- server/src/routes/checkout.js: remove unused createBillingPortalSession
from the destructuring import. The portal logic lives in
routes/billing.js; checkout.js never called it.
- src/background/events.js: remove a stale commented-out
browser.runtime.openOptionsPage() line.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The fast-xml-parser >=5.3.8 override (added for CVE) is incompatible
with @aws-sdk/client-ses, whose XML response parser registers entities
named "#xD" and "#10" — names that 5.x rejects with
[EntityReplacer] Invalid character '#' in entity name.
SESv2 uses REST/JSON, sidestepping the parser entirely. validateEmail
already used SESv2; this consolidates the three send functions onto
the same client and drops @aws-sdk/client-ses.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Prevents foreign Stripe events (from other apps sharing this Stripe
account) from being processed. Webhook ignores events whose products
are not in the allowlist; server refuses to boot without it set.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add SES email validation with 2s timeout and fail-open behavior to
send-magic-link. Add per-IP rate limiting with decrement on verify.
Fix SES response parsing path (MailboxValidation.IsValid.ConfidenceVerdict).
Add dedicated unit tests for validateEmail.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace file-per-record auth requests, file-per-hash rate limits, and
JSON blob subscription cache with a single SQLite database via
better-sqlite3. Consolidate duplicated email/IP rate limit code into
shared helpers. Add missing IP rate limit pruning to cleanup interval.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The checkout.session.completed webhook only sent a welcome email but
did not update the subscription cache, so users kept getting cached
free status after paying.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add RYS Premium subscription system
Introduce optional paid tier with sign-in, Stripe billing, and premium
feature gating. Core features remain free. Includes Node.js server for
auth, payments, and license management.
Extension changes:
- Sign-in flow with magic link email
- Premium/upgrade/account modals with branded UI
- Premium feature gating (60+ advanced settings)
- Password lock and scheduling (premium)
- Fix "hide all but first row" for YouTube's new flat homepage DOM
- Hide sidebar ad panels by default
- Enable "Hide all Shorts" by default
Server:
- Magic link auth with rate limiting
- Stripe checkout, webhooks, and billing portal
- JWT-based license tokens
- AWS SES transactional emails (welcome, sign-in, cancellation)
- Grandfathered donor support
Also adds CI workflow, server test suite, and extension unit tests.
dependabot[bot]
Lawrence Hook
Lawrence Hook
EC2 Default User