Martin Dvorak
3ea2cea100
Next.js 15 app that turns photos, PDFs, DOCX/PPTX and text into a swipeable feed of AI-generated activities (flashcards, multiple choice, true/false, fill-in-the-blank, matching, ordering, short answer) using the user's own Ollama models. Highlights: - All AI calls run in server route handlers; the browser never talks to Ollama. - Bring-your-own-key mode (default): the key lives only in the browser and is sent per-request; server, local-daemon and shared-key modes also supported. - Client-side document extraction (pdf.js, mammoth, jszip) with scanned-PDF page rendering for the vision model; notes stay in their original language. - ChatGPT-style shell: collapsible sidebar / mobile drawer, neutral token-based light + dark themes, folder organisation, PWA (manifest, SW, offline page). - Strict JSON validation with zod + auto-repair, rate limiting, and request guards (cross-origin, body-size, API-key sanitising). - setup.sh bootstraps deps, .env.local and a production build. Gitignore excludes .env*, the generated pdf.js worker and local scratch files.
79 lines
2.9 KiB
TypeScript
79 lines
2.9 KiB
TypeScript
/**
|
|
* Small server-side guards shared by the API routes.
|
|
*
|
|
* Freezmo is a self-hosted app with no accounts, so the realistic threats are
|
|
* (a) a hostile page in the user's browser poking the local server, (b) huge
|
|
* bodies exhausting memory, and (c) odd values ending up in outbound headers.
|
|
*/
|
|
|
|
function formatBytes(bytes: number): string {
|
|
if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
|
|
return `${(bytes / 1024 / 1024).toFixed(bytes < 10 * 1024 * 1024 ? 1 : 0)} MB`;
|
|
}
|
|
|
|
/** Rejects requests whose body is larger than `maxBytes` (Content-Length check). */
|
|
export function rejectOversizedBody(request: Request, maxBytes: number): Response | null {
|
|
const header = request.headers.get("content-length");
|
|
if (!header) return null;
|
|
const length = Number.parseInt(header, 10);
|
|
if (Number.isFinite(length) && length > maxBytes) {
|
|
return Response.json(
|
|
{
|
|
error: `Request body is too large (${formatBytes(length)}). Limit is ${formatBytes(maxBytes)}.`,
|
|
kind: "too_large",
|
|
},
|
|
{ status: 413 },
|
|
);
|
|
}
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Same-origin check for state-changing requests.
|
|
*
|
|
* There is no cookie-based auth here, so CSRF can't steal a session — but a
|
|
* malicious website could still make the user's browser fire requests at a
|
|
* LAN-hosted Freezmo (and burn their rate limit or, in `server` auth mode,
|
|
* their credits). Browsers always send `Origin` on cross-origin POSTs and
|
|
* cannot forge it, so a mismatch is a reliable signal. Requests without an
|
|
* `Origin` (curl, scripts, native apps) are allowed.
|
|
*/
|
|
export function rejectCrossOrigin(request: Request): Response | null {
|
|
const origin = request.headers.get("origin");
|
|
if (!origin) return null;
|
|
|
|
let originHost: string;
|
|
try {
|
|
originHost = new URL(origin).host;
|
|
} catch {
|
|
return Response.json({ error: "Invalid Origin header.", kind: "forbidden" }, { status: 403 });
|
|
}
|
|
|
|
const host = request.headers.get("host");
|
|
if (host && originHost === host) return null;
|
|
|
|
// Next dev/prod behind a proxy may rewrite Host; trust x-forwarded-host too.
|
|
const forwardedHost = request.headers.get("x-forwarded-host");
|
|
if (forwardedHost && originHost === forwardedHost) return null;
|
|
|
|
// Allow the loopback pair (localhost vs 127.0.0.1) for convenience.
|
|
const loopback = new Set(["localhost", "127.0.0.1", "[::1]", "0.0.0.0"]);
|
|
const bare = (value: string) => value.replace(/:\d+$/, "");
|
|
if (loopback.has(bare(originHost)) && loopback.has(bare(host ?? ""))) return null;
|
|
|
|
return Response.json(
|
|
{ error: "Cross-origin requests are not allowed.", kind: "forbidden" },
|
|
{ status: 403 },
|
|
);
|
|
}
|
|
|
|
/**
|
|
* API keys are pasted by humans, so clean them before they go into a header:
|
|
* trim, drop control characters/whitespace (header injection), cap the length.
|
|
*/
|
|
export function sanitiseApiKey(value: string | null | undefined): string {
|
|
if (!value) return "";
|
|
return value
|
|
.replace(/[\u0000-\u001F\u007F-\u009F\s]/g, "")
|
|
.slice(0, 512);
|
|
}
|