webpeel 0.20.2 → 0.20.3

package/dist/server/routes/playground.js

@@ -0,0 +1,283 @@
+/**
+ * Playground endpoint — GET /v1/playground?url=<encoded_url>
+ *                       GET /v1/playground/search?q=<query>
+ *
+ * Unauthenticated endpoints for the WebPeel playground page.
+ * Lets visitors try the product without signing up.
+ *
+ * Security:
+ * - CORS-locked to webpeel.dev and localhost
+ * - IP-based rate limit: 10 requests per 15 minutes (shared across /fetch and /search)
+ * - Simple HTTP-only fetch (no browser rendering)
+ * - 5-second timeout
+ * - Content truncated to 5,000 chars
+ * - No screenshots
+ */
+import { Router } from 'express';
+import { peel } from '../../index.js';
+import { getBestSearchProvider } from '../../core/search-provider.js';
+import { createLogger } from '../logger.js';
+const log = createLogger('playground');
+// ── IP-based rate limiter ─────────────────────────────────────────────────────
+const MAX_PER_WINDOW = 10;
+const WINDOW_MS = 15 * 60 * 1000; // 15 minutes
+const ipHits = new Map();
+function checkRateLimit(ip) {
+    const now = Date.now();
+    const entry = ipHits.get(ip);
+    if (!entry || now > entry.resetAt) {
+        const resetAt = now + WINDOW_MS;
+        ipHits.set(ip, { count: 1, resetAt });
+        return { allowed: true, remaining: MAX_PER_WINDOW - 1, resetAt };
+    }
+    if (entry.count >= MAX_PER_WINDOW) {
+        return { allowed: false, remaining: 0, resetAt: entry.resetAt };
+    }
+    entry.count++;
+    return { allowed: true, remaining: MAX_PER_WINDOW - entry.count, resetAt: entry.resetAt };
+}
+// Clean up expired entries every 5 minutes
+setInterval(() => {
+    const now = Date.now();
+    for (const [ip, entry] of ipHits) {
+        if (now > entry.resetAt)
+            ipHits.delete(ip);
+    }
+}, 5 * 60 * 1000).unref();
+// ── CORS helper ───────────────────────────────────────────────────────────────
+function setCorsHeaders(req, res) {
+    const origin = req.headers.origin || '';
+    if (origin === 'https://webpeel.dev' ||
+        /^http:\/\/localhost(:\d+)?$/.test(origin) ||
+        /^http:\/\/127\.0\.0\.1(:\d+)?$/.test(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+    }
+    else if (!origin) {
+        // Allow curl and server-to-server (no Origin header)
+        res.setHeader('Access-Control-Allow-Origin', '*');
+    }
+    res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+}
+// ── IP extraction ─────────────────────────────────────────────────────────────
+function getClientIp(req) {
+    const forwardedFor = req.headers['x-forwarded-for'];
+    const firstForwardedIp = typeof forwardedFor === 'string'
+        ? forwardedFor.split(',')[0].trim()
+        : Array.isArray(forwardedFor) ? forwardedFor[0] : undefined;
+    return req.headers['cf-connecting-ip']
+        || firstForwardedIp
+        || req.headers['x-real-ip']
+        || req.ip
+        || req.socket?.remoteAddress
+        || 'unknown';
+}
+// ── CORS origin check ─────────────────────────────────────────────────────────
+function isAllowedOrigin(req) {
+    const origin = req.headers.origin || req.headers.referer || '';
+    if (!origin)
+        return true; // Allow curl / server-to-server (no Origin header)
+    return (origin === 'https://webpeel.dev' ||
+        origin.startsWith('https://webpeel.dev/') ||
+        /^http:\/\/localhost(:\d+)?/.test(origin) ||
+        /^http:\/\/127\.0\.0\.1(:\d+)?/.test(origin));
+}
+// ── Router ────────────────────────────────────────────────────────────────────
+const MAX_CONTENT_LENGTH = 5000;
+const FETCH_TIMEOUT_MS = 5000;
+const SIGN_UP_URL = 'https://app.webpeel.dev';
+export function createPlaygroundRouter() {
+    const router = Router();
+    // ── CORS preflight ─────────────────────────────────────────────────────────
+    router.options('/', (req, res) => {
+        setCorsHeaders(req, res);
+        res.status(204).end();
+    });
+    router.options('/search', (req, res) => {
+        setCorsHeaders(req, res);
+        res.status(204).end();
+    });
+    // ── GET /v1/playground?url=... ─────────────────────────────────────────────
+    router.get('/', async (req, res) => {
+        setCorsHeaders(req, res);
+        // CORS check
+        if (!isAllowedOrigin(req)) {
+            res.status(403).json({
+                success: false,
+                error: {
+                    type: 'cors_denied',
+                    message: 'Playground is only available from webpeel.dev',
+                    hint: `Sign up at ${SIGN_UP_URL} for full API access.`,
+                },
+            });
+            return;
+        }
+        const url = (req.query.url || '').trim();
+        if (!url) {
+            res.status(400).json({
+                success: false,
+                error: {
+                    type: 'missing_url',
+                    message: 'URL parameter is required',
+                    hint: 'GET /v1/playground?url=https://example.com',
+                },
+            });
+            return;
+        }
+        // Basic URL validation
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(url);
+        }
+        catch {
+            res.status(400).json({
+                success: false,
+                error: {
+                    type: 'invalid_url',
+                    message: 'Invalid URL format',
+                    hint: 'Ensure the URL is well-formed: https://example.com',
+                },
+            });
+            return;
+        }
+        if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+            res.status(400).json({
+                success: false,
+                error: {
+                    type: 'invalid_url',
+                    message: 'Only HTTP and HTTPS URLs are allowed',
+                },
+            });
+            return;
+        }
+        // Rate limit by IP
+        const ip = getClientIp(req);
+        const rl = checkRateLimit(ip);
+        res.setHeader('X-RateLimit-Limit', String(MAX_PER_WINDOW));
+        res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(rl.resetAt / 1000)));
+        if (!rl.allowed) {
+            res.status(429).json({
+                success: false,
+                error: {
+                    type: 'rate_limited',
+                    message: 'Playground limit reached (10 requests per 15 minutes)',
+                    hint: `Sign up for a free API key for unlimited access: ${SIGN_UP_URL}`,
+                },
+                playground: true,
+            });
+            return;
+        }
+        try {
+            log.info('Playground fetch', { url, ip });
+            const startMs = Date.now();
+            const result = await peel(url, {
+                timeout: FETCH_TIMEOUT_MS,
+                render: false,
+                noEscalate: true,
+            });
+            const fullContent = result.content || '';
+            const content = fullContent.slice(0, MAX_CONTENT_LENGTH);
+            const truncated = fullContent.length > MAX_CONTENT_LENGTH;
+            res.json({
+                success: true,
+                url: result.url,
+                title: result.title,
+                content,
+                tokens: result.tokens,
+                method: result.method,
+                elapsed: Date.now() - startMs,
+                truncated,
+                ...(truncated && {
+                    upgrade: `Full content available with a free API key → ${SIGN_UP_URL}`,
+                }),
+                playground: true,
+                rateLimitRemaining: rl.remaining,
+            });
+        }
+        catch (err) {
+            log.warn('Playground fetch error', { url, error: err?.message });
+            res.status(502).json({
+                success: false,
+                error: {
+                    type: 'fetch_failed',
+                    message: err?.message || 'Failed to fetch URL',
+                    hint: 'Check that the URL is publicly accessible.',
+                },
+                playground: true,
+            });
+        }
+    });
+    // ── GET /v1/playground/search?q=... ───────────────────────────────────────
+    router.get('/search', async (req, res) => {
+        setCorsHeaders(req, res);
+        // CORS check
+        if (!isAllowedOrigin(req)) {
+            res.status(403).json({
+                success: false,
+                error: {
+                    type: 'cors_denied',
+                    message: 'Playground is only available from webpeel.dev',
+                },
+            });
+            return;
+        }
+        const q = (req.query.q || '').trim();
+        if (!q) {
+            res.status(400).json({
+                success: false,
+                error: {
+                    type: 'missing_query',
+                    message: 'Query parameter is required',
+                    hint: 'GET /v1/playground/search?q=your+query',
+                },
+            });
+            return;
+        }
+        // Rate limit by IP (shared counter with fetch)
+        const ip = getClientIp(req);
+        const rl = checkRateLimit(ip);
+        res.setHeader('X-RateLimit-Limit', String(MAX_PER_WINDOW));
+        res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(rl.resetAt / 1000)));
+        if (!rl.allowed) {
+            res.status(429).json({
+                success: false,
+                error: {
+                    type: 'rate_limited',
+                    message: 'Playground limit reached (10 requests per 15 minutes)',
+                    hint: `Sign up for a free API key for unlimited access: ${SIGN_UP_URL}`,
+                },
+                playground: true,
+            });
+            return;
+        }
+        try {
+            log.info('Playground search', { q, ip });
+            const startMs = Date.now();
+            const { provider, apiKey } = getBestSearchProvider();
+            const results = await provider.searchWeb(q, { count: 5, apiKey });
+            res.json({
+                success: true,
+                query: q,
+                results,
+                elapsed: Date.now() - startMs,
+                playground: true,
+                rateLimitRemaining: rl.remaining,
+            });
+        }
+        catch (err) {
+            log.warn('Playground search error', { q, error: err?.message });
+            res.status(502).json({
+                success: false,
+                error: {
+                    type: 'search_failed',
+                    message: err?.message || 'Search failed',
+                },
+                playground: true,
+            });
+        }
+    });
+    return router;
+}

package/dist/server/routes/screenshot.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Screenshot endpoint — POST /v1/screenshot
+ *
+ * Takes a screenshot of a URL and returns base64-encoded image data.
+ * Uses the same rate limiting / credit system as the fetch endpoint (1 credit).
+ *
+ * The main endpoint accepts an optional `mode` parameter to select behaviour:
+ *   - "screenshot" (default) — basic screenshot
+ *   - "filmstrip"            — multiple frames over time
+ *   - "audit"               — accessibility / section audit
+ *   - "viewports"           — multi-viewport screenshots
+ *   - "design"              — design analysis (audit + tokens merged)
+ *   - "diff"                — visual diff between url and compareUrl
+ *   - "compare"             — design comparison between url and compareUrl/ref
+ *
+ * All legacy sub-endpoints (/filmstrip, /audit, /viewports, …) are kept as
+ * thin wrappers that delegate to the same named handler functions.
+ * /animation is deprecated and returns 410 Gone.
+ */
+import { Router } from 'express';
+import type { AuthStore } from '../auth-store.js';
+export declare function createScreenshotRouter(authStore: AuthStore): Router;