nobswebdev/private_image
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
114 Commits 1 Branch 0 Tags
c95af9576f3d52809d257ca7073bca99d7b28bf3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
nobswebdev c95af9576f Improve upload metadata status copy and stack status lines on all widths. 2026-10-31 00:10:18 +01:00
nobswebdev 32cd1bdb9e Precompress ExifTool WASM with Brotli and serve via nginx brotli_static. 
Tor first loads drop from ~25 MB raw to ~5 MB on the wire; prod build writes .wasm.br sidecars and Alpine nginx serves them under /assets with long-lived cache.
 2026-10-30 23:32:16 +01:00
nobswebdev 26899fdf66 add full-page drag hint overlay for file drop on upload. 2026-10-30 20:43:18 +01:00
nobswebdev 88bc0111de reorder about page sections with host comparison first. 
Move comparison table after the intro and put Compare hosts first in section nav.
 2026-10-30 19:07:45 +01:00
nobswebdev 946cf21110 add preview thumbnail to metadata inspector and share links. 
Reuse queue object URLs in UploadPanelHeader for the selected row.
 2026-10-30 18:54:56 +01:00
nobswebdev 1298e05010 show metadata inspector tabs when strip fails. 
Use MetadataTabBody to drive Original and Stripped tab content when strip fails after a successful read.
 2026-10-30 18:37:02 +01:00
nobswebdev 19a8feff19 add not-found handling to ZK and hotlink viewer pages. 
Rename ViewerView and view store to ZkViewerView and useZkViewStore; unify hotlink load and ZK unlock error copy.
 2026-10-30 17:43:29 +01:00
nobswebdev bb08bb389f make upload and metadata UI responsive on mobile. 
Improve narrow-viewport layout for upload, About, and shell overflow; keep modal scroll without extra dismiss or a11y markup changes.
 2026-10-30 16:23:09 +01:00
nobswebdev 938229eeea add thumbnail preview for each queued image. 
Create and revoke blob URLs on pick and session reset; reset upload session on view unmount.
 2026-10-29 22:31:04 +01:00
nobswebdev 9cc73e0dc5 replace upload dropzone with global intake controls. 
Window drag-drop and paste share the same pick path as the file chooser; configure modal lives in the intake component.
 2026-10-29 21:40:07 +01:00
nobswebdev ebe8b9aa2f fix app shell layout so footer stays visible on short pages. 
Replace min-h-screen on viewer and delete mains with flex-1 inside a growing router outlet.
 2026-10-29 19:52:47 +01:00
nobswebdev ec072f7dda simplify configure upload modal share mode copy. 
Short hints per mode with Learn more links to About anchors in a new tab.
 2026-10-29 19:52:47 +01:00
nobswebdev e07049dda9 update about flow diagrams and align prose width with comparison table. 
Refreshed stripped JPEGs and removed max-w-3xl so sections use the full max-w-5xl main column.
 2026-10-29 18:58:37 +01:00
nobswebdev 1df2e6a4f7 add site footer with source links and author credit. 
Hardcoded clearnet and onion repository URLs; instance links omitted for Onion-Location.
 2026-10-29 18:58:37 +01:00
nobswebdev fa1c2abb51 add about page with features and competitor comparison. 
Includes section nav, flow diagrams with lightbox, comparison table, brand theme tokens, and router hash scroll.
 2026-10-29 18:14:18 +01:00
nobswebdev eed17c9aab add top navigation with logo upload and about links. 
Shared app header in the layout shell and upload main area flex fix for the new chrome.
 2026-10-29 18:14:15 +01:00
nobswebdev adb1d7bca9 Fix Onion-Location on SPA responses behind nginx add_header. 
Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.
 2026-10-28 23:12:08 +01:00
nobswebdev b97fcc2b20 Add CSP sandbox on nginx hotlink image responses. 
Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
 2026-10-28 22:38:28 +01:00
nobswebdev 4a534a8007 Add production deployment guide and restrict CORS to development. 
Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.
 2026-10-28 22:07:32 +01:00
nobswebdev 915d62f09a Trust nginx proxy and drop hotlink response headers from Nest. 
Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.
 2026-10-28 20:56:21 +01:00
nobswebdev cb37a1e23c Add prod nginx image with clearnet, onion, and SPA build. 
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.
 2026-10-28 20:56:21 +01:00
nobswebdev 4385a024a8 Add prod compose and backend production image. 
Wire postgres, pgadmin, backend, nginx, and tor with nullcart-style layout; document clearnet and onion hostname env vars for deploy.
 2026-10-28 20:56:05 +01:00
nobswebdev 214fa0f875 Enforce maxViews atomically when reserving a view slot. 
Use a conditional UPDATE with parenthesized OR so increment only applies to the target row and fails when the view cap is reached.
 2026-10-27 22:09:48 +01:00
nobswebdev 3cf1d5e8aa Fix drop lastViewedAt migration order for fresh databases. 
Run the column drop after AddUploadTable so TypeORM does not execute ALTER before uploads exists.
 2026-10-27 22:09:45 +01:00
nobswebdev 29407814cc Add UploadCleanupService for cron purge and delete uploads. 
Move token delete and storage purge off UploadService; enforce expiry and max views on GET without purging until the scheduled cleanup job runs.
 2026-10-27 21:07:01 +01:00
nobswebdev 00ef845277 Add DeleteView one-click delete page at /d/:id?token=... 2026-10-27 19:13:40 +01:00
nobswebdev c147a010b5 Enforce max views on access and purge after the last allowed view. 2026-10-27 18:30:35 +01:00
nobswebdev 9a2bc67b1d Reject expired uploads on ZK and hotlink GET with 404. 
Use dayjs to compare expiresAt before reading storage or incrementing view_count.
 2026-10-27 15:30:03 +01:00
nobswebdev 481eb0bcd6 Add DELETE /api/uploads/:id with delete_token and unlink ciphertext. 
Return 204 when the token hash matches; ignore missing files on unlink so the row is still removed.
 2026-10-27 15:19:25 +01:00
nobswebdev 073e6ac1f2 Increment view_count after successful ZK and hotlink GETs. 
Bump count only when ciphertext or decrypted image is ready; 404 paths do not increment. Cover both flows in UploadService tests.
 2026-10-27 15:06:26 +01:00
nobswebdev cb8a6a800d Drop lastViewedAt from uploads because inactivity cleanup is out of scope. 
Add a migration and remove the column from the Upload entity.
 2026-10-27 14:55:27 +01:00
nobswebdev 6407b64f26 Derive API origin from VITE_API_BASE_URL for hotlink image src. 
Nest api config (baseUrl + baseUrlRoot) so dev cross-origin /i requests work without a separate app-env flag.
 2026-10-27 14:03:30 +01:00
nobswebdev dfc52749b2 Add hotlink viewer page at /h/:id/:secret. 2026-10-26 23:06:28 +01:00
nobswebdev bf36b1d2aa Restrict hotlink mimeType to image/* and harden image responses. 2026-10-26 23:06:23 +01:00
nobswebdev 5db90f02c5 Add GET /i/:id/:secret hotlink image decrypt stream. 2026-10-26 21:47:30 +01:00
nobswebdev 82cdb6ffa3 Clear ZK viewer secrets and image blob when leaving the page. 2026-10-26 20:22:47 +01:00
nobswebdev dc8e576679 add password prompt to ZK viewer for wrapped uploads 2026-10-26 20:06:54 +01:00
nobswebdev 112aa99f1e add ViewerView decrypt from URL fragment via view store 2026-10-26 19:13:15 +01:00
nobswebdev 65bbc4537b add GET /api/uploads/:id for zk ciphertext JSON 
Expose ZK ciphertext and wrap fields for the viewer; return 404 for
missing, non-zk, or absent storage. Use injected upload repository and
shared isErrorEnoent for missing files.
 2026-10-26 02:11:57 +01:00
nobswebdev 7b70788dcf Point hotlink viewer links at the viewer page path. 
Hotlink share links were using the zero-knowledge viewer URL. The direct image URL stays separate for embeds.
 2026-10-25 23:39:33 +01:00
nobswebdev ee9f80da5f Remove unused resolveAxiosErrorMessage helper. 
Upload UI uses predefined queue messages only; surfacing API response text is out of scope for this PR.
 2026-10-25 22:23:01 +01:00
nobswebdev 42fe209164 Simplify upload modal, dropzone, and settings markup. 
Remove redundant dialog ARIA wiring, hide the file input with hidden instead of sr-only, and trim footnote accessibility attributes that duplicated visible text.
 2026-10-25 22:00:16 +01:00
nobswebdev f5be0a0de3 Show copyable share links after batch upload completes. 
Add share results panel gated by showShareLinks, build URLs from queue entry secrets, and align file name handling with the metadata inspector.
 2026-10-25 22:00:16 +01:00
nobswebdev f305ce7a39 Refactor metadata inspector with shared tab list and output panel. 
Reuse InlineTabList for original/stripped tabs and a single pre block component to match patterns used elsewhere on the upload page.
 2026-10-25 22:00:15 +01:00
nobswebdev 4e9a3368a6 Persist upload IDs and URL secrets on successful queue entries. 
Store server response fields and mode-specific secrets so share links can be built client-side after upload without precomputed paths.
 2026-10-25 22:00:05 +01:00
nobswebdev 5f6ee193e7 Configure share link origins from clearnet scheme and onion hostname. 
Lets the frontend build full viewer and delete URLs for both networks without hardcoding host shape in components.
 2026-10-25 22:00:05 +01:00
nobswebdev 95ed6e5f58 Add share URL builders and embed format helpers for uploaded images. 
Centralize clearnet/onion paths, delete links, and BBCode/Markdown/HTML output with unit tests and escape-html for safe HTML snippets.
 2026-10-25 22:00:01 +01:00
nobswebdev b4cc26a632 Polish upload UI for dual queue status and batch confirm flow. 
Metadata error confirm, success styling, upload-confirmed hiding of configure, and remove stale PR plan doc.
 2026-10-23 18:34:17 +02:00
nobswebdev 271c2b7b2d Execute batch uploads with metadata gates, encryption, and queue state. 
Separate upload entries per file, ALTCHA on POST, and stripped-or-original fallback on metadata errors.
 2026-10-23 18:34:13 +02:00
nobswebdev fe643d9831 Add client ALTCHA proof-of-work and Vite env flags for uploads. 
Expose enabled/max-number settings and wire altcha-lib for per-upload challenges.
 2026-10-23 18:34:09 +02:00
nobswebdev 805665745b Add batch upload configure modal and settings mapping utilities. 
Users configure share mode, expiry, and max views before upload; batch summary confirms choices above the queue.
 2026-10-22 03:14:02 +02:00
nobswebdev 3bb3258686 Pin dev Docker images to Node 22.23.4 for October 2026 security fixes. 2026-10-21 17:46:33 +02:00
nobswebdev bd456451a4 Remove NEVER_MODE_INACTIVITY_DAYS env variable as idea of cleanup of inactive images changed 2026-10-21 15:03:53 +02:00
nobswebdev d82d451448 Extract upload dropzone and queue UI with shared pick validation utils. 2026-10-20 22:20:16 +02:00
nobswebdev 47361a83b9 add optional Argon2id password wrap for zk uploads. 
Wrap the image DEK for password-protected batches, keep the URL fragment as a separate secret, and extend prepare/decrypt helpers with tests.
 2026-10-20 18:31:33 +02:00
nobswebdev 4376ed7ff1 Expand Vitest coverage for shared frontend utils. 
Cover Axios error message extraction, generic error fallbacks, ArrayBuffer views used by Web Crypto, and share URL builders.
 2026-10-19 23:05:46 +02:00
nobswebdev afbd5e204c Add client-side ZK and hotlink upload crypto with Pinia store. 
Encrypt image bytes in the browser, keep keys out of POST bodies (URL fragment or path secret), and POST ciphertext via typed upload API helpers.
 2026-10-19 23:05:33 +02:00
nobswebdev 0238858c8b add frontend AES-GCM and base64 helpers with Vitest coverage. 2026-10-19 03:00:03 +02:00
nobswebdev f2987da2fe update upload validation to use shared AES-GCM size constants on the backend. 2026-10-19 02:59:52 +02:00
nobswebdev e1f0d01467 Restore Axios error.message when response body has no API message. 2026-10-18 18:22:15 +02:00
nobswebdev 1826cef8fe Strip metadata in the ExifTool worker during upload preview. 
Cache stripped blobs, show original vs stripped metadata tabs, and keep user-facing errors on fixed store messages with console logging for diagnostics.
 2026-10-18 18:02:49 +02:00
nobswebdev 18597f4127 Add upload queue UI with ExifTool metadata preview on pick. 
Users can select images within configured limits, see per-row load status, and inspect raw ExifTool output before upload work continues.
 2026-10-17 21:39:59 +02:00
nobswebdev 5b6304709e Serialize ExifTool work in the worker with a FIFO job queue. 
Overlapping parseMetadata calls on one WASM instance caused wrong metadata when multiple files were read in parallel; callers can still postMessage concurrently.
 2026-10-15 20:43:22 +02:00
nobswebdev e10341d44b Patch zeroperl-ts so worker WASM load honors custom fetch. 
Postinstall updates @6over3/zeroperl-ts and wires the worker to load zeroperl.wasm via Vite ?url.
 2026-10-15 18:57:43 +02:00
nobswebdev 42f9a3eafc Wire metadata previews through ExifTool store with friendly status messages. 
Prefetch ExifTool on upload mount and track pending/loading/ready per file for batch preview loads.
 2026-10-15 17:18:25 +02:00
nobswebdev b47c5c7696 Add ExifTool worker and Pinia store for off-thread metadata reads. 
Warm up WASM in a dedicated worker with a tiny JPEG probe and expose init/read RPC to the main thread.
 2026-10-15 17:18:21 +02:00
nobswebdev 321c67fa3d Add metadata Pinia store for ExifTool queue preview reads. 
Introduce preview entry types, resolveErrorMessage, and nullcart-style resolveAxiosErrorMessage for upcoming upload API errors.
 2026-10-13 22:18:48 +02:00
nobswebdev e89f76a673 Pin @uswriting/exiftool and patch exit-0 stderr guard on install. 
Postinstall removes upstream guards that mark parseMetadata failed when stderr is non-empty after success; Docker dev image copies patches before npm ci.
 2026-10-13 21:07:04 +02:00
nobswebdev 8b42dbb962 Use Node 22 in dev Docker images for file-type v22. 2026-10-12 21:45:44 +02:00
nobswebdev bffb6de145 Align frontend env with single-image upload validation limits. 2026-10-12 20:18:43 +02:00
nobswebdev d4529376c6 Add single-image zk and hotlink upload API with service tests. 
Replace batch DTOs with per-mode endpoints, persist ciphertext with file-type
checks, and return a hashed delete token for future revocation.
 2026-10-12 20:18:40 +02:00
nobswebdev 7f99256863 Verify ALTCHA before upload body parse with single-use replay store. 
Run challenge TTL and replay tracking in middleware, remove the guard, and
wire ScheduleModule for pruning used solutions.
 2026-10-12 20:18:36 +02:00
nobswebdev 96383a7426 Restructure upload validation env and colocate config types. 
Move app config shapes under types/config, replace batch upload env vars with
per-image bytes and JSON body padding, and extend IsBase64 for decoded limits.
 2026-10-12 20:18:22 +02:00
nobswebdev 4b7f8459cb Align frontend env with validation limits and axios plugin. 
Flatten share/API config keys, nest validation limits only, and move the HTTP client to plugins/axios.
 2026-10-07 00:36:16 +02:00
nobswebdev c762223200 Add zk and hotlink upload create DTOs with batch options. 
Split item shapes, array caps from config, and password-protected zk item transform.
 2026-10-07 00:36:16 +02:00
nobswebdev fa36b27d1b Add isBase64 and NullOr validators for upload DTOs. 
Include toBase64 helper and focused specs for base64 and null-or field rules.
 2026-10-07 00:36:13 +02:00
nobswebdev 493843cc42 Move upload caps into validation config env vars. 
Replace MAX_IMAGES_PER_UPLOAD with VALIDATION_UPLOAD_* limits mirrored on the frontend VITE_* names.
 2026-10-07 00:36:10 +02:00
nobswebdev 64180d21e7 validate env booleans as true/false strings only. 
Avoid @IsBoolean with implicit conversion mismatching isEnabled(); add tests and shared BOOLEAN_STRING_VALUES.
 2026-10-06 19:44:31 +02:00
nobswebdev b16678bf74 add dockerignore for backend and frontend dev images. 
Prevent copying host node_modules, dist, and build artifacts into Docker build context.
 2026-10-06 19:44:13 +02:00
nobswebdev e50c71e549 update .env.example with ALTCHA and throttle variables. 
Add default THROTTLE_TTL_MS and THROTTLE_LIMIT; remove obsolete hotlink throttle env keys.
 2026-10-06 19:06:32 +02:00
nobswebdev 7e4a889b50 add upload rate limiter per IP to backend. 
Nest throttler with nullcart-style default profile and upload override via throttleProfiles.
 2026-10-06 18:59:44 +02:00
nobswebdev 84f8a85214 add ALTCHA verification guard for uploads. 
Verify body.altcha when ALTCHA_ENABLED; export AltchaGuard only. Drop unused StorageModule export.
 2026-10-06 15:04:31 +02:00
nobswebdev 87376ea37f add ALTCHA challenge endpoint and env config. 
GET /api/altcha/challenge, nullcart-style env validation, and ALTCHA_ENABLED wiring.
 2026-10-05 23:53:28 +02:00
nobswebdev a8070da39d add local ciphertext storage module to backend. 
Bind-mount backend/uploads in dev; path helpers with traversal guards and Jest coverage for StorageService.
 2026-10-05 23:01:31 +02:00
nobswebdev fb1cb1d6b0 add migration and entities for uploads upload_zk upload_hotlink. 2026-10-05 22:14:26 +02:00
nobswebdev 64041aa9a8 add TypeORM postgres config and migration runner. 2026-10-05 20:54:50 +02:00
nobswebdev 7bf4a851aa add VITE share and API vars to env example. 2026-09-28 14:55:56 +02:00
nobswebdev ceeaea2120 add Pinia axios and VITE config to frontend. 2026-09-28 14:55:56 +02:00
nobswebdev a7dac01168 add vue-router and empty upload viewer delete views. 2026-09-28 14:55:21 +02:00
nobswebdev 0d1b9c0d40 add Tailwind and design tokens to frontend. 
Tailwind v4 via Vite plugin, theme tokens in main.css, and VS Code hints for v4 at-rules.
 2026-09-28 14:24:57 +02:00
nobswebdev 8287fa4aae add dev quickstart to README. 
Document env copy, no-cache compose build, and local npm install for editors.
 2026-09-27 23:28:31 +02:00
nobswebdev 559ba6c4b5 add frontend Docker dev service on port 5173. 
Vite hot reload via src bind mount; starts after backend health check passes.
 2026-09-27 23:25:34 +02:00
nobswebdev cb0eed2e01 add Prettier config from nullcart. 
Editor format-on-save uses root .prettierrc; align App.vue indentation.
 2026-09-27 23:16:11 +02:00
nobswebdev 3ed8510aa9 add Vite Vue 3 TypeScript frontend skeleton. 
Minimal home view and dev server on port 5173 for later Docker wiring.
 2026-09-27 23:12:01 +02:00
nobswebdev 572844bc73 add backend Docker dev service with hot reload. 
Wire Nest into dev compose with src bind mount and health-check probe.
 2026-09-27 23:06:19 +02:00
nobswebdev a785ce775f add NestJS skeleton and GET /api/health-check. 
Thin API bootstrap with config module and nullcart-style health route for Docker checks.
 2026-09-27 23:05:28 +02:00
nobswebdev aff4d2cc6f add deploy scripts and Tor skeleton from nullcart. 
Prod deploy, cert bootstrap/issue/renew, and onion hostname helper for docker-compose.prod.
 2026-09-27 22:52:58 +02:00
nobswebdev 4cb44e4582 add .env.example and docker-compose.dev.yml for local dev. 
Postgres 16, pgAdmin 8, and env placeholders for backend, ALTCHA, and throttles.
 2026-09-27 22:49:17 +02:00
nobswebdev 90c2bbdbdd add monorepo layout and root README 2026-09-27 22:29:19 +02:00
nobswebdev 6bc8c2f92b init Readme 2026-09-27 18:17:47 +02:00