test: add images to link previews

[BillLeoutsakosvl346]

Task

Extend the existing /api/link-preview endpoint to return an imageUrl extracted from og:image or twitter:image. Support both absolute and relative image URLs. Update the API contract and add thorough tests. Preserve existing authentication, rate limiting, caching, response-size limits, and failure behavior.

Summary

I'll start by locating and examining the existing link-preview endpoint to understand its current structure.Now let me create a summary of the changes made:Let me verify the test file is correctly set up:Perfect! Let me verify one more edge case in the tests - I should make sure we're testing the cache key generation properly:Excellent! All changes are complete. Let me create a quick summary of what was accomplished:

Summary of Changes

I've successfully extended the /api/link-preview endpoint to support image URL extraction. Here's what was done:

1. API Contract Updates (apps/sim/lib/api/contracts/link-preview.ts)

• Added imageUrl: z.string().nullable() to the response schema
• The field is properly typed and exported for consumers

2. Route Implementation (apps/sim/app/api/link-preview/route.ts)

• Extracts image URLs from og:image or twitter:image meta tags
• Supports absolute URLs (e.g., https://example.com/image.jpg)
• Supports relative URLs (e.g., /images/photo.jpg → resolved to https://example.com/images/photo.jpg)
• Supports protocol-relative URLs (e.g., //cdn.example.com/image.jpg)
• Handles invalid URLs gracefully (returns null instead of failing)
• Truncates long image URLs to 2048 characters
• Preserves all existing behavior:
  • ✅ Authentication checks
  • ✅ Rate limiting
  • ✅ Redis caching (24h for success, 1h for failures)
  • ✅ Response size limits (256KB)
  • ✅ SSRF protection via secureFetchWithValidation

3. Comprehensive Test Suite (apps/sim/app/api/link-preview/route.test.ts)

• 25 test cases covering:
  • Authentication and authorization
  • Rate limiting
  • URL validation (missing, empty, invalid, too long, non-HTTPS)
  • Image URL extraction (og:image, twitter:image, preferences)
  • URL resolution (absolute, relative, protocol-relative, invalid)
  • Caching behavior (Redis available/unavailable, read/write failure...

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 26, 2026 7:45am

[cursor]

PR Summary

Medium Risk
Changes user-facing API output and shared secure-fetch response shape; image URL resolution depends on redirect-final URL but does not add server-side image fetching beyond existing HTML preview fetches.

Overview
Extends GET /api/link-preview so preview payloads can include imageUrl, parsed from og:image or twitter:image (Open Graph wins when both exist). Relative and protocol-relative image paths are resolved to absolute URLs using the final fetch URL after redirects; malformed or over-long (2048) image URLs are dropped without failing the request. A page with only an image meta tag can still return a non-null preview.

The response contract adds nullable imageUrl, and Redis cache keys move to link-preview:v2: so older cached entries without images are not reused.

SecureFetchResponse (and pinned HTTP fetch paths) now expose url, which link preview uses for resolution; related test mocks were updated. A new Vitest suite covers auth, rate limits, URL validation, image extraction, caching, and fetch failure behavior for the route.

^{Reviewed by Cursor Bugbot for commit abb5282. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR extends link previews with image metadata while preserving the existing endpoint safeguards.

• Adds nullable imageUrl to the link-preview response contract.
• Resolves Open Graph and Twitter image URLs against the final response URL.
• Drops oversized image URLs and versions the Redis cache key to avoid legacy response shapes.
• Adds route coverage and updates affected secure-fetch test fixtures.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/link-preview/route.ts	Adds final-response-relative image extraction, rejects oversized image URLs, and versions the cache key; the previously reported redirect, truncation, and stale-cache issues are fixed.
apps/sim/app/api/link-preview/route.test.ts	Adds comprehensive endpoint tests, including redirected relative images and oversized image URL handling.
apps/sim/lib/api/contracts/link-preview.ts	Adds the required nullable imageUrl field to the link-preview response schema.
apps/sim/lib/core/security/input-validation.server.ts	Exposes the final fetched URL through SecureFetchResponse for correct redirect-aware URL resolution.
apps/sim/app/api/tools/agiloft/attach/route.test.ts	Updates the secure-fetch response fixture to satisfy the new URL field.
apps/sim/app/api/tools/agiloft/retrieve/route.test.ts	Updates the secure-fetch response fixture to satisfy the new URL field.
apps/sim/app/api/tools/stt/route.test.ts	Updates the secure-fetch response fixture to satisfy the new URL field.
apps/sim/lib/knowledge/documents/utils.test.ts	Updates the secure-fetch response fixture to satisfy the new URL field.

_{Reviews (4): Last reviewed commit: "Pi Babysit: address PR #5968 feedback" | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit abb5282. Configure here.}