Freezmo: self-hosted notes-to-activities study app

Next.js 15 app that turns photos, PDFs, DOCX/PPTX and text into a swipeable
feed of AI-generated activities (flashcards, multiple choice, true/false,
fill-in-the-blank, matching, ordering, short answer) using the user's own
Ollama models.

Highlights:
- All AI calls run in server route handlers; the browser never talks to Ollama.
- Bring-your-own-key mode (default): the key lives only in the browser and is
  sent per-request; server, local-daemon and shared-key modes also supported.
- Client-side document extraction (pdf.js, mammoth, jszip) with scanned-PDF
  page rendering for the vision model; notes stay in their original language.
- ChatGPT-style shell: collapsible sidebar / mobile drawer, neutral token-based
  light + dark themes, folder organisation, PWA (manifest, SW, offline page).
- Strict JSON validation with zod + auto-repair, rate limiting, and request
  guards (cross-origin, body-size, API-key sanitising).
- setup.sh bootstraps deps, .env.local and a production build.

Gitignore excludes .env*, the generated pdf.js worker and local scratch files.

lib/http-guard.ts

@@ -0,0 +1,79 @@
+/**
+ * Small server-side guards shared by the API routes.
+ *
+ * Freezmo is a self-hosted app with no accounts, so the realistic threats are
+ * (a) a hostile page in the user's browser poking the local server, (b) huge
+ * bodies exhausting memory, and (c) odd values ending up in outbound headers.
+ */
+
+function formatBytes(bytes: number): string {
+  if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(bytes < 10 * 1024 * 1024 ? 1 : 0)} MB`;
+}
+
+/** Rejects requests whose body is larger than `maxBytes` (Content-Length check). */
+export function rejectOversizedBody(request: Request, maxBytes: number): Response | null {
+  const header = request.headers.get("content-length");
+  if (!header) return null;
+  const length = Number.parseInt(header, 10);
+  if (Number.isFinite(length) && length > maxBytes) {
+    return Response.json(
+      {
+        error: `Request body is too large (${formatBytes(length)}). Limit is ${formatBytes(maxBytes)}.`,
+        kind: "too_large",
+      },
+      { status: 413 },
+    );
+  }
+  return null;
+}
+
+/**
+ * Same-origin check for state-changing requests.
+ *
+ * There is no cookie-based auth here, so CSRF can't steal a session — but a
+ * malicious website could still make the user's browser fire requests at a
+ * LAN-hosted Freezmo (and burn their rate limit or, in `server` auth mode,
+ * their credits). Browsers always send `Origin` on cross-origin POSTs and
+ * cannot forge it, so a mismatch is a reliable signal. Requests without an
+ * `Origin` (curl, scripts, native apps) are allowed.
+ */
+export function rejectCrossOrigin(request: Request): Response | null {
+  const origin = request.headers.get("origin");
+  if (!origin) return null;
+
+  let originHost: string;
+  try {
+    originHost = new URL(origin).host;
+  } catch {
+    return Response.json({ error: "Invalid Origin header.", kind: "forbidden" }, { status: 403 });
+  }
+
+  const host = request.headers.get("host");
+  if (host && originHost === host) return null;
+
+  // Next dev/prod behind a proxy may rewrite Host; trust x-forwarded-host too.
+  const forwardedHost = request.headers.get("x-forwarded-host");
+  if (forwardedHost && originHost === forwardedHost) return null;
+
+  // Allow the loopback pair (localhost vs 127.0.0.1) for convenience.
+  const loopback = new Set(["localhost", "127.0.0.1", "[::1]", "0.0.0.0"]);
+  const bare = (value: string) => value.replace(/:\d+$/, "");
+  if (loopback.has(bare(originHost)) && loopback.has(bare(host ?? ""))) return null;
+
+  return Response.json(
+    { error: "Cross-origin requests are not allowed.", kind: "forbidden" },
+    { status: 403 },
+  );
+}
+
+/**
+ * API keys are pasted by humans, so clean them before they go into a header:
+ * trim, drop control characters/whitespace (header injection), cap the length.
+ */
+export function sanitiseApiKey(value: string | null | undefined): string {
+  if (!value) return "";
+  return value
+    .replace(/[\u0000-\u001F\u007F-\u009F\s]/g, "")
+    .slice(0, 512);
+}