Flea Flicker
c7007051d7
Two defense-in-depth fixes from the GRO-2162 feature-level security review: 1. Enforce the documented ?limit cap on POST /api/clients/geocode-batch. The handler now clamps limit to GEOCODE_BATCH_MAX_LIMIT (500) after the positive-integer check, bounding synchronous request duration and per-request external API cost when routeOptimizationProvider = "google". 2. Redact the encrypted googleMapsApiKey from GET /api/admin/settings on both the existing-row and auto-create branches. The ciphertext is never needed client-side and is now stripped via redactSettings(). Adds route-level tests for the limit clamp (default/passthrough/clamp/floor/ reject) and the settings redaction (both branches). Updates UAT_PLAYBOOK.md TC-API-2.13a and TC-API-13.1. Co-Authored-By: Paperclip <noreply@paperclip.ing>
GroomBook API
GroomBook API service — extracted from the groombook/app monorepo.
Overview
This repository contains the GroomBook API service, including:
- REST API endpoints
- Database schema and migrations (via Drizzle ORM)
- Authentication (via Better Auth)
- Background job handlers
Structure
src/ # API service source
packages/db/ # Database schema, migrations, and utilities
packages/types/ # Shared TypeScript types
Setup
pnpm install
cp .env.example .env # Fill in required environment variables
pnpm --filter @groombook/api dev
Docker
docker build -t ghcr.io/groombook/api:latest .
docker run -p 3000:3000 ghcr.io/groombook/api:latest
License
AGPL-3.0-only