Connor Yoh
06c51f52fc
- PaygWalletController.createPortalSession no longer holds a JPA connection during the
outbound RestTemplate.exchange. DB work (membership + payg_team_extensions) moves into
a small loadPortalContext helper; the HTTP call runs after the helper returns. JOIN
FETCH on findPrimaryMembership means no lazy access happens outside the implicit per-
repo tx, so a slow Supabase edge fn no longer pins HikariCP for 30s.
- Add payg.portal.allowed-return-hosts allowlist (CSV). Caller-supplied return_url is
parsed (URI) and its host is matched case-insensitively against the allowlist before
forwarding to the edge fn; scheme is restricted to http/https so javascript:/data:
URLs can't slip past. Empty allowlist rejects any caller-supplied return_url with
400 INVALID_RETURN_URL — operator must opt-in explicitly. Defense in depth: doesn't
rely on the edge fn to enforce its own allowlist.
- @RequestBody is now required = false so the FE may POST with no body and let the edge
fn fall back to its configured default. Drops the dead req != null guard.
- ManageBillingButton.tsx now POSTs /api/v1/payg/portal-session via apiClient instead of
calling supabase.functions.invoke('manage-billing') directly, so the new endpoint is
actually on the live path. Maps the controller error codes (TEAM_NOT_SUBSCRIBED,
INVALID_RETURN_URL, PORTAL_NOT_CONFIGURED, PORTAL_UNAVAILABLE) to user-facing copy.
- Tests: add INVALID_RETURN_URL coverage (off-allowlist + javascript: scheme), empty
allowlist with null returnUrl bypass, and null-body acceptance. All 16 PaygWalletController
tests pass; coverage targets met.
Stirling PDF - The Open-Source PDF Platform
Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
Key Capabilities
- Everywhere you work - Desktop client, browser UI, and self-hosted server with a private API.
- 50+ PDF tools - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
- Automation & workflows - No-code pipelines direct in UI with APIs to process millions of PDFs.
- Enterprise‑grade - SSO, auditing, and flexible on‑prem deployments.
- Developer platform - REST APIs available for nearly all tools to integrate into your existing systems.
- Global UI - Interface available in 40+ languages.
For a full feature list, see the docs: https://docs.stirlingpdf.com
Quick Start
docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
Then open: http://localhost:8080
For full installation options (including desktop and Kubernetes), see our Documentation Guide.
Resources
Support
- Community Discord
- Bug Reports: Github issues
Contributing
We welcome contributions! Please see CONTRIBUTING.md for guidelines.
This project uses Task as a unified command runner for all build, dev, and test commands. Run task install to get started, or see the Developer Guide for full details.
For adding translations, see the Translation Guide.
License
Stirling PDF is open-core. See LICENSE for details.