@@ -411,6 +459,16 @@ function createApp({
const parseHtmlForm = express.urlencoded({ extended: false, limit: "256kb" });
const analysisLimiter = rateLimit({
+ handler: (req, res, _next, options) => {
+ const message = typeof options.message === "string"
+ ? options.message
+ : "Too many analysis requests. Please try again later.";
+ if (req.path.startsWith("/api/")) {
+ res.status(options.statusCode).json({ error: message });
+ return;
+ }
+ res.status(options.statusCode).type("text").send(message);
+ },
legacyHeaders: false,
limit: 30,
message: "Too many analysis requests. Please try again later.",
@@ -419,6 +477,17 @@ function createApp({
...rateLimitOptions,
});
+ const analyzeUrl = async (value) => {
+ if (!value) {
+ const error = new Error("A URL is required.");
+ error.statusCode = 400;
+ throw error;
+ }
+ const requestedUrl = normalizeTargetUrl(value);
+ const html = await pageFetcher(requestedUrl);
+ return analyzeDocument(html, requestedUrl, { imageInspector, mode: "url" });
+ };
+
app.get(
"/",
(req, res, next) =>
@@ -437,7 +506,7 @@ function createApp({
02
Preview every share
- See how your page can appear across search, Facebook, X, and LinkedIn.
+ See how your page can appear across search, Facebook, X, LinkedIn, Slack, and WhatsApp.
03
@@ -448,8 +517,7 @@ function createApp({
if (requestedUrl) {
try {
- const html = await pageFetcher(requestedUrl);
- const analysis = await analyzeDocument(html, requestedUrl, { imageInspector, mode: "url" });
+ const analysis = await analyzeUrl(requestedUrl);
content = renderAnalysis(analysis);
} catch (error) {
const isPublicError = Number.isInteger(error.statusCode);
@@ -462,6 +530,35 @@ function createApp({
},
);
+ app.get("/api/analyze", analysisLimiter, async (req, res) => {
+ try {
+ const requestedUrl = typeof req.query.url === "string" ? req.query.url : "";
+ const analysis = await analyzeUrl(requestedUrl);
+ res.json(serializeAnalysis(analysis));
+ } catch (error) {
+ const isPublicError = Number.isInteger(error.statusCode);
+ res.status(isPublicError ? error.statusCode : 502).json({
+ error: isPublicError ? error.message : "The target website could not be analyzed.",
+ });
+ }
+ });
+
+ app.get("/report.md", analysisLimiter, async (req, res) => {
+ try {
+ const requestedUrl = typeof req.query.url === "string" ? req.query.url : "";
+ const analysis = await analyzeUrl(requestedUrl);
+ res
+ .attachment("metascope-report.md")
+ .type("text/markdown")
+ .send(toMarkdownReport(analysis));
+ } catch (error) {
+ const isPublicError = Number.isInteger(error.statusCode);
+ res.status(isPublicError ? error.statusCode : 502).type("text").send(
+ isPublicError ? error.message : "The target website could not be analyzed.",
+ );
+ }
+ });
+
app.post("/analyze/html", analysisLimiter, parseHtmlForm, async (req, res) => {
const pastedHtml = typeof req.body.html === "string" ? req.body.html : "";
const suppliedBaseUrl = typeof req.body.baseUrl === "string" ? req.body.baseUrl.trim() : "";
diff --git a/test/app.test.js b/test/app.test.js
index fa4185a..860873b 100644
--- a/test/app.test.js
+++ b/test/app.test.js
@@ -57,6 +57,103 @@ test("renders a successful SEO and social metadata audit", async () => {
assert.match(response.text, /SEO Audit/);
});
+test("renders Slack and WhatsApp previews with URL sharing actions", async () => {
+ const app = createApp({
+ pageFetcher: async () => fixtureHtml,
+ imageInspector: successfulImageInspector,
+ });
+ const response = await request(app)
+ .get("/")
+ .query({ url: "https://example.com/source" })
+ .expect(200);
+
+ assert.match(response.text, />SlackWhatsApp {
+ const app = createApp({
+ pageFetcher: async () => fixtureHtml,
+ imageInspector: successfulImageInspector,
+ });
+ const response = await request(app)
+ .get("/api/analyze")
+ .query({ url: "https://example.com/source" })
+ .expect("Content-Type", /json/)
+ .expect(200);
+
+ assert.equal(response.body.schemaVersion, 1);
+ assert.equal(response.body.url, "https://example.com/source");
+ assert.equal(response.body.source.mode, "url");
+ assert.equal(response.body.metadata.title, "A useful fixture title for search results");
+ assert.equal(typeof response.body.score.value, "number");
+ assert.ok(response.body.checks.some((check) => check.id === "og-title"));
+ assert.equal(response.body.images.openGraph.width, 1200);
+});
+
+test("returns safe JSON API validation and upstream errors", async () => {
+ const app = createApp({
+ pageFetcher: async () => {
+ throw new Error("sensitive upstream detail");
+ },
+ });
+
+ const missing = await request(app).get("/api/analyze").expect(400);
+ assert.deepEqual(missing.body, { error: "A URL is required." });
+
+ const failed = await request(app)
+ .get("/api/analyze")
+ .query({ url: "https://example.com" })
+ .expect(502);
+ assert.deepEqual(failed.body, { error: "The target website could not be analyzed." });
+ assert.doesNotMatch(JSON.stringify(failed.body), /sensitive upstream detail/);
+});
+
+test("keeps API rate-limit errors in the JSON contract", async () => {
+ const app = createApp({
+ pageFetcher: async () => fixtureHtml,
+ imageInspector: successfulImageInspector,
+ rateLimitOptions: { limit: 1 },
+ });
+
+ await request(app)
+ .get("/api/analyze")
+ .query({ url: "https://example.com" })
+ .expect(200);
+ const limited = await request(app)
+ .get("/api/analyze")
+ .query({ url: "https://example.com" })
+ .expect("Content-Type", /json/)
+ .expect(429);
+
+ assert.deepEqual(limited.body, {
+ error: "Too many analysis requests. Please try again later.",
+ });
+});
+
+test("downloads a Markdown audit report for a public URL", async () => {
+ const app = createApp({
+ pageFetcher: async () => fixtureHtml,
+ imageInspector: successfulImageInspector,
+ });
+ const response = await request(app)
+ .get("/report.md")
+ .query({ url: "https://example.com/source" })
+ .expect("Content-Type", /text\/markdown/)
+ .expect(200);
+
+ assert.match(response.headers["content-disposition"], /attachment; filename="metascope-report\.md"/);
+ assert.match(response.text, /# MetaScope audit: https:\/\/example\.com\/source/);
+ assert.match(response.text, /Score: \*\*\d+\/100\*\*/);
+ assert.match(response.text, /\| Status \| Category \| Check \| Finding \|/);
+ assert.match(response.text, /Fixture Open Graph title/);
+});
+
test("explains the product and next step on the landing page", async () => {
const app = createApp();
const response = await request(app).get("/").expect(200);
@@ -279,6 +376,7 @@ test("serves the local editor script without unsafe DOM insertion", async () =>
assert.match(response.headers["content-type"], /javascript/);
assert.match(response.text, /textContent/);
+ assert.match(response.text, /data-copy-audit-link/);
assert.doesNotMatch(response.text, /\.innerHTML\s*=/);
});
diff --git a/test/report.test.js b/test/report.test.js
new file mode 100644
index 0000000..b2e78e5
--- /dev/null
+++ b/test/report.test.js
@@ -0,0 +1,64 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { serializeAnalysis, toMarkdownReport } = require("../lib/report");
+
+const analysis = {
+ source: {
+ mode: "url",
+ requestedUrl: "https://example.com/page",
+ finalUrl: "https://example.com/page",
+ },
+ score: { value: 82, errors: 1, warnings: 2, passed: 10, info: 1 },
+ metadata: {
+ title: "Example | title",
+ description: "A useful description",
+ canonical: { raw: "/page", url: "https://example.com/page" },
+ openGraph: {
+ title: "Open Graph title",
+ description: "Open Graph description",
+ image: { raw: "/social.png", url: "https://example.com/social.png" },
+ url: { raw: "/page", url: "https://example.com/page" },
+ },
+ twitter: { card: "summary_large_image" },
+ },
+ checks: [
+ {
+ id: "title",
+ category: "seo",
+ status: "warning",
+ message: "Title contains a | delimiter\nand a new line.",
+ evidence: "Example | title",
+ weight: 3,
+ },
+ ],
+ images: { openGraph: null, twitter: null },
+};
+
+test("serializes only the stable public analysis contract", () => {
+ const result = serializeAnalysis({ ...analysis, privateState: "do not expose" });
+
+ assert.equal(result.schemaVersion, 1);
+ assert.equal(result.url, "https://example.com/page");
+ assert.equal(result.metadata.title, "Example | title");
+ assert.equal(result.privateState, undefined);
+ assert.deepEqual(Object.keys(result), [
+ "schemaVersion",
+ "url",
+ "source",
+ "score",
+ "metadata",
+ "checks",
+ "images",
+ ]);
+});
+
+test("creates a deterministic Markdown report without broken table rows", () => {
+ const report = toMarkdownReport(analysis);
+
+ assert.match(report, /^# MetaScope audit: https:\/\/example\.com\/page/m);
+ assert.match(report, /Score: \*\*82\/100\*\*/);
+ assert.match(report, /Example \\| title/);
+ assert.match(report, /Title contains a \\| delimiter and a new line\./);
+ assert.match(report, /## Detected metadata/);
+ assert.ok(report.endsWith("\n"));
+});
+