fix(security): Phase 1 P0 hardening from cross-project audit

Close open uploads, image-proxy SSRF, fail-open AI quotas in production,
auth gaps on app routes, and MCP tenant isolation issues.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/app/actions/semantic-search.ts

@@ -2,7 +2,7 @@
 
 import { semanticSearchService, SearchResult } from '@/lib/ai/services/semantic-search.service'
 import { auth } from '@/auth'
-import { reserveUsageOrThrow, QuotaExceededError } from '@/lib/entitlements'
+import { reserveUsageOrThrow, QuotaExceededError, QuotaServiceUnavailableError } from '@/lib/entitlements'
 
 export interface SemanticSearchResponse {
   results: SearchResult[]
@@ -28,6 +28,11 @@ export async function semanticSearch(
       await reserveUsageOrThrow(session.user.id, 'semantic_search');
     } catch (err) {
       if (err instanceof QuotaExceededError) throw err;
+      if (err instanceof QuotaServiceUnavailableError || process.env.NODE_ENV === 'production') {
+        throw err instanceof QuotaServiceUnavailableError
+          ? err
+          : new QuotaServiceUnavailableError();
+      }
       console.error('[semantic-search] Quota check error (fail-open):', err);
     }
   }

memento-note/app/api/ai/suggest-charts/route.ts

@@ -4,7 +4,7 @@ import { willUseByokForLane } from '@/lib/ai/provider-for-user'
 import { getSystemConfig } from '@/lib/config'
 import { prisma } from '@/lib/prisma'
 import { auth } from '@/auth'
-import { reserveUsageOrThrow, QuotaExceededError } from '@/lib/entitlements'
+import { reserveUsageOrThrow, QuotaExceededError, QuotaServiceUnavailableError } from '@/lib/entitlements'
 import { hasUserAiConsent } from '@/lib/consent/server-consent'
 
 export const maxDuration = 30
@@ -63,6 +63,9 @@ export async function POST(req: Request) {
     if (err instanceof QuotaExceededError) {
       return Response.json(err.toJSON(), { status: 402 })
     }
+    if (err instanceof QuotaServiceUnavailableError || process.env.NODE_ENV === 'production') {
+      return Response.json({ error: 'QUOTA_SERVICE_UNAVAILABLE' }, { status: 503 })
+    }
     console.error('[suggest-charts] Quota check error (fail-open):', err)
   }
 

memento-note/app/api/ai/tags/route.ts

@@ -4,7 +4,7 @@ import { contextualAutoTagService } from '@/lib/ai/services/contextual-auto-tag.
 import { runLaneWithBillingUser, willUseByokForLane } from '@/lib/ai/provider-for-user';
 import { getSystemConfig } from '@/lib/config';
 import { z } from 'zod';
-import { checkEntitlementOrThrow, QuotaExceededError } from '@/lib/entitlements';
+import { checkEntitlementOrThrow, QuotaExceededError, QuotaServiceUnavailableError } from '@/lib/entitlements';
 import { hasUserAiConsent } from '@/lib/consent/server-consent';
 
 import { getAISettings } from '@/app/actions/ai-settings';
@@ -42,6 +42,12 @@ export async function POST(req: NextRequest) {
       if (err instanceof QuotaExceededError) {
         return NextResponse.json(err.toJSON(), { status: 402 });
       }
+      if (err instanceof QuotaServiceUnavailableError || process.env.NODE_ENV === 'production') {
+        return NextResponse.json(
+          { error: 'QUOTA_SERVICE_UNAVAILABLE' },
+          { status: 503 },
+        );
+      }
       console.error('[/api/ai/tags] Quota check error (fail-open):', err);
     }
     const body = await req.json();

memento-note/app/api/ai/title-suggestions/route.ts

@@ -3,7 +3,7 @@ import { runLaneWithBillingUser, willUseByokForLane } from '@/lib/ai/provider-fo
 import { getSystemConfig } from '@/lib/config'
 import { auth } from '@/auth'
 import { getAISettings } from '@/app/actions/ai-settings'
-import { reserveUsageOrThrow, QuotaExceededError } from '@/lib/entitlements'
+import { reserveUsageOrThrow, QuotaExceededError, QuotaServiceUnavailableError } from '@/lib/entitlements'
 import { z } from 'zod'
 import { hasUserAiConsent } from '@/lib/consent/server-consent'
 
@@ -68,6 +68,9 @@ export async function POST(req: NextRequest) {
         if (err instanceof QuotaExceededError) {
           return NextResponse.json(err.toJSON(), { status: 402 })
         }
+        if (err instanceof QuotaServiceUnavailableError || process.env.NODE_ENV === 'production') {
+          return NextResponse.json({ error: 'QUOTA_SERVICE_UNAVAILABLE' }, { status: 503 })
+        }
         console.error('[/api/ai/title-suggestions] Quota check error (fail-open):', err)
       }
     }

memento-note/app/api/chat/route.ts

@@ -9,7 +9,7 @@ import { auth } from '@/auth'
 import { hasUserAiConsent } from '@/lib/consent/server-consent'
 import { loadTranslations, getTranslationValue, SupportedLanguage } from '@/lib/i18n'
 import { toolRegistry } from '@/lib/ai/tools'
-import { reserveUsageOrThrow, QuotaExceededError } from '@/lib/entitlements'
+import { reserveUsageOrThrow, QuotaExceededError, QuotaServiceUnavailableError } from '@/lib/entitlements'
 import { ByokUnavailableError } from '@/lib/byok'
 import { trackFeatureUsage } from '@/lib/usage-tracker'
 import { readFile } from 'fs/promises'
@@ -78,7 +78,15 @@ export async function POST(req: Request) {
         { status: 503 }
       )
     }
-    console.error('[chat] Quota check error (fail-open):', err)
+    if (err instanceof QuotaServiceUnavailableError) {
+      return Response.json({ error: err.code }, { status: 503 })
+    }
+    if (process.env.NODE_ENV !== 'production') {
+      console.error('[chat] Quota check error (fail-open):', err)
+    } else {
+      console.error('[chat] Quota check error:', err)
+      return Response.json({ error: 'QUOTA_SERVICE_UNAVAILABLE' }, { status: 503 })
+    }
   }
 
   // 2. Parse request body

memento-note/app/api/image-proxy/route.ts

@@ -1,6 +1,13 @@
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@/auth'
+import { isBlockedFetchHost } from '@/lib/ssrf-guard'
 
 export async function GET(req: NextRequest) {
+  const session = await auth()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
   const url = req.nextUrl.searchParams.get('url')
   if (!url) return NextResponse.json({ error: 'Missing url' }, { status: 400 })
 
@@ -9,6 +16,9 @@ export async function GET(req: NextRequest) {
     if (!['http:', 'https:'].includes(parsed.protocol)) {
       return NextResponse.json({ error: 'Invalid protocol' }, { status: 400 })
     }
+    if (isBlockedFetchHost(parsed.hostname)) {
+      return NextResponse.json({ error: 'Host not allowed' }, { status: 403 })
+    }
 
     const controller = new AbortController()
     const timeout = setTimeout(() => controller.abort(), 5000)

memento-note/app/api/uploads/[...path]/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server'
 import { readFile, stat } from 'fs/promises'
 import path from 'path'
 import { auth } from '@/auth'
+import { canAccessUploadedNoteImage } from '@/lib/upload-access'
 
 const UPLOAD_DIR = path.join(process.cwd(), 'data', 'uploads')
 
@@ -17,6 +18,7 @@ export async function GET(
   _req: NextRequest,
   { params }: { params: Promise<{ path: string[] }> }
 ) {
+  const session = await auth()
   const { path: segments } = await params
 
   // Only serve from uploads/notes/ subdirectory
@@ -25,6 +27,13 @@ export async function GET(
   }
 
   const filename = segments[segments.length - 1]
+  const allowed = await canAccessUploadedNoteImage(filename, session?.user?.id)
+  if (!allowed) {
+    return new NextResponse(session?.user?.id ? 'Forbidden' : 'Unauthorized', {
+      status: session?.user?.id ? 403 : 401,
+    })
+  }
+
   const ext = path.extname(filename).toLowerCase()
   const contentType = MIME_MAP[ext]
   if (!contentType) {

memento-note/auth.config.ts

@@ -27,7 +27,11 @@ export const authConfig = {
                              nextUrl.pathname.startsWith('/canvas') ||
                              nextUrl.pathname.startsWith('/notebooks') ||
                              nextUrl.pathname.startsWith('/note/') ||
-                             nextUrl.pathname.startsWith('/brainstorm');
+                             nextUrl.pathname.startsWith('/brainstorm') ||
+                             nextUrl.pathname.startsWith('/insights') ||
+                             nextUrl.pathname.startsWith('/graph') ||
+                             nextUrl.pathname.startsWith('/revision') ||
+                             nextUrl.pathname.startsWith('/support');
       const isAdminPage = nextUrl.pathname.startsWith('/admin');
       const isPublicPage = nextUrl.pathname === '/' ||
                           nextUrl.pathname === '/login' ||

memento-note/lib/entitlements.ts

@@ -20,12 +20,20 @@ export interface EntitlementResult {
   remaining: number;
   limit: number;
   tier: SubscriptionTier;
-  reason?: 'QUOTA_EXCEEDED' | 'TIER_LIMITED' | 'FEATURE_NOT_AVAILABLE';
+  reason?: 'QUOTA_EXCEEDED' | 'TIER_LIMITED' | 'FEATURE_NOT_AVAILABLE' | 'SERVICE_UNAVAILABLE';
   message?: string;
   upgradeTier?: 'PRO' | 'BUSINESS';
   byokConfigured?: boolean;
 }
 
+export class QuotaServiceUnavailableError extends Error {
+  code = 'QUOTA_SERVICE_UNAVAILABLE';
+
+  constructor(message = 'Quota service temporarily unavailable') {
+    super(message);
+  }
+}
+
 export class QuotaExceededError extends Error {
   code = 'QUOTA_EXCEEDED';
   upgradeTier: 'PRO' | 'BUSINESS';
@@ -77,6 +85,10 @@ export class QuotaExceededError extends Error {
 
 const TTL_SECONDS = 90 * 24 * 60 * 60;
 
+function shouldFailClosedOnRedisError(): boolean {
+  return process.env.NODE_ENV === 'production';
+}
+
 const INCREMENT_BY_LUA = `
 local count = tonumber(ARGV[1]) or 1
 local ttl = tonumber(ARGV[2])
@@ -194,7 +206,17 @@ export async function canUseFeature(
       byokConfigured: await hasAnyActiveByok(userId),
     };
   } catch (err) {
-    console.error('[entitlements] Redis unavailable, allowing request (fail-open):', err);
+    console.error('[entitlements] Redis unavailable:', err);
+    if (shouldFailClosedOnRedisError()) {
+      return {
+        allowed: false,
+        remaining: 0,
+        limit,
+        tier,
+        reason: 'SERVICE_UNAVAILABLE',
+        message: 'Quota service temporarily unavailable. Please try again later.',
+      };
+    }
     return { allowed: true, remaining: limit, limit, tier };
   }
 }
@@ -264,7 +286,10 @@ export async function reserveUsageOrThrow(
     }
   } catch (err) {
     if (err instanceof QuotaExceededError) throw err;
-    console.error('[entitlements] Redis unavailable, allowing request (fail-open):', err);
+    console.error('[entitlements] Redis unavailable:', err);
+    if (shouldFailClosedOnRedisError()) {
+      throw new QuotaServiceUnavailableError();
+    }
   }
 }
 

memento-note/lib/ssrf-guard.ts

@@ -0,0 +1,22 @@
+/** Block hosts that must not be fetched by server-side proxies. */
+export function isBlockedFetchHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+
+  if (!host || host === 'localhost' || host.endsWith('.localhost')) return true
+  if (host === '0.0.0.0' || host === '::' || host === '::1') return true
+  if (host.endsWith('.local') || host.endsWith('.internal')) return true
+
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
+  if (ipv4) {
+    const octets = ipv4.slice(1, 5).map(Number)
+    if (octets.some((n) => n > 255)) return true
+    const [a, b] = octets
+    if (a === 10 || a === 127 || a === 0) return true
+    if (a === 169 && b === 254) return true
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+    if (a === 100 && b >= 64 && b <= 127) return true
+  }
+
+  return false
+}

memento-note/lib/upload-access.ts

@@ -0,0 +1,37 @@
+import { prisma } from './prisma'
+
+/** Whether a note image upload may be served to the current viewer. */
+export async function canAccessUploadedNoteImage(
+  filename: string,
+  userId: string | null | undefined,
+): Promise<boolean> {
+  const imagePath = `/uploads/notes/${filename}`
+
+  const published = await prisma.note.findFirst({
+    where: {
+      isPublic: true,
+      trashedAt: null,
+      OR: [
+        { content: { contains: imagePath } },
+        { images: { contains: filename } },
+      ],
+    },
+    select: { id: true },
+  })
+  if (published) return true
+
+  if (!userId) return false
+
+  const owned = await prisma.note.findFirst({
+    where: {
+      userId,
+      trashedAt: null,
+      OR: [
+        { content: { contains: imagePath } },
+        { images: { contains: filename } },
+      ],
+    },
+    select: { id: true },
+  })
+  return !!owned
+}

memento-note/tests/unit/entitlements.test.ts

@@ -142,7 +142,8 @@ describe('entitlements', () => {
       expect(result.reason).toBe('FEATURE_NOT_AVAILABLE');
     });
 
-    it('should fail-open when Redis is down', async () => {
+    it('should fail-open when Redis is down in non-production', async () => {
+      vi.stubEnv('NODE_ENV', 'development');
       mockActiveSubscription('BASIC');
       vi.mocked(redis.get).mockRejectedValue(new Error('Connection refused'));
 
@@ -150,6 +151,17 @@ describe('entitlements', () => {
 
       expect(result.allowed).toBe(true);
     });
+
+    it('should fail-closed when Redis is down in production', async () => {
+      vi.stubEnv('NODE_ENV', 'production');
+      mockActiveSubscription('BASIC');
+      vi.mocked(redis.get).mockRejectedValue(new Error('Connection refused'));
+
+      const result = await canUseFeature('user1', 'semantic_search');
+
+      expect(result.allowed).toBe(false);
+      expect(result.reason).toBe('SERVICE_UNAVAILABLE');
+    });
   });
 
   describe('checkEntitlementOrThrow', () => {