Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
134 lines
3.9 KiB
JavaScript
134 lines
3.9 KiB
JavaScript
/**
|
|
* Freezmo service worker (production only).
|
|
*
|
|
* Strategy, deliberately conservative:
|
|
* - API routes are never cached and never intercepted.
|
|
* - Navigations: network first, falling back to the cached shell, then /offline.
|
|
* - /_next/static + icons: stale-while-revalidate (fast, self-healing).
|
|
* - Everything else: straight to the network.
|
|
*
|
|
* Bumping CACHE_VERSION is how a new deploy invalidates old assets.
|
|
*/
|
|
const CACHE_VERSION = "freezmo-v51";
|
|
const SHELL_CACHE = `${CACHE_VERSION}-shell`;
|
|
const ASSET_CACHE = `${CACHE_VERSION}-assets`;
|
|
|
|
const SHELL_ASSETS = [
|
|
"/",
|
|
"/offline",
|
|
"/manifest.webmanifest",
|
|
"/icons/icon-192.png",
|
|
"/icons/icon-512.png",
|
|
"/icons/apple-touch-icon.png",
|
|
];
|
|
|
|
self.addEventListener("install", (event) => {
|
|
event.waitUntil(
|
|
(async () => {
|
|
const cache = await caches.open(SHELL_CACHE);
|
|
await Promise.allSettled(SHELL_ASSETS.map((url) => cache.add(new Request(url, { cache: "reload" }))));
|
|
await self.skipWaiting();
|
|
})(),
|
|
);
|
|
});
|
|
|
|
self.addEventListener("activate", (event) => {
|
|
event.waitUntil(
|
|
(async () => {
|
|
const names = await caches.keys();
|
|
await Promise.all(
|
|
names.filter((name) => !name.startsWith(CACHE_VERSION)).map((name) => caches.delete(name)),
|
|
);
|
|
await self.clients.claim();
|
|
})(),
|
|
);
|
|
});
|
|
|
|
function isCacheableAsset(url) {
|
|
return (
|
|
url.pathname.startsWith("/_next/static/") ||
|
|
url.pathname.startsWith("/icons/") ||
|
|
url.pathname === "/manifest.webmanifest" ||
|
|
/\.(?:css|js|png|jpg|jpeg|svg|webp|woff2?)$/.test(url.pathname)
|
|
);
|
|
}
|
|
|
|
/* ------------------------------------------------------------------ */
|
|
/* Push reminders (opt-in; only active when VAPID is configured) */
|
|
/* ------------------------------------------------------------------ */
|
|
|
|
self.addEventListener("push", (event) => {
|
|
let data = {};
|
|
try {
|
|
data = event.data ? event.data.json() : {};
|
|
} catch {
|
|
data = {};
|
|
}
|
|
event.waitUntil(
|
|
self.registration.showNotification(data.title || "Freezmo", {
|
|
body: data.body || "",
|
|
icon: "/icons/icon-192.png",
|
|
badge: "/icons/icon-192.png",
|
|
data: { url: data.url || "/" },
|
|
}),
|
|
);
|
|
});
|
|
|
|
self.addEventListener("notificationclick", (event) => {
|
|
event.notification.close();
|
|
const url = (event.notification.data && event.notification.data.url) || "/";
|
|
event.waitUntil(
|
|
self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((clients) => {
|
|
for (const client of clients) {
|
|
if ("focus" in client) {
|
|
client.navigate(url).catch(() => {});
|
|
return client.focus();
|
|
}
|
|
}
|
|
return self.clients.openWindow(url);
|
|
}),
|
|
);
|
|
});
|
|
|
|
self.addEventListener("fetch", (event) => {
|
|
const request = event.request;
|
|
if (request.method !== "GET") return;
|
|
|
|
const url = new URL(request.url);
|
|
if (url.origin !== self.location.origin) return;
|
|
// Never touch the API: keys, notes and generated decks must always be live.
|
|
if (url.pathname.startsWith("/api/")) return;
|
|
|
|
if (request.mode === "navigate") {
|
|
event.respondWith(
|
|
(async () => {
|
|
try {
|
|
const response = await fetch(request);
|
|
const cache = await caches.open(SHELL_CACHE);
|
|
cache.put("/", response.clone()).catch(() => {});
|
|
return response;
|
|
} catch {
|
|
const cache = await caches.open(SHELL_CACHE);
|
|
return (await cache.match("/")) ?? (await cache.match("/offline")) ?? Response.error();
|
|
}
|
|
})(),
|
|
);
|
|
return;
|
|
}
|
|
|
|
if (isCacheableAsset(url)) {
|
|
event.respondWith(
|
|
(async () => {
|
|
const cache = await caches.open(ASSET_CACHE);
|
|
const cached = await cache.match(request);
|
|
const network = fetch(request)
|
|
.then((response) => {
|
|
if (response.ok) cache.put(request, response.clone()).catch(() => {});
|
|
return response;
|
|
})
|
|
.catch(() => cached);
|
|
return cached ?? network;
|
|
})(),
|
|
);
|
|
}
|
|
});
|