Commit Graph
24 Commits
Author SHA1 Message Date
biggy d46f9644bb feat: DOMPurify HTML sanitization (P3)
Replace regex-based stripScriptTags with isomorphic-dompurify:
- Whitelist-based HTML sanitization prevents XSS bypasses
- Removes scripts, event handlers, and dangerous attributes
- Preserves data: URIs for inlined CSS/images
- Maintains complete document structure for Tizen TVs

Also updates:
- Data flow diagram comments (SEC 19)
- Modification guide comments
- Dependencies (isomorphic-dompurify ^2.36.0)
2026-06-24 07:46:05 +02:00
biggy f17d2f533a fix: static analysis remediation
- Add error logging to inlineAllResources() catch block (P2)
  - Logs warning when resource inlining fails instead of silent fail
  - Updated SEC 22 header comment to reflect change

Note: bakeStyles is correctly scoped to URLItem (per-URL), not View-level.
The DB column exists but code properly uses urlItem.bakeStyles.
2026-06-24 07:46:05 +02:00
biggy 3a21070d62 chore: static analysis baseline
Pre-analysis checkpoint before implementing fixes for:
- bakeStyles field mapping
- error logging improvements
- HTML sanitization hardening
2026-06-24 07:46:05 +02:00
biggy e862827d2d feat(render): add waitBeforeCaptureMs option and refactor CSS baking
Add waitBeforeCaptureMs parameter to URLItem and renderSSR to allow waiting
before capturing page content (useful for animations/dynamic content).

Refactor bakeComputedStyles from per-element computed style baking to a
simplified approach that collects all CSS into a single inline style tag.
This reduces complexity while maintaining compatibility.
2026-06-24 07:46:05 +02:00
biggy a6e93564ba feat(tv-remote-control): add Samsung TV remote control program
- Add `program.py` implementing async MDC client to manage TV power state and display ID
- Add `requirements.txt` with `python-samsung-mdc` dependency
2026-06-19 12:00:57 +02:00
biggy 5020d2c288 style: format code for better readability
- Format arrays and objects on multiple lines for clarity
- Add trailing commas to arrays and objects
- Format function parameters across multiple lines when needed
- Format string concatenation and template literals consistently
- Format try-catch blocks with proper spacing
2026-05-13 13:46:47 +02:00
biggy ac759a60fe feat(ui): add banned IPs management to debug panel
- Add debug section for banned IPs with refresh button
- Implement fetchBannedIPs() function to display banned IPs in table
- Add adminUnban() function for unbanning IPs from UI
- Show IP, ban time, reason, banned by, and unban action in table
2026-05-13 13:36:37 +02:00
biggy 75f9686533 feat(security): add IP banning system with admin controls
- Add banned_ips database table with IP, timestamp, reason, and banned_by fields
- Implement IP ban checking in deviceTrack to block banned connections
- Add admin API endpoints: /api/admin/ban/:ip, /api/admin/unban/:ip, /api/admin/disconnect/:ip, /api/admin/refresh/:ip
- Add GET /api/banned endpoint to retrieve banned IPs list
- Return 403 error page for banned IP connections
2026-05-13 13:36:35 +02:00
biggy daee65e0d5 feat(perf): add cache warmup for improved performance
Implement automatic cache warming when users first connect to views.
Pre-renders all URLs in a view to eliminate initial load latency.
Also adds periodic warmup for active devices and removes cache TTL
refresh on cache hits to preserve original expiration timing.
2026-05-13 13:17:57 +02:00
biggy 69b62b6af3 feat(ui): add close button to modal dialogs
Add × button to modal overlays for better UX. Button is positioned
in top-right corner with hover effects and proper styling.
2026-05-13 13:17:55 +02:00
biggy 6d38beaf26 Merge pull request 'refactor: replace MJPEG streaming with screenshot + meta-refresh' (#1) from deepseek-fix into main
Reviewed-on: #1
2026-05-13 11:12:36 +02:00
biggy f86b0411d5 refactor: move bakeStyles from view-level to per-URL setting 2026-05-13 10:54:59 +02:00
biggy 807ce639a7 chore: remove obsolete database file 2026-05-13 10:31:48 +02:00
biggy c294c8c85e feat: add dark mode and style baking support for Samsung TV compatibility 2026-05-13 10:31:46 +02:00
biggy b69d830fc8 build: update Docker configuration with chromium and compose setup 2026-05-13 10:31:43 +02:00
biggy 7c07454e7a chore: ignore views.db database file 2026-05-13 08:53:01 +02:00
biggy aadb241986 ops: add Docker deployment configuration 2026-05-13 08:52:25 +02:00
biggy 53944c44d3 fix(server): resolve localStorage SecurityError, request timeout, and navigation timeout issues
- Replace localStorage.clear() with CDP Storage.clearDataForOrigin to avoid SecurityError on about:blank (opaque origin)
- Add idleTimeout to Bun.serve config to prevent 10s timeout during queued renders
- Add timeout fallback for networkidle0 in renderSSR and renderScreenshotFrame to handle sites that never reach idle state
- Add recursive CSS @import resolver with font service filtering
- Preserve media attribute when inlining CSS
2026-05-13 08:52:24 +02:00
biggy 1aca866459 feat(debug): replace HTTP polling with WebSocket for real-time debug updates 2026-05-13 08:42:50 +02:00
biggy 94141e928c feat(api, ui): add debug panel and device tracking
Add real-time debug panel with server metrics, view status, cache
visualization, and device tracking. Add viewport/cache TTL config
to views. Simplify cache management and remove rate limiting.
2026-05-13 08:04:59 +02:00
biggy a1a1446ed1 build: add linting and formatting tooling 2026-05-13 08:04:55 +02:00
biggy 86b75598fd feat: add multi-browser page pooling, render caching, and rate limiting
- Implement browser pool with 2 browsers × 8 pages each
- Add page pool with acquire/release lifecycle and page reset between uses
- Add render cache with TTL-based expiry and pre-warming before rotation boundaries
- Add in-memory view cache to avoid repeated DB reads
- Add per-IP rate limiting (2s cooldown)
- Add concurrent render limit (16 max)
- Refactor database functions with `db` prefix for clarity
- Add CONFIG object for all tunable parameters
- Add In
2026-05-13 07:07:34 +02:00
biggy 722a3143dc refactor: replace MJPEG streaming with screenshot + meta-refresh
- Remove multipart/x-mixed-replace streaming (broken on Chromium)
- Add per-view screenshot rendering with base64 HTML embedding
- Implement resource inlining for CSS, images, and favicons
- Add render locks to prevent overlapping Puppeteer operations
- Simplify UpdateViewBody type to extend Partial<CreateViewBody>
- Update browser args for better stability
- Standardize formatting (tabs to spaces)
2026-05-12 23:31:33 +02:00
biggy edbe3f9bf2 init 2026-05-12 23:10:10 +02:00