Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
112 lines
4 KiB
TypeScript
112 lines
4 KiB
TypeScript
import { z } from "zod";
|
|
|
|
import { extractNotes, notesToText } from "@/lib/ai";
|
|
import { authErrorMessage, authErrorKind, getServerConfig, resolveAuth } from "@/lib/config";
|
|
import { friendlyErrorMessage, OllamaError } from "@/lib/ollama";
|
|
import { rejectCrossOrigin, rejectOversizedBody, requestLocale } from "@/lib/http-guard";
|
|
import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
|
|
import { acquireModelGate } from "@/lib/model-guard";
|
|
import { dataUrlSchema } from "@/lib/schemas";
|
|
import { translate } from "@/lib/i18n-dict";
|
|
|
|
export const runtime = "nodejs";
|
|
export const dynamic = "force-dynamic";
|
|
export const maxDuration = 300;
|
|
|
|
/** Same ceiling as deck generation: up to 16 resized photos. */
|
|
const MAX_BODY_BYTES = 33554432;
|
|
const MAX_IMAGE_CHARS = 8_000_000;
|
|
|
|
const requestSchema = z.object({
|
|
images: z.array(dataUrlSchema(MAX_IMAGE_CHARS)).max(16).optional(),
|
|
text: z.string().max(120_000).optional(),
|
|
});
|
|
|
|
/**
|
|
* Turns chat attachments (photos, scanned pages, pasted document text) into
|
|
* plain text with the existing vision pipeline, so any chat model — including
|
|
* text-only ones — can use them. Never stores anything.
|
|
*/
|
|
export async function POST(request: Request) {
|
|
const locale = requestLocale(request);
|
|
const crossOrigin = rejectCrossOrigin(request);
|
|
if (crossOrigin) return crossOrigin;
|
|
const oversized = rejectOversizedBody(request, MAX_BODY_BYTES);
|
|
if (oversized) return oversized;
|
|
|
|
const config = getServerConfig();
|
|
|
|
const limit = rateLimit(`chat:${clientKey(request)}`, config.rateLimits.chat, config.rateLimits.windowMs);
|
|
if (!limit.allowed) return rateLimitResponse(limit, locale);
|
|
|
|
const auth = resolveAuth(config, request);
|
|
if ("error" in auth) {
|
|
return Response.json(
|
|
{ error: authErrorMessage(locale, auth.error), kind: authErrorKind(auth.error) },
|
|
{ status: 401 },
|
|
);
|
|
}
|
|
|
|
let payload: unknown;
|
|
try {
|
|
payload = await request.json();
|
|
} catch {
|
|
return Response.json({ error: translate(locale, "server.bodyNotJson") }, { status: 400 });
|
|
}
|
|
|
|
const parsed = requestSchema.safeParse(payload);
|
|
if (!parsed.success) {
|
|
return Response.json(
|
|
{ error: translate(locale, "server.invalidRequest", { detail: parsed.error.issues[0]?.message ?? "" }) },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
const images = (parsed.data.images ?? []).map(stripDataUrlPrefix).filter(Boolean);
|
|
const text = parsed.data.text?.trim() ?? "";
|
|
if (images.length === 0 && !text) {
|
|
return Response.json({ error: translate(locale, "server.needContent") }, { status: 400 });
|
|
}
|
|
|
|
const gate = acquireModelGate(request, config, locale);
|
|
if ("response" in gate) return gate.response;
|
|
const abort = new AbortController();
|
|
const timer = setTimeout(() => abort.abort(), config.timeoutMs);
|
|
try {
|
|
if (images.length === 0) {
|
|
// Plain text needs no model call at all.
|
|
return Response.json({ text: text.slice(0, 48_000) });
|
|
}
|
|
const extraction = await extractNotes({
|
|
model: config.visionModel,
|
|
repairModel: config.textModel,
|
|
auth: auth.auth,
|
|
images,
|
|
text: text || undefined,
|
|
signal: abort.signal,
|
|
});
|
|
const extracted = notesToText(extraction.notes).slice(0, 48_000);
|
|
if (!extracted.trim()) {
|
|
return Response.json({ error: translate(locale, "chat.attachEmpty"), kind: "bad_response" }, { status: 422 });
|
|
}
|
|
return Response.json({ text: extracted });
|
|
} catch (error) {
|
|
console.error("[api/chat/extract]", error instanceof OllamaError ? `${error.kind}: ${error.message}` : error);
|
|
return Response.json(
|
|
{
|
|
error: friendlyErrorMessage(error, auth.auth.baseUrl, locale),
|
|
kind: error instanceof OllamaError ? error.kind : "unknown",
|
|
},
|
|
{ status: 502 },
|
|
);
|
|
} finally {
|
|
clearTimeout(timer);
|
|
gate.gate.release();
|
|
}
|
|
}
|
|
|
|
function stripDataUrlPrefix(value: string): string {
|
|
const commaIndex = value.indexOf(",");
|
|
if (value.startsWith("data:") && commaIndex !== -1) return value.slice(commaIndex + 1);
|
|
return value;
|
|
}
|