Daniel Salazar
20b3b88e39
metering: big fixes to metering + jsdoc types ( #3547 )
...
Changes are:
- global egress metering
- remove file egress cost
- introduce file op cost for the per request cost s3 has
- enforce fs read/download etc to through 402 when out of usage; allow for subdomains
- enforce kv metering when out of usage through 402; allow for workers
- jsdoc as source of truth for puter.js types
- kv driver caching for get and batchget operations with decreased costs
2026-08-12 01:06:04 -07:00
Daniel Salazar
79d4201f12
fix: rate limits, AI routing, and a type-check gate ( #3529 )
...
- declare rate + concurrency limits on every route and driver that lacked one
- add acquireConcurrent for websocket connections and the DAV mount
- bucket AI models by identity key only; keep resold duplicates of any vendor
- skip recently-failed provider routes; cap the fallback chain at 3 attempts
- let full-access access tokens bind a worker to an app their own user owns
- cache resolved subscriptions so tiered limits don't add a round trip
2026-08-10 19:09:47 -07:00
Juan Fernando Castro and Daniel Salazar
d202be10a9
feat: let apps use another app's data with user consent ( #3516 )
...
* feat(perms): add cross-app app-data permission vocabulary
* feat(perms): sweep app grants by permission prefix
* feat(perms): resolve and withdraw cross-app data grants
* feat(kv): support an authorized namespace override and per-key privacy
* feat(kv): gate cross-app KV access behind app-data grants
* feat(fs): allow cross-app AppData access and require a scope to delete
* feat(auth): accept permission lists and gate app-data grants
* feat(perms): add requestAppData to the puter.js SDK
* feat(gui): carry permission lists through the IPC and popup transports
* feat(gui): describe cross-app data requests in the consent dialog
* docs: document requestAppData and per-entry KV privacy
* perf(perms): sweep cross-app grants only for origin-bootstrapped apps
* fix(gui): stop double-encoding cross-app consent text
* fix(perms): close three gaps in cross-app grant enforcement
* fix(kv): meter and batch the per-entry privacy probe
* fix(perms): resolve app identifiers and scopes more strictly in the SDK
* test(perms): cover the cross-app consent flow end to end
* fix: small missing token resolution for app
also adds the same exclusion for the batchPut api, small change
* fix: make resolved actor optional
---------
Co-authored-by: Daniel Salazar <daniel.salazar@puter.com >
2026-08-08 04:04:07 -07:00
Daniel Salazar
116d6e6663
tests: big test push for better coverage ( #3490 )
2026-08-01 14:29:59 -07:00
Neal Shah
2c139929ac
Check if user is suspended on WebDAV basic auth and others ( #3369 )
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
Notify HeyPuter / notify (push) Has been cancelled
release-please / release-please (push) Has been cancelled
2026-07-13 02:46:28 -04:00
Daniel Salazar
b706693f82
wip: hardening ( #3266 )
2026-06-15 16:07:44 -07:00
Daniel Salazar
b188942436
feat (PUT-1016 & PUT-1020) ( #3164 )
...
* feat (PUT-1016 & PUT-1020)
temp account preservation on forced relogin
hosted asset cookies to v2 token too
* fix: remove llm dashes and ugly comments
* update agents
2026-05-26 23:35:16 -07:00
Daniel Salazar
0ff0ea7743
fix: fs event emissions ( #3153 )
2026-05-25 14:25:27 -07:00
Daniel Salazar
b04e8b046a
fix: fixing misc issues around alerting and bugs ( #3141 )
...
- decrease ai related alerts and make errors not 500
- decreased bad fs controller checks to be 404s instead of 500s
- force bucket regions for now
- validate webdav perms for locking/unlocking
2026-05-21 14:26:47 -07:00
ProgrammerIn-wonderland
5bcb425926
Add tests for Peer, WebDAV, Workers, and WISP. ( #3070 )
Maintain Release Merge PR / update-release-pr (push) Has been cancelled
Notify HeyPuter / notify (push) Has been cancelled
release-please / release-please (push) Has been cancelled
2026-05-10 21:44:30 -04:00
Daniel Salazar
9bcd77c85b
chore: add legacy codes back to all errors ( #3022 )
2026-05-08 13:51:55 -07:00
Nariman Jelveh
267f464232
Add AGPL license headers to source files ( #2877 )
2026-05-01 13:50:42 -07:00
d4d78ac7db
rework: change backend and backend extensions to use simpler code structure and patterns ( #2815 )
...
* fix: dynamodb health checks and client recreation (#2789 )
* wip: no nanoServices groundwork
* feat: data clients in new shape
* wip: auth and perms in new system
* more wip
* middlewaters mainly done
* wip: fsv2 in new layout
* old fs v2 migration
* driver system
* driver and old fs fixes
* ai drivers wip
* stream support
* metering in ai chat driver
* wip: new auth
* rate limit and auth routes
* captcha and anti csrf
* fix: types
* auth store
* app logic
* wip most other dricvers
* fs
* mostly kill all legacy stuff
* fs finish
* fix: redis usage
* ai controller
* driver cleanup
* socket io in v2
* broadcast and crudq stuff
* subdomains
* notifcations and shares
* fix bad syntaxes
* auth wip
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* extensions
* extension setup
* more routes
* sql migrations and default services
* home router
* tier 7
* everything else
* everything else
* remaining missing bits
* server health
* logs
* cleanup
* deps
* cleanup 2
* more cleanup 2
* boot
* fix launch
* config fix
* move file
* fix: tsconfig things
* fix: extension loading
* launching
* fix: drivers
* fix: others
* fix: icons
* fix: file uploads
* fs fixes
* fix: fs api
* fix: dev-center
* config
* add back telemetry
* lint stuff
* husky hooks
* fix: fs oss
* fix: config migration
* config migration
* migrate scripts + replicate
* runner
* fix: merge defafult config
* fix: default region
* fix: api domain
* fix paths in readfile
* fix fs entry default s3
* NS: Remove Referral && Entri Service
* dep cleanups
* fix: static assets
* fix: kv and perms
* fix: driver registrations
* fix: home mapping
* fix: rao
* adding back 500 alarm
* fix: build paths
* fix: fs and kv shapes
* fix: kv shape
* more kv coercing and ai chat matching format as prior
* fix: private app gates
* private app caches
* fix: whole bunch of legacy shape issues
* update template jsonc
* fix caching partial oidc and fs signed paths
* more oidc fixes
* fix: wip
* fix: private apps
* admin route fixes
* fix: last few things hopefully
* claude uploads
* fix security for app only routes
* fix kv system namespace
* stuff
* fix: app and kv and suggested apps
* fix:open item
* fix: FS operations
* fix: default app icons
* add back token-read and WSL support
* metering fixes
* fix: fsEntry
* perm scanners and implicators
* proper download endpoint
* fix: download
* fix anti csrft on v2
* fix file extensions, app icons
* fold in v1 fixes from origin/main into v2 equivalents
Re-applies the v1 fixes that landed on origin/main into their v2
counterparts since the v1 files were deleted on DS/wip during the v2
migration. v1 commits referenced below.
- SQLBatcher: flush immediately when queue hits maxBatchSize instead
of racing the timer (v1 12f48238).
- RedisClient: drop maxRetriesPerRequest from 2 to 1 to shrink failure
window (v1 b6776ab436bd6073f14f1bf46b3196ednoreply@anthropic.com >
* remoe anti-csrf from auth routes that had not used them
* more icon fixes
* fix worker functionality
* fix: app and subdomain es
Co-authored-by: Copilot <copilot@github.com >
* fix PUT-761
* fix: PUT-748
* fix: rename fsService
* Add security back to WorkerDriver
* Migrate worker from fsEntry to fs. Fix cache issue
* remove ability to create symlinks
* strict webdav acl
* require auth for wisp
* chore: service renames
* Add metering back to puter peer api
* fix: PUT-760 PUT-749
* fix: PUT-746
* fix: peer cost
Co-authored-by: Copilot <copilot@github.com >
* fix: 771
* change order of peer controller
* fix: create appdata folder for app on get auth token
* fix: align delete site and list sites
* delete: putility
* fix subdomains
* Add support for tilde in subdomains, fix subdomain update
* cleanup PeerController.ts and fix billing oversight (#2844 )
* fix: PUT-786
* fix: bugs
* fix: issues with multiple subdomain queries, or permission checks
* fix: harden response shapes to not contain uneeded fields
* fix: move state to redis
* fix: missing kv methods + better sec
Co-authored-by: Copilot <copilot@github.com >
* fix: subdomainStore limit
* fix: missing path resolution
Co-authored-by: Copilot <copilot@github.com >
* fs fixes
* fix: undef error
* fix fs + cleanup
* fix: npm audit fixes
* heal path entries where missing
Co-authored-by: Copilot <copilot@github.com >
* fix: caching
Co-authored-by: Copilot <copilot@github.com >
* fix: cache inconsistencies
Co-authored-by: Copilot <copilot@github.com >
* fix: app driver metadata
Co-authored-by: Copilot <copilot@github.com >
* remove extraneous comma
* fix: associated app icons
* fix: bad tool call
* Add validation to WorkerDriver#getFilePaths
* misc fs and auth issues
Co-authored-by: Copilot <copilot@github.com >
* fix: oidc errors
Co-authored-by: Copilot <copilot@github.com >
* fix: PUT-797
* fix: legacy appdata_app
Co-authored-by: Copilot <copilot@github.com >
* fix: add alert logs
Co-authored-by: Copilot <copilot@github.com >
* fix: error handling
* Disable sharecontroller
* fix: remove private user identifier for ai
* fix: private app fixes
* Add backback signup_server
* fix: completionId size
Co-authored-by: Copilot <copilot@github.com >
* fix: revalidate path for oidc
* fix: revalidate path for oidc
* fix: email validation
Co-authored-by: Copilot <copilot@github.com >
* fix: user create query
* fix: middleware extensions
Co-authored-by: Copilot <copilot@github.com >
* use x-forwarded-for for req ip forwarded
* fix: missing last_activity ts
* feat: add cache broadcast to subdomains
* fix: update config typing
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
Co-authored-by: ProgrammerIn-wonderland <3838shah@gmail.com >
Co-authored-by: Copilot <copilot@github.com >
Co-authored-by: Nariman Jelveh <nj@puter.com >
Co-authored-by: velzie <velzie@velzie.rip >
2026-04-30 12:13:43 -07:00
Daniel Salazar