lotobo/barcode-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Barcode Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 11:08:20 +02:00
parent 81677e1134
commit d94e03b81a
29 changed files with 1266 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/docs/ARCHITECTURE.md
+5 -3
View File
@@ -1,7 +1,9 @@
# Architecture
Barcode Tools is a static React/Vite application wrapped in the shared Toolbox shell. `barcode/generate.ts` validates options, delegates encoding to the browser build of `bwip-js`, rejects active or linked constructs in the generated SVG string, and previews it through a revocable blob URL. It also parses the bounded two-column batch format and creates deterministic SVG ZIPs with `fflate`.
Barcode Tools is a static React/Vite application wrapped in the shared Toolbox shell. `barcode/generate.ts` validates options, delegates encoding to the browser build of `bwip-js`, rejects active or linked constructs in the generated SVG string, and previews it through a revocable blob URL. It also parses the bounded two-column batch format, creates deterministic SVG ZIPs, computes physical/raster planning dimensions from the generated aspect ratio, and adds millimetre dimensions to a print SVG without rasterizing it. Quiet-zone module values are guidance only because bwip-js padding is measured in points.
`barcode/payloads.ts` escapes structured QR fields and validates GTIN check digits. The decode workspace lazy-loads ZXing only after a file or camera action. Image files are passed through a revocable object URL; camera acquisition is explicit and its controls are stopped on request or unmount. Decoded values are rendered as text and never navigated.
`barcode/payloads.ts` escapes structured QR fields and validates GTIN check digits. `barcode/gs1.ts` recognizes a bounded table of common GS1 AIs, consumes fixed-width fields, requires GS separators for non-final variable fields, validates lengths/data classes/dates/check digits, and stops at an unknown raw AI rather than guessing its boundary.
Version 0.1 does not create an application worker or persist input. The camera requires a secure context but not a top-level browsing context. Relative entry and asset URLs keep the build relocatable below a nested portal path.
The decode workspace lazy-loads ZXing only after a file or camera action. Pressing **Start camera** is the sole path to `getUserMedia`. When the browser exposes `BarcodeDetector`, it processes at most one frame per animation frame; otherwise the local ZXing constraint decoder is used. Image files are passed through a revocable object URL; camera streams/animation/ZXing controls are stopped on request, failure or unmount. Decoded values are rendered as text and never navigated.
The application does not persist input. The camera requires a secure context and may be constrained by the embedding portal's Permissions Policy. Relative entry and asset URLs keep the build relocatable below a nested portal path.
public/docs/PRIVACY-SECURITY.md
+2 -2
View File
@@ -1,7 +1,7 @@
# Privacy and security
Payloads, images and camera frames are processed in the browser. There is no telemetry, analytics, account, persistence or server upload. Camera access happens only after pressing **Start camera**, is governed by browser permission, requests video without audio, and can be stopped from the workspace.
Payloads, images and camera frames are processed in the browser. There is no telemetry, analytics, account, persistence or server upload. Camera access happens only after pressing **Start camera**, is governed by browser permission/Permissions Policy, requests video without audio, and can be stopped from the workspace. The stream and scan loop are stopped on cancellation, failure and unmount.
Images are limited to 20 MiB, generated payloads to 4,096 characters, and batch input to 256 KiB/100 rows. Structured QR fields are escaped and Wi-Fi security is restricted to WPA, WEP or nopass. Generated SVG is rejected if it contains scripts, foreign objects, event handlers or linked content; previews use local blob URLs.
Decoded payloads are untrusted text and are never opened automatically. A valid check digit does not prove GS1 allocation, and the quiet-zone text is guidance rather than print-quality validation. Interoperability and physical print quality must be checked with the intended scanner and applicable specification.
Decoded payloads are untrusted text and are never opened automatically. A recognized AI or valid check digit does not prove GS1 allocation, ownership or complete carrier conformance. Unknown raw AIs stop parsing to avoid inventing field boundaries. Physical dimensions and raster pixels are planning values: generated padding is expressed in points, not modules, so quiet zones/X-dimension and physical print quality must be measured and tested with the intended scanner and applicable specification.