Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

app/api/homework/refine/route.ts

@@ -6,6 +6,7 @@ import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
 import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
 import { translate } from "@/lib/i18n-dict";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { acquireModelGate } from "@/lib/model-guard";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -64,6 +65,8 @@ export async function POST(request: Request) {
     );
   }
 
+  const gate = acquireModelGate(request, config, locale);
+  if ("response" in gate) return gate.response;
   try {
     const text = await refineHomeworkText({
       model: config.textModel,
@@ -86,5 +89,7 @@ export async function POST(request: Request) {
       },
       { status: 502 },
     );
+  } finally {
+    gate.gate.release();
   }
 }

app/api/homework/route.ts

@@ -5,8 +5,9 @@ import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth, resolveM
 import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
 import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { acquireModelGate } from "@/lib/model-guard";
 import { translate } from "@/lib/i18n-dict";
-import { homeworkModeSchema, type HomeworkStep } from "@/lib/schemas";
+import { dataUrlSchema, homeworkModeSchema, type HomeworkStep } from "@/lib/schemas";
 import { uid } from "@/lib/utils";
 
 export const runtime = "nodejs";
@@ -20,12 +21,12 @@ const MAX_BODY_BYTES = 33554432;
 
 const requestSchema = z.object({
   mode: homeworkModeSchema,
-  images: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
+  images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
   text: z.string().max(120_000).optional(),
   /** Mode "check": the student's own attempt at the assignment. */
   solution: z.string().max(120_000).optional(),
   /** Mode "check": photos of the attempt (handwritten work, scanned pages). */
-  solutionImages: z.array(z.string().min(32).max(MAX_IMAGE_CHARS)).max(16).optional(),
+  solutionImages: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
   /** Language of the assignment (usually detected by the vision step). */
   language: z.string().max(60).optional(),
 });
@@ -95,6 +96,11 @@ export async function POST(request: Request) {
     return Response.json({ error: translate(locale, "server.needSolution") }, { status: 400 });
   }
 
+  // Concurrency + the account-wide model budget (lib/model-guard), taken
+  // after every cheap rejection so a 400 can never leak a slot.
+  const gate = acquireModelGate(request, config, locale);
+  if ("response" in gate) return gate.response;
+
   const encode = encoder();
   const abort = new AbortController();
   // A single hard deadline for the whole pipeline (two sequential model calls).
@@ -257,6 +263,7 @@ export async function POST(request: Request) {
         });
       } finally {
         clearTimeout(globalTimer);
+        gate.gate.release();
         try {
           controller.close();
         } catch {
@@ -266,6 +273,7 @@ export async function POST(request: Request) {
     },
     cancel() {
       clearTimeout(globalTimer);
+      gate.gate.release();
       abort.abort();
     },
   });