1649 Commits

Include renames

Author	SHA1	Message	Date
Shruc	06b66719fe	fix gemini image provider implementation (#2569) ... * implement proper calls to gemini image * remove hardcoded image prices * fix model selection * add flash 3.1 image, fix pricing * also handle uris with data prefix * more efficient uri parsing * fix token calculation * re-add some costs for models page	2026-03-08 23:25:11 -07:00
jelveh	62df3df6a9	Add nl2br Handlebars helper and use in template ... Convert newline characters in email reason text to <br /> tags and ensure proper escaping. Replaced {{reason}} with {{{nl2br reason}}} in the rejection template and registered an nl2br Handlebars helper that escapes HTML entities, transforms newlines to <br /> and returns a SafeString so line breaks render correctly in emails.	2026-03-08 15:51:54 -07:00
ProgrammerIn-wonderland	004777824d	use openrouter provided USD cost when present (#2619)	2026-03-08 12:12:24 -07:00
Eric Dubé	0fa0340ca2	clean(apps): merge fns only called by get_app_icon_url (#2617) ... Each of these methods is only being called by get_app_icon_url. By changing that ternary operator into an `if` block with an early return we can move the bodies of these functions here. If one of the former functions ever needs to be used in more than one place, it's easy to extract it out of here agian - for now though let's not pay the cost of jumping to another function definition while trying to understand this code if we're not gaining anything from it.	2026-03-06 20:07:14 -05:00
ProgrammerIn-wonderland	a0fc1bca30	add gpt 5.3 codex and gpt 5.4 (#2618) ... * add gpt 5.3 codex and gpt 5.4 * add gemini 3.1 pro preview	2026-03-06 16:59:39 -08:00
Eric Dubé	f167da9a0a	clean: remove a log (#2610)	2026-03-04 22:02:36 -05:00
Daniel Salazar	4aab06611e	feat: redirect away cookie (#2609)	2026-03-04 17:54:58 -08:00
Daniel Salazar	237973f227	fix: fetching user from session token (#2607) ... old bug was causing issues trying to use sessions as auth checks for tighter security for private apps. missed it without more detailed logs	2026-03-04 17:29:52 -08:00
Daniel Salazar	3f0b0bfd1d	feat: more robust error logs (#2605)	2026-03-04 16:47:01 -08:00
Daniel Salazar	d28cc46e02	fix: add logs to debug on prod (#2604)	2026-03-04 16:20:52 -08:00
Eric Dubé	0864b9ece1	dev(apps): add configuration to not use app icon subdomain (#2603) ... * dev(apps): add configuration to not use app icon subdomain For some local configurations of Puter, such as using ngrok or a hosting service that has limited subdomains or limited subdomain depth, the static hosting subdomain for app icons is difficult to configure and may not be viable. Since this is only done so an external geo-replicated cache can be used, and it's always possible for Puter's backend to generate an app icon, it should be possible to configure Puter's backend to use icons from a URL hosted on the default subdomain. Add a configuration parameter to the service "app-icon" called "no_subdomain" which prevents Puter's backend from sending puter-icons subdomain URLs or redirecting to them. Also perform some small cleanup changes to make the existing code easier to understand, including: - rename `buildAppIconUrl` to `buildAppIconSubdomainUrl` to make it clear which of the two types of icon URLs are being generated. - replace `withAppIconUrl` with `get_app_icon_url` so it is possible to get an icon URL without mutating an app object. - make the `get_taskbar_items` helper use the same code for getting app icons as the `get_apps` helper. * fix(apps): test initializes a service with no config	2026-03-04 19:10:32 -05:00
Daniel Salazar	9721943040	fix: prioritize new token thant anything outdated stored in localstorage (#2600)	2026-03-04 14:49:05 -08:00
KernelDeimos	fc29e57730	fix(oidc): request object reference in oidc signup ... The request object was not being passed to OIDC signup because it is called by createUserFromOIDC which doesn't take a request object as a parameter. It was decided to have `create_user` take the request object from context if it's not specified rather than change the signature of createUserFromOIDC.	2026-03-04 14:33:36 -05:00
Daniel Salazar	1720c97851	fix: origin canonization (#2597)	2026-03-04 11:09:25 -08:00
Daniel Salazar	8a14871dde	fix: bad token generation for private apps (#2596)	2026-03-04 10:09:16 -08:00
Daniel Salazar	6b6f9b4743	fix: puter site middleware host (#2594)	2026-03-03 22:18:47 -08:00
Daniel Salazar	8380b28d8a	fix: reset subdomain if empty (#2593)	2026-03-03 21:07:55 -08:00
Daniel Salazar	adf034b120	feat: add subdomain to private asset tokens (#2591)	2026-03-03 20:37:17 -08:00
Daniel Salazar	dbdead9ad1	fix: remove redis cache scan in favour of direct key invalidation (#2589)	2026-03-03 19:55:41 -08:00
Daniel Salazar	911c163fc8	feat: private app config to use app urls + app routing (#2587) ... * feat: private app config to use app urls * fix: launch app * fix: cookie origin	2026-03-03 18:34:33 -08:00
Daniel Salazar	1f975b9d19	fix: private app config to use app urls (#2586)	2026-03-03 15:49:33 -08:00
Daniel Salazar	4f5fec5ee4	feat: resolve private app hosts by index_url fallback (#2583) ... * feat: resolve private app hosts by index_url fallback Adds a private-app lookup fallback for hosted subdomains without associated_app_id by matching owner-scoped index_url candidates built from request host and configured protocol. * fix: redirect path * fix: add new domains too * fix, bootstrap url * fix: bootstrap url * fix: auto sign in puter pirvate app	2026-03-03 13:52:12 -08:00
KernelDeimos	930cbfb770	fix(ai): additional auth guard (corrected 676b6c3)	2026-03-02 19:55:07 -05:00
KernelDeimos	91b9aa014a	Reapply "fix(auth): add explicit check for access token suspension (#2576)" (#2579) ... This reverts commit 8349b0d692.	2026-03-02 19:45:11 -05:00
KernelDeimos	9fd1d0a2e2	Revert "fix(ai): additional auth guard (#2577)" ... This reverts commit 676b6c31e1.	2026-03-02 19:37:18 -05:00
Eric Dubé	8349b0d692	Revert "fix(auth): add explicit check for access token suspension (#2576)" (#2579) ... This reverts commit f6b9c69ce6.	2026-03-02 19:24:15 -05:00
Eric Dubé	676b6c31e1	fix(ai): additional auth guard (#2577)	2026-03-02 18:45:33 -05:00
Eric Dubé	f6b9c69ce6	fix(auth): add explicit check for access token suspension (#2576)	2026-03-02 17:10:42 -05:00
Daniel Salazar	314c671778	fix: redis startup (#2571) ... add event logging and handling to deal with redis startup	2026-02-28 13:25:42 -08:00
Daniel Salazar	bb02fc6e6b	fix: hardcode default perm (#2570)	2026-02-28 13:13:05 -08:00
Daniel Salazar	537f3957ed	feat: add private app direct-login bootstrap page (#2566) ... * feat: add private app direct-login bootstrap page Serves a lightweight puter.js sign-in interstitial when private app identity is missing, then retries with a bootstrap token query param while preserving entitlement redirect behavior for authenticated denies. * fix: allow private app subdomain	2026-02-28 13:04:14 -08:00
Daniel Salazar	2eb16ceab6	chore: switch private hosting domain to puter.dev (#2565) ... Updates private app hosting defaults and middleware/test expectations from puter.app to puter.dev for current rollout needs.	2026-02-27 16:24:54 -08:00
Eric Dubé	2cc8cb22f8	[OIDC] allow user deletion for accounts without a password (#2567) ... * fix: user deletion for OIDC accounts * clean(backend): update copied license header * clean(backend): replace previously removed comments * fix: double-encoding	2026-02-27 18:55:12 -05:00
Eric Dubé	9d4e990b92	dev(oidc): switch login/signup flows where applicable (#2550) ... For convenience, switch flow if the user's action doesn't match the system state when signing up or logging in with Google: - If the user chooses "signup" but they already have an account, log them into that account. - If the user chooses "login" but they do not have an account yet, create an account where their authenticated email address.	2026-02-27 18:30:17 -05:00
Daniel Salazar	7e07c3d937	feat: add private access rollout gate and auditing (#2560) ... Adds a config flag to disable private app gate enforcement, structured middleware audit logs for private access decisions, and regression coverage for the disabled-gate path.	2026-02-27 13:55:15 -08:00
Eric Dubé	866825767b	fix(backend): default rate-limit scope instead of error (#2564) ... When a rate-limit scope is not configured, use a default configuration instead of throwing an error. Display a warning about the unconfigured rate-limit scope when the default is used.	2026-02-27 15:58:36 -05:00
Anshuman Tripathi	7c437fabf3	fix: corrected service reference (#2559)	2026-02-27 13:45:01 -05:00
Reynaldi Chernando	613b0482e8	Add nano banana 2 (#2562)	2026-02-27 13:00:36 -05:00
Daniel Salazar	784847b1b1	feat: enforce private app hosting access gate (#2557) ... Add private app access gating in PuterSiteMiddleware with entitlement event checks, bootstrap/private cookie token flow, and camelCase helper/test updates.	2026-02-26 23:42:32 -08:00
Daniel Salazar	23089901dd	perf:remove recents cache (#2558)	2026-02-26 16:38:58 -08:00
Daniel Salazar	15e7a3503b	feat: add private app asset token auth helpers (#2555) ... * feat: add private app asset token auth helpers Add mint/verify helpers and hardened cookie option helpers for app-private-asset tokens in AuthService. Add focused tests for claims validation, mismatch denial, and cookie option defaults. * fix: add prvate app config for new subdomain	2026-02-26 14:19:59 -08:00
Daniel Salazar	f8560cf0f9	fix: delete redis keys in parallel, don't grant both read and write if just write needed (#2552)	2026-02-26 14:03:21 -08:00
Daniel Salazar	1887352301	fix: don't await cache invalidation for grant app permission (#2551) ... * fix: disable broadcast for cache invalidation * fix: remove broadcast for redis events for now * fix: don't await cache invalidation for grant app permission	2026-02-25 17:26:42 -08:00
Daniel Salazar	2c1b21e197	feat: type extension cache update events (#2548) ... * feat: type extension cache update events Expose outer.cacheUpdate in extension API typings and consolidate extension service typing via ServicesMap. * fix: batch broadcast events * fix: bad import * fix: import socket io * fix: bad undefined call * fix: simplify await for broadcast processing	2026-02-25 17:05:05 -08:00
Daniel Salazar	aa04dfabb4	feat: add is_private to apps (#2546)	2026-02-25 13:26:16 -08:00
Daniel Salazar	7a1468d070	fix: app icons via subdomain on localhost (#2544)	2026-02-25 10:14:39 -08:00
Daniel Salazar	66f1cd0bc3	fix: remove broadcast for cache updates (#2542) ... * fix: disable broadcast for cache invalidation * fix: remove broadcast for redis events for now	2026-02-24 16:45:32 -08:00
Eric Dubé	6658a90b6a	fix(backend): invalidate app permission debounce (#2541) ... * fix(backend): debounce app permission invalidation * fix(backend): debounce app permission invalidation	2026-02-24 19:00:34 -05:00
Daniel Salazar	4c863cc5bc	fix: make invalidations more robust (#2529)	2026-02-24 15:45:46 -08:00
Daniel Salazar	6544e8c250	cleanup,:remove debugger calls in our code (#2535)	2026-02-24 15:42:39 -08:00