Improvements v0.0.4 #5

Merged

rdenadai merged 4 commits from rdenadai/improvements-v0.0.4 into main 2026-08-14 22:19:29 +00:00

Conversation 0 Commits 4 Files changed 45 +1470 -267

rdenadai commented 2026-08-14 22:13:01 +00:00

Owner

Copy link

Summary

Small, scoped improvements for v0.0.4: new utilities, local Docker usability, frontend/backend code quality, and security fixes on the JWT tool and API docs page.

What's new

• Password Generator with configurable length and character sets.
• Color Wheel picker with keyboard/ARIA support and proper pointer handling.
• RGB / Hex color converter (#RRGGBB <-> rgb(...)).
• Regex Validator with named group highlighting.

Improvements

• Frontend quality: deduped constants/helpers, fixed duplicate labels, simplified selection checks, removed unused imports.
• Backend quality: validated inputs before use, removed unused error bindings, whitespace/import cleanups, extracted duplicated config.
• Local Docker: random host ports for api and ui, easier first run.
• API Docker: switched base image to slim so OpenCV installs via prebuilt wheels (no in-container compile).
• UI route layout: /api/* paths now resolve under the same origin, simplifying Caddy/nginx config.
• Navbar/menu: direct link to the API Docs page.

Fixes

• GET /api/health added for UI/SPA usage; existing GET / kept for direct container probes.
• API Docs page now calls /api/health (was hitting the SPA root, returning the HTML shell).
• ApiView XSS: shortener URLs and fake-data JSON are escaped before v-html; raw values kept for clipboard copy.
• JWT Encoder/Decoder:
  • Header/Payload/Signature now escaped before render (the JWT signature segment was a real XSS vector via v-html).
  • Encoder restricted to HS256 / HS384 / HS512 (matches the symmetric-only secret flow).
  • Removed auto-copy on decode/encode (was a surprise side effect).
  • Signature label (no longer claims verification) and accordion copy updated.
• TextareaView: forwards id (and other fallthrough attrs) to the actual <textarea> via inheritAttrs: false + v-bind="$attrs".

## Summary Small, scoped improvements for v0.0.4: new utilities, local Docker usability, frontend/backend code quality, and security fixes on the JWT tool and API docs page. ## What's new - **Password Generator** with configurable length and character sets. - **Color Wheel** picker with keyboard/ARIA support and proper pointer handling. - **RGB / Hex color converter** (`#RRGGBB` <-> `rgb(...)`). - **Regex Validator** with named group highlighting. ## Improvements - **Frontend quality**: deduped constants/helpers, fixed duplicate labels, simplified selection checks, removed unused imports. - **Backend quality**: validated inputs before use, removed unused error bindings, whitespace/import cleanups, extracted duplicated config. - **Local Docker**: random host ports for `api` and `ui`, easier first run. - **API Docker**: switched base image to slim so OpenCV installs via prebuilt wheels (no in-container compile). - **UI route layout**: `/api/*` paths now resolve under the same origin, simplifying Caddy/nginx config. - **Navbar/menu**: direct link to the API Docs page. ## Fixes - **`GET /api/health`** added for UI/SPA usage; existing `GET /` kept for direct container probes. - **API Docs page** now calls `/api/health` (was hitting the SPA root, returning the HTML shell). - **ApiView XSS**: shortener URLs and fake-data JSON are escaped before `v-html`; raw values kept for clipboard copy. - **JWT Encoder/Decoder**: - Header/Payload/Signature now escaped before render (the JWT signature segment was a real XSS vector via `v-html`). - Encoder restricted to `HS256 / HS384 / HS512` (matches the symmetric-only secret flow). - Removed auto-copy on decode/encode (was a surprise side effect). - `Signature` label (no longer claims verification) and accordion copy updated. - **`TextareaView`**: forwards `id` (and other fallthrough attrs) to the actual `<textarea>` via `inheritAttrs: false` + `v-bind="$attrs"`.

rdenadai added 4 commits 2026-08-14 22:13:01 +00:00

Improvements v0.0.4 3877bc5bba

feat: v0.0.4 improvements and new tools a8bb876c7a

fix: api base image, local compose ports, color wheel and frontend quality 820ffddd2c

fix: jwt encoder/decoder hardening, /api/health, and api view xss ... 13666792cd

- JWT: escape header/payload/signature for v-html; raw JSON via result-to-copy; restrict encoder to HS256/384/512; label 'Signature' (not 'Verify Signature'); remove auto-copy side effects; pass id to TextareaView.
- API: add GET /api/health for SPA/UI usage; keep GET / for direct container probes.
- UI: /api docs now calls /api/health; escape shortener URLs and fake-data JSON before v-html; raw via result-to-copy for clipboard.
- TextareaView: forward attrs to <textarea> via inheritAttrs: false + v-bind (so id reaches the element).
- Accordion copy: 'Encode and decode JWT headers, payloads, and signatures'.

rdenadai force-pushed rdenadai/improvements-v0.0.4 from 13666792cd to 72ca66c3d7 2026-08-14 22:18:53 +00:00 Compare

rdenadai merged commit 73bf4446bb into main 2026-08-14 22:19:29 +00:00

rdenadai referenced this pull request from a commit 2026-08-14 22:19:30 +00:00

Merge pull request 'Improvements v0.0.4' (#5) from rdenadai/improvements-v0.0.4 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rdenadai/microbox!5

No description provided.