Freezmo: self-hosted notes-to-activities study app

Next.js 15 app that turns photos, PDFs, DOCX/PPTX and text into a swipeable
feed of AI-generated activities (flashcards, multiple choice, true/false,
fill-in-the-blank, matching, ordering, short answer) using the user's own
Ollama models.

Highlights:
- All AI calls run in server route handlers; the browser never talks to Ollama.
- Bring-your-own-key mode (default): the key lives only in the browser and is
  sent per-request; server, local-daemon and shared-key modes also supported.
- Client-side document extraction (pdf.js, mammoth, jszip) with scanned-PDF
  page rendering for the vision model; notes stay in their original language.
- ChatGPT-style shell: collapsible sidebar / mobile drawer, neutral token-based
  light + dark themes, folder organisation, PWA (manifest, SW, offline page).
- Strict JSON validation with zod + auto-repair, rate limiting, and request
  guards (cross-origin, body-size, API-key sanitising).
- setup.sh bootstraps deps, .env.local and a production build.

Gitignore excludes .env*, the generated pdf.js worker and local scratch files.

app/api/grade/route.ts

@@ -0,0 +1,71 @@
+import { z } from "zod";
+
+import { gradeShortAnswer } from "@/lib/ai";
+import { AUTH_ERROR_MESSAGES, authErrorKind, getServerConfig, resolveAuth } from "@/lib/config";
+import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
+import { rejectCrossOrigin, rejectOversizedBody } from "@/lib/http-guard";
+import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const requestSchema = z.object({
+  question: z.string().min(1).max(1000),
+  referenceAnswer: z.string().min(1).max(2000),
+  keyPoints: z.array(z.string().max(300)).max(8).default([]),
+  userAnswer: z.string().min(1).max(2000),
+  /** Language of the deck so feedback comes back in the same language. */
+  language: z.string().max(60).optional(),
+});
+
+/** Generous but finite: ~16 compressed images plus JSON overhead. */
+const MAX_BODY_BYTES = 65536;
+
+export async function POST(request: Request) {
+  const crossOrigin = rejectCrossOrigin(request);
+  if (crossOrigin) return crossOrigin;
+  const oversized = rejectOversizedBody(request, MAX_BODY_BYTES);
+  if (oversized) return oversized;
+
+  const config = getServerConfig();
+
+  const limit = rateLimit(`grade:${clientKey(request)}`, config.rateLimits.grade, config.rateLimits.windowMs);
+  if (!limit.allowed) return rateLimitResponse(limit);
+
+  const auth = resolveAuth(config, request);
+  if ("error" in auth) {
+    return Response.json(
+      { error: AUTH_ERROR_MESSAGES[auth.error], kind: authErrorKind(auth.error) },
+      { status: 401 },
+    );
+  }
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return Response.json({ error: "Request body was not valid JSON." }, { status: 400 });
+  }
+
+  const parsed = requestSchema.safeParse(payload);
+  if (!parsed.success) {
+    return Response.json({ error: "Invalid grading request." }, { status: 400 });
+  }
+
+  try {
+    const result = await gradeShortAnswer({
+      model: config.textModel,
+      auth: auth.auth,
+      ...parsed.data,
+      // Grading is quick; don't let a hung request block the feed for minutes.
+      signal: AbortSignal.timeout(Math.min(config.timeoutMs, 120_000)),
+    });
+    return Response.json(result);
+  } catch (error) {
+    console.error("[api/grade]", error instanceof OllamaError ? `${error.kind}: ${error.message}` : error);
+    return Response.json(
+      { error: friendlyErrorMessage(error, auth.auth.baseUrl), kind: error instanceof OllamaError ? error.kind : "unknown" },
+      { status: 502 },
+    );
+  }
+}