Arnaud
3042d289a0
Full list of the audit's confirmed findings and their fixes: - Stored XSS via unescaped JSON-LD on the public recipe page (app/r/[id]/page.tsx) — escape < before injecting. - CSP allowed unsafe-eval in production — now dev-only (Next prod never eval()s; only its HMR does). - avatarUrl accepted any URL with no ownership check — now takes an avatarKey issued by avatar-presign, validated server-side, same pattern as recipe/review photos. - No session revocation on password change/reset — both now revoke other sessions (revokeOtherSessions: true, revokeSessionsOnPasswordReset). - Rate-limit bypass via spoofable X-Forwarded-For — take the last (proxy-appended) hop instead of the first (client-supplied) one, matching the single-Traefik-hop topology. - Webhook signing secrets stored plaintext — now AES-256-GCM encrypted like every other secret in this app, with a legacy- plaintext fallback for pre-existing rows (bare hex has no ":", our ciphertext format always does). - Better Auth's own rate limiter defaulted to in-memory storage, ineffective across replicas — now backed by the same Redis as lib/rate-limit.ts (secondaryStorage), with storeSessionInDatabase explicit so session storage itself doesn't move as a side effect. - Presigned upload URLs didn't bind the declared file size to the actual upload, letting a client under-declare size (and quota charge) then PUT an arbitrarily large object — switched to S3 presigned POST with a signed content-length-range condition, enforced by the storage server itself. - generateMetadata() on the recipe page skipped the visibility filter the page body uses, leaking a private recipe's title via <title> to any signed-in user with the id. - Block/unblock had no rate limit, unlike follow/unfollow. - AI quota was charged even when a user's own BYOK key was used (their own credentials/billing) — added an isByok flag through the config-resolution chain and skip the charge when set. Also wired BYOK into generate/generate-from-idea/translate/import-url, which never looked it up at all before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
1.8 KiB
TypeScript
54 lines
1.8 KiB
TypeScript
import { createOpenAI } from "@ai-sdk/openai";
|
|
import { createAnthropic } from "@ai-sdk/anthropic";
|
|
import type { LanguageModel } from "ai";
|
|
|
|
export type AiProvider = "openai" | "anthropic" | "openrouter" | "ollama";
|
|
|
|
export type AiConfig = {
|
|
provider?: AiProvider;
|
|
model?: string;
|
|
apiKey?: string;
|
|
/** True when apiKey is the caller's own BYOK key — their own credentials
|
|
* and billing, so platform AI-call quota shouldn't be charged for it. */
|
|
isByok?: boolean;
|
|
};
|
|
|
|
export function resolveModel(config: AiConfig = {}): LanguageModel {
|
|
const provider = config.provider ?? getDefaultProvider();
|
|
|
|
switch (provider) {
|
|
case "openai": {
|
|
const openai = createOpenAI({ apiKey: config.apiKey ?? process.env["OPENAI_API_KEY"] });
|
|
return openai(config.model ?? "gpt-4o-mini");
|
|
}
|
|
case "anthropic": {
|
|
const anthropic = createAnthropic({ apiKey: config.apiKey ?? process.env["ANTHROPIC_API_KEY"] });
|
|
return anthropic(config.model ?? "claude-haiku-4-5-20251001");
|
|
}
|
|
case "openrouter": {
|
|
const openrouter = createOpenAI({
|
|
apiKey: config.apiKey ?? process.env["OPENROUTER_API_KEY"],
|
|
baseURL: "https://openrouter.ai/api/v1",
|
|
});
|
|
return openrouter(config.model ?? process.env["OPENROUTER_DEFAULT_MODEL"] ?? "google/gemini-flash-1.5");
|
|
}
|
|
case "ollama": {
|
|
const ollama = createOpenAI({
|
|
apiKey: "ollama",
|
|
baseURL: process.env["OLLAMA_BASE_URL"] ?? "http://localhost:11434/v1",
|
|
});
|
|
return ollama(config.model ?? "llama3.2");
|
|
}
|
|
default: {
|
|
throw new Error(`Unknown AI provider: ${String(provider)}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
function getDefaultProvider(): AiProvider {
|
|
if (process.env["OPENROUTER_API_KEY"]) return "openrouter";
|
|
if (process.env["OPENAI_API_KEY"]) return "openai";
|
|
if (process.env["ANTHROPIC_API_KEY"]) return "anthropic";
|
|
return "ollama";
|
|
}
|