SPLITa — Feature
PDF Split Operation
7deb7b0
src/processing/split.rs — SplitSpec tagged enum (all/ranges), PageRange validationPOST /v1/split — multipart/form-data, returns base64 parts- Events:
split.completed, split.failed
- 50MB max PDF size enforced at processing + multipart
+ 28 tests
SPLITb — Feature
PDF Merge Operation
eb8fc09
src/processing/merge.rs — deep-copy merge using lopdfPOST /v1/merge — multiple files, returns merged PDF- Events:
merge.completed, merge.failed
- Limits: 50MB/file, 20 files max, 200MB total
+ 17 tests
SPLITc — Feature
PDF Rotate Operation
75cc37f
src/processing/rotate.rs — page rotation with additive anglesPOST /v1/rotate — file + spec JSON, returns rotated PDF- Events:
rotate.completed, rotate.failed
- Angles: 90/180/270 with mod 360 wraparound
+ 25 tests
SEC-FIX — Security
JWT Hardening
3ffb20f
- JWT
iss/aud claim validation enforced
- HS256 production guard (requires explicit opt-in)
body_html 512KB / schema 64KB size limits- CORS hardened: no origins allowed by default
+ 9 tests
SEC-FIX-2: Security Review Findings (8 items fixed)
Commit: 7d59f13 ·
+5 tests
- SEC-01 A03 — DB error messages sanitized. Conflict/Internal return generic messages; full details logged server-side via
tracing::warn! / tracing::error!.
- SEC-02 A05 — RLS INSERT policies now enforce
tenant_id = current_setting('app.tenant_id') via migration 006.
- SEC-03 A10 — Auth failures logged at WARN with peer address, request path, and failure reason.
- SEC-04 A05 — RBAC enforcement deferred. ADR-001 written (waiting on OID role definitions).
- SEC-05 Dead dependencies removed:
reqwest, validator.
- SEC-06
Mutex::lock().unwrap() replaced with .expect() with context messages.
- SEC-07
X-Correlation-Id header propagated from request to CloudEvents via with_correlation_id().
- SEC-08 64KB size limit enforced on
spec multipart field in split/rotate handlers.
Quality Gates
✓
cargo test
179 passed, 0 failed
Files Changed (since SPLITa)