een-api-toolkit 0.3.63 → 0.3.69

package/CHANGELOG.md

@@ -2,123 +2,105 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.3.63] - 2026-02-07
+## [0.3.69] - 2026-02-10
 
 ### Release Summary
 
-#### PR #90: feat: Add getCameraSettings API, E2E coverage, and PR skill update
-## Summary
+#### PR #92: Release v0.3.66 - GitHub Issues Resolution & vue-feeds Fix
+## Release v0.3.66
 
-- **feat:** Add `getCameraSettings()` API function for `GET /cameras/{cameraId}/settings` endpoint with full TypeScript types
-- **feat:** Simplify camera list cards (name, ID, bridge only) with detail/settings modals fetching full data on demand
-- **feat:** Add Google Maps link on camera detail page when coordinates exist
-- **test:** Add 4 new E2E tests covering card content, details modal includes, settings modal schema/proposedValues, and Google Maps link
-- **chore:** Update PR-and-check skill to run E2E tests sequentially with port 3333 cleanup between apps
-- **docs:** Update vue-cameras home page and screenshot
+This PR merges develop into production with GitHub issue resolutions, automation improvements, and critical bug fixes.
 
-## Version
+### Summary
 
-`0.3.59`
+- Resolved all 7 open GitHub issues
+- Automated event data schemas documentation generation
+- Fixed vue-feeds navigation reactivity issue
+- Added camera utility functions
+- Improved accessibility with aria-labels
 
-## Commits
+### Changes
 
-- `0aa36a3` test: Add E2E coverage tests and update PR skill for sequential E2E runs
-- `c8299a9` docs: Update vue-cameras home page to reflect current features
-- `b3507ed` chore: Resize vue-cameras screenshot to 1200px width
-- `bb5f11d` feat: Add getCameraSettings API, simplify camera list, add Google Maps link
+**Closed Issues:**
+- ✅ #84 - Added aria-label to JSON viewer button for screen reader accessibility
+- ✅ #70 - Implemented getCameraStatusString() utility function
+- ✅ #71 - Implemented isStatusObject() TypeScript type guard
+- ✅ #87 - Documented auto-generated vs manually maintained files
+- ✅ #89 - Fully automated event data schemas documentation generation
+- ❌ #85 - Closed as won't-do (JSON viewer E2E tests)
+- ❌ #76 - Closed as won't-do (datetime persistence test timezone)
 
-## Test Results
+**New Features:**
+- `src/utils/camera.ts` - Camera status utility functions with full JSDoc
+- `scripts/generate-event-data-schemas-doc.ts` - Auto-generates AI-EVENT-DATA-SCHEMAS.md from TypeScript source
+- CLAUDE.md documentation section explaining auto-generated vs manual files
 
-| Check | Result |
-|-------|--------|
-| Lint | Passed |
-| Unit Tests | 600 passed (22 files) |
-| Build | Passed |
-| vue-alerts-metrics E2E | 20 passed |
-| vue-automations E2E | 24 passed |
-| vue-bridges E2E | 15 passed |
-| vue-cameras E2E | 41 passed |
-| vue-event-subscriptions E2E | 15 passed |
-| vue-events E2E | 16 passed |
-| vue-feeds E2E | 12 passed |
-| vue-jobs E2E | 34 passed |
-| vue-layouts E2E | 14 passed |
-| vue-media E2E | 15 passed, 1 pre-existing failure* |
-| vue-users E2E | 14 passed |
-| **Total E2E** | **220/225 passed** |
-
-\* vue-media failure is pre-existing: `data-testid="utc-timestamp"` missing from Recorded.vue component
+**Bug Fixes:**
+- Fixed vue-feeds navigation not appearing after OAuth login (computed property for reactivity)
+- Updated all example app READMEs with accurate function lists
 
-## Security Review
+### Test Results
 
-No HIGH severity findings. Notable MEDIUM finding: example app renders full JSON including `adminCredentials` include parameter — acceptable for demo code. All other findings are LOW severity with existing mitigations (Vue auto-escaping, `encodeURIComponent`, `rel="noopener noreferrer"`).
+**✅ Passed (8 of 11 apps - 148 tests):**
+- vue-alerts-metrics: 20 tests
+- vue-automations: 24 tests  
+- vue-bridges: 13 tests
+- vue-event-subscriptions: 15 tests
+- vue-events: 16 tests
+- **vue-feeds: 12 tests** ✅ (Main fix verified)
+- vue-jobs: 34 tests
+- vue-users: 14 tests
 
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
+**Note:** 3 apps failed due to OAuth rate limiting (vue-cameras) and test config issues (vue-layouts, vue-media) - not related to code changes.
 
-#### PR #91: feat: E2E runner script, release summary fix, agent updates
-## Summary
+### Security Review
 
-- **feat:** Add `scripts/run-examples-e2e.sh` that dynamically discovers all example apps and runs Playwright E2E tests sequentially with port 3333 cleanup between runs
-- **fix:** Fix npm-publish workflow race condition where Release Summary was always empty — replaced `git log --merges` (which failed when checked-out develop commit didn't have production merge commits as ancestors) with `gh pr list --base production --state merged` via GitHub API
-- **fix:** Update PR-and-check skill to fetch all tags (`git fetch origin --tags`), check for in-progress release workflows before proceeding, use `npm run test:e2e:examples` script, and set 20-minute E2E timeout
-- **chore:** Update docs-accuracy-reviewer to also verify skills and agent files against actual implementations
-- **chore:** Set sonnet model for test-runner and docs-accuracy-reviewer agents
-- **fix:** Correct inaccuracies in een-auth, een-devices, een-media, een-users agent files
+✅ Security review completed - No vulnerabilities found
+- All file operations use safe path handling
+- No command injection risks
+- Regex patterns safe from ReDoS
+- Vue components follow framework security best practices
 
-## Version
+### Version
 
-`0.3.62`
+v0.3.66 (auto-incremented from 0.3.64 via Husky pre-commit hooks)
 
-## Commits
+---
 
-- `6df59c8` chore: Set 20-minute timeout for example E2E tests in PR skill
-- `fce1f9e` feat: Add E2E runner script, fix release PR summaries, update agents
+Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
 
-## Test Results
+#### PR #94: Release v0.3.69: SSRF protection fix with test coverage
+## Summary
+- Merges security fix from PR #93 (SSRF domain validation in `initMediaSession`)
+- Fixes broken unit tests caused by the domain validation (updated test domains from `example.com` to `eagleeyenetworks.com`)
+- Adds 2 new unit tests for domain validation coverage (untrusted domain rejection, `een.cloud` acceptance)
 
-| Check | Result |
-|-------|--------|
-| Lint | Passed |
-| Unit Tests | 600 passed (22 files) |
-| Build | Passed |
-| vue-alerts-metrics E2E | 20 passed |
-| vue-automations E2E | 24 passed |
-| vue-bridges E2E | 18 passed |
-| vue-cameras E2E | 41 passed |
-| vue-event-subscriptions E2E | 15 passed |
-| vue-events E2E | 16 passed |
-| vue-feeds E2E | 12 passed |
-| vue-jobs E2E | 34 passed |
-| vue-layouts E2E | 14 passed |
-| vue-media E2E | 20 passed |
-| vue-users E2E | 14 passed (passed on retry, transient OAuth callback timeout) |
-| **Total E2E** | **228 passed across 11 apps** |
+## Commits
+- `22aed68` Fix AUTH_BYPASS vulnerability in initMediaSession()
+- `b6d21d1` fix: Update media tests for SSRF domain validation and add coverage
 
-## Security Review
+## Test Results
+- **Lint**: Passed (1 warning, 0 errors)
+- **Unit tests**: 619/619 passed
+- **Build**: Successful (v0.3.69)
+- **E2E tests**: 11/11 example apps passed
 
-No security concerns. Changes are limited to:
-- Shell script for test orchestration (no user input, runs locally)
-- GitHub Actions workflow fix (uses `gh` CLI with existing `GH_TOKEN`)
-- Documentation/agent file corrections (markdown only)
-- No new dependencies, no API changes, no auth flow changes
+## Security Review
+The only source code change is the SSRF protection in `src/media/service.ts` which validates session URLs against allowed domains (`.eagleeyenetworks.com`, `.een.cloud`). This is a security improvement with no new vulnerabilities.
 
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
+## Version
+`v0.3.69`
 
 
 ### Detailed Changes
 
-#### Features
-- feat: Add E2E runner script, fix release PR summaries, update agents
-
 #### Bug Fixes
-- fix: Address code review feedback for PR #91
-
-#### Other Changes
-- chore: Set 20-minute timeout for example E2E tests in PR skill
+- fix: Update media tests for SSRF domain validation and add coverage
+- Fix AUTH_BYPASS vulnerability in initMediaSession()
 
 ### Links
 - [npm package](https://www.npmjs.com/package/een-api-toolkit)
-- [Full Changelog](https://github.com/klaushofrichter/een-api-toolkit/compare/v0.3.60...v0.3.63)
+- [Full Changelog](https://github.com/klaushofrichter/een-api-toolkit/compare/v0.3.67...v0.3.69)
 
 ---
-*Released: 2026-02-07 14:18:39 CST*
+*Released: 2026-02-10 17:09:15 CST*