Martin Dvorak
8822baf4b7
Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
60 lines
2 KiB
TypeScript
60 lines
2 KiB
TypeScript
import type { ServerConfig } from "./config";
|
|
import { translate, type Locale } from "./i18n-dict";
|
|
import { acquireSlot, clientKey, rateLimit, rateLimitResponse, releaseSlot } from "./rate-limit";
|
|
|
|
/**
|
|
* One gate in front of every route that spends an Ollama call:
|
|
*
|
|
* - a **global budget** per window (all clients together) so no flood can
|
|
* burn through the account — the thing that gets a key throttled or banned;
|
|
* - a **per-IP concurrency cap** and a **global one**, so a burst of parallel
|
|
* requests can't pile up model calls (or sockets and memory).
|
|
*
|
|
* The slot is released once, when the response is finished — including a
|
|
* client that disconnects mid-stream, and including routes that throw.
|
|
*/
|
|
export type ModelGate = { release: () => void };
|
|
|
|
export function acquireModelGate(
|
|
request: Request,
|
|
config: ServerConfig,
|
|
locale: Locale,
|
|
): { gate: ModelGate } | { response: Response } {
|
|
const perIpKey = `model-ip:${clientKey(request)}`;
|
|
const totalKey = "model-total";
|
|
|
|
if (!acquireSlot(totalKey, config.rateLimits.concurrentTotal)) {
|
|
return { response: busyResponse(locale) };
|
|
}
|
|
if (!acquireSlot(perIpKey, config.rateLimits.concurrent)) {
|
|
releaseSlot(totalKey);
|
|
return { response: busyResponse(locale) };
|
|
}
|
|
|
|
const budget = rateLimit("model-budget", config.rateLimits.modelTotal, config.rateLimits.windowMs);
|
|
if (!budget.allowed) {
|
|
releaseSlot(perIpKey);
|
|
releaseSlot(totalKey);
|
|
return { response: rateLimitResponse(budget, locale) };
|
|
}
|
|
|
|
let released = false;
|
|
return {
|
|
gate: {
|
|
release: () => {
|
|
if (released) return;
|
|
released = true;
|
|
releaseSlot(perIpKey);
|
|
releaseSlot(totalKey);
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
/** 429 for "something is already running" — not a rate-limit punishment. */
|
|
function busyResponse(locale: Locale): Response {
|
|
return Response.json(
|
|
{ error: translate(locale, "server.busy"), kind: "busy", retryAfter: 5 },
|
|
{ status: 429, headers: { "Retry-After": "5", "Cache-Control": "no-store" } },
|
|
);
|
|
}
|