=None in error cases
- Fix test expecting dict response format for list_files endpoint
- Fix NOT NULL constraint by providing valid local_filename
- Fix retry-subtask to validate subtask name before checking processed file
- Add mock for process_document in reprocess test
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Break long line in lifespan function to multiple lines
- Remove test_startup.py (not needed, existing tests validate startup)
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Convert sync and async startup handlers to single lifespan function
- Remove deprecated @app.on_event("startup") and @app.on_event("shutdown")
- Add asynccontextmanager import for lifespan pattern
- Consolidate all startup/shutdown logic into one place
- Fixes Python 3.14 compatibility issue causing startup failure
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Settings management represents a significant new feature warranting a minor version bump:
- Database-backed configuration with 102 settings
- Fernet encryption for sensitive values
- Setup wizard for first-time installations
- Complete admin UI and REST API
- OAuth admin group support
Version updated: 0.3.3 → 0.5.0
Keep 0.3.3 release notes intact (drag-and-drop feature from main branch).
Add 0.5.0 as new current release with settings features.
Updated files:
- VERSION: 0.5.0
- CHANGELOG.md: Added 0.5.0 release, kept 0.3.3 intact
- MILESTONES.md: Added v0.5.0 section, adjusted future versions
- TODO.md: Updated current version
- ROADMAP.md: Updated current status
- app/config.py: Default version 0.5.0-dev
- docs/BuildMetadata.md: Updated reference
- ANALYSIS_SUMMARY.md: Updated version
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
VERSION:
- Update from 0.1.0-test to 0.3.3
CHANGELOG.md:
- Create comprehensive changelog for all releases
- Document v0.3.3 features: settings management, encryption, setup wizard
- List all new files, changes, fixes, and security improvements
TODO.md:
- Update version reference to v0.3.3
- Mark settings management features as complete
- Add completed items for 2026-02-08
- Update last review date
MILESTONES.md:
- Update last updated date
- Mark v0.3.3 as Released (2026-02-08)
- Add comprehensive release notes with all features
- Update version history table
- Update current release to v0.3.3 with new features listed
ROADMAP.md:
- Update to reflect v0.3.3 current status
- Add settings management features to current status
- Update last updated date
Other files:
- app/config.py: Update default version to 0.3.3-dev
- docs/BuildMetadata.md: Update default version reference
- ANALYSIS_SUMMARY.md: Update current version
All documentation now reflects v0.3.3 release with complete feature list.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]