Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

app/api/chat/extract/route.ts

@@ -5,6 +5,8 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth } from "@
 import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
 import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { acquireModelGate } from "@/lib/model-guard";
+import { dataUrlSchema } from "@/lib/schemas";
 import { translate } from "@/lib/i18n-dict";
 
 export const runtime = "nodejs";
@@ -16,7 +18,7 @@ const MAX_BODY_BYTES = 33554432;
 const MAX_IMAGE_CHARS = 8_000_000;
 
 const requestSchema = z.object({
-  images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
+  images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
   text: z.string().max(120_000).optional(),
 });
 
@@ -66,6 +68,8 @@ export async function POST(request: Request) {
     return Response.json({ error: translate(locale, "server.needContent") }, { status: 400 });
   }
 
+  const gate = acquireModelGate(request, config, locale);
+  if ("response" in gate) return gate.response;
   const abort = new AbortController();
   const timer = setTimeout(() => abort.abort(), config.timeoutMs);
   try {
@@ -97,6 +101,7 @@ export async function POST(request: Request) {
     );
   } finally {
     clearTimeout(timer);
+    gate.gate.release();
   }
 }
 

app/api/chat/route.ts

@@ -4,6 +4,7 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
 import { friendlyErrorMessage, ollamaChatStream, OllamaError } from "@/lib/ollama";
 import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { acquireModelGate } from "@/lib/model-guard";
 import { translate } from "@/lib/i18n-dict";
 import { buildChatSystemPrompt } from "@/lib/prompts";
 import { estimateTokens, trimHistory } from "@/lib/chat-trim";
@@ -131,6 +132,11 @@ export async function POST(request: Request) {
     })),
   });
 
+  // Concurrency + the account-wide model budget (lib/model-guard), taken
+  // after every cheap rejection so a 400 can never leak a slot.
+  const gate = acquireModelGate(request, config, locale);
+  if ("response" in gate) return gate.response;
+
   const encode = encoder();
   const abort = new AbortController();
   const globalTimer = setTimeout(() => abort.abort(), config.timeoutMs);
@@ -170,6 +176,7 @@ export async function POST(request: Request) {
         }
       } finally {
         clearTimeout(globalTimer);
+        gate.gate.release();
         try {
           controller.close();
         } catch {
@@ -179,6 +186,7 @@ export async function POST(request: Request) {
     },
     cancel() {
       clearTimeout(globalTimer);
+      gate.gate.release();
       abort.abort();
     },
   });