glitchgrab 1.43.0 → 1.45.0

package/README.md

@@ -67,12 +67,65 @@ interface GlitchgrabSession {
   name: string;            // required - reporter's display name
   email?: string | null;   // optional
   phone?: string | null;   // optional
+  signature?: string | null; // optional - signSession() from "glitchgrab/server"
   [key: string]: unknown;  // any extra fields
 }
 ```
 
 The `userId` is stored with every report. Use it to look up which user reported a bug in your own database.
 
+## How do I protect my token?
+
+Your `gg_` token ships in your app's JavaScript, so anyone can copy it. That is by design — it can only file reports into one repo — but the AI features (the assistant, AI enhance, voice input, "already reported?") cost money on every call. Three things stop a copied token being abused:
+
+- **Rate limits.** Every token route is limited per token and per IP address. Nothing to configure.
+- **Allowed domains.** On the **Tokens** page, list the sites allowed to use a token from a browser (`https://app.example.com` — subdomains are included). Requests from any other website are refused. Empty means any site. A server-side script can fake the `Origin` header, so this stops the token being pasted into another website, not a determined attacker. Report filing from `glitchgrab/server`, MCP and CI is never affected.
+- **Signed users.** On the repo card, generate a signing secret and set **Signed users** to *Warn* or *Enforce*. Your server signs the logged-in user's id; the SDK sends that signature with its AI requests.
+
+```tsx
+// app/layout.tsx — a server component
+import { signSession } from "glitchgrab/server";
+import { auth } from "@/lib/auth"; // your auth library
+import { Providers } from "./providers";
+
+export default async function RootLayout({ children }: { children: React.ReactNode }) {
+  const user = (await auth())?.user;
+
+  const session = user
+    ? {
+        userId: user.id,
+        name: user.name ?? "User",
+        email: user.email,
+        // Reads GLITCHGRAB_SIGNING_SECRET. Server env only — never NEXT_PUBLIC_.
+        signature: signSession({ userId: user.id }),
+      }
+    : null;
+
+  return <Providers session={session}>{children}</Providers>;
+}
+
+// app/providers.tsx — "use client"
+// <GlitchgrabProvider token={process.env.NEXT_PUBLIC_GLITCHGRAB_TOKEN!} session={session}>
+```
+
+| Mode | Signed user | Unsigned or anonymous caller |
+|------|-------------|------------------------------|
+| Off | everything works | everything works |
+| Warn | everything works | everything works; the SDK logs a warning in development |
+| Enforce | everything works | AI features are hidden — **the plain report form still files** |
+
+- A signature lasts 24 hours by default (`signSession({ userId, ttlSeconds })`). Build it per request so it refreshes.
+- Rotating the secret breaks signatures already issued until your pages render again with the new one.
+- `signSession` throws when the secret or `userId` is missing — it runs on your server, where that is a deploy mistake worth seeing. The rest of the SDK never throws.
+
+## What data does Glitchgrab collect about reporters?
+
+Besides what the reporter types and the `session` you pass, every report records the **IP address it came from, an approximate location (city, region, country) and the network (ISP / ASN)**. Only you, the repo owner, can see it in Glitchgrab — it is never written into the GitHub issue. The raw IP is deleted after 90 days; a one-way hash, the location and the network are kept so repeat reports from one address can still be grouped.
+
+Reports sent from `glitchgrab/server` record your server's address, not an end user's.
+
+If your users are in India or the EU, mention this in your privacy policy (DPDP Act / GDPR treat an IP address as personal data).
+
 ## How do I add a report button?
 
 ### Default floating button

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { f as GlitchgrabProviderProps, U as UseGlitchgrabReturn, R as ReportButtonProps, F as FeedbackButtonProps, g as GlitchgrabSession, C as CaptureErrorOptions, e as GlitchgrabFeedback, a as BreadcrumbType, B as Breadcrumb, b as CapturedContext, D as DeviceInfo, c as FeedbackPayload, d as FeedbackResult, h as ReportPayload, i as ReportResult } from './types-YpA_jHFp.mjs';
-export { G as GlitchgrabConfig, j as ReportSeverity, k as ReportType, l as RuntimeInfo } from './types-YpA_jHFp.mjs';
+import { f as GlitchgrabProviderProps, U as UseGlitchgrabReturn, R as ReportButtonProps, F as FeedbackButtonProps, g as GlitchgrabSession, C as CaptureErrorOptions, e as GlitchgrabFeedback, a as BreadcrumbType, B as Breadcrumb, b as CapturedContext, D as DeviceInfo, c as FeedbackPayload, d as FeedbackResult, h as ReportPayload, i as ReportResult } from './types-Lldp5noh.mjs';
+export { G as GlitchgrabConfig, j as ReportSeverity, k as ReportType, l as RuntimeInfo } from './types-Lldp5noh.mjs';
 import * as React from 'react';
 import { ReactNode } from 'react';
 
@@ -364,12 +364,24 @@ interface EnhanceContext {
         message: string;
     }>;
 }
+/**
+ * The signed-in user as the host's server vouched for them (`signSession`).
+ *
+ * Rides in the request BODY, never a header: every token route sets its own
+ * CORS allow-list of headers, so a new header would fail preflight on all of
+ * them. Omitted entirely when there is no signature — an unsigned id proves
+ * nothing, and the server reads its absence as "unsigned".
+ */
+interface SignedIdentity {
+    userId?: string | null;
+    signature?: string | null;
+}
 /**
  * Polish raw description text via the Glitchgrab AI enhance endpoint.
  * Returns the polished text on success, or the original text on any failure.
  * Never throws.
  */
-declare function enhanceText(text: string, token: string, baseUrl?: string, screenshot?: string | null, context?: EnhanceContext | null): Promise<string>;
+declare function enhanceText(text: string, token: string, baseUrl?: string, screenshot?: string | null, context?: EnhanceContext | null, identity?: SignedIdentity | null): Promise<string>;
 
 declare function computeSignature(params: {
     errorMessage: string | undefined;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { f as GlitchgrabProviderProps, U as UseGlitchgrabReturn, R as ReportButtonProps, F as FeedbackButtonProps, g as GlitchgrabSession, C as CaptureErrorOptions, e as GlitchgrabFeedback, a as BreadcrumbType, B as Breadcrumb, b as CapturedContext, D as DeviceInfo, c as FeedbackPayload, d as FeedbackResult, h as ReportPayload, i as ReportResult } from './types-YpA_jHFp.js';
-export { G as GlitchgrabConfig, j as ReportSeverity, k as ReportType, l as RuntimeInfo } from './types-YpA_jHFp.js';
+import { f as GlitchgrabProviderProps, U as UseGlitchgrabReturn, R as ReportButtonProps, F as FeedbackButtonProps, g as GlitchgrabSession, C as CaptureErrorOptions, e as GlitchgrabFeedback, a as BreadcrumbType, B as Breadcrumb, b as CapturedContext, D as DeviceInfo, c as FeedbackPayload, d as FeedbackResult, h as ReportPayload, i as ReportResult } from './types-Lldp5noh.js';
+export { G as GlitchgrabConfig, j as ReportSeverity, k as ReportType, l as RuntimeInfo } from './types-Lldp5noh.js';
 import * as React from 'react';
 import { ReactNode } from 'react';
 
@@ -364,12 +364,24 @@ interface EnhanceContext {
         message: string;
     }>;
 }
+/**
+ * The signed-in user as the host's server vouched for them (`signSession`).
+ *
+ * Rides in the request BODY, never a header: every token route sets its own
+ * CORS allow-list of headers, so a new header would fail preflight on all of
+ * them. Omitted entirely when there is no signature — an unsigned id proves
+ * nothing, and the server reads its absence as "unsigned".
+ */
+interface SignedIdentity {
+    userId?: string | null;
+    signature?: string | null;
+}
 /**
  * Polish raw description text via the Glitchgrab AI enhance endpoint.
  * Returns the polished text on success, or the original text on any failure.
  * Never throws.
  */
-declare function enhanceText(text: string, token: string, baseUrl?: string, screenshot?: string | null, context?: EnhanceContext | null): Promise<string>;
+declare function enhanceText(text: string, token: string, baseUrl?: string, screenshot?: string | null, context?: EnhanceContext | null, identity?: SignedIdentity | null): Promise<string>;
 
 declare function computeSignature(params: {
     errorMessage: string | undefined;