fix(security): Phase 1 P0 hardening from cross-project audit

Close open uploads, image-proxy SSRF, fail-open AI quotas in production, auth gaps on app routes, and MCP tenant isolation issues. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-20 16:53:19 +00:00
parent 40f30155c2
commit 4d96605144
16 changed files with 264 additions and 95 deletions
--- a/memento-note/auth.config.ts
+++ b/memento-note/auth.config.ts
@@ -27,7 +27,11 @@ export const authConfig = {
                             nextUrl.pathname.startsWith('/canvas') ||
                             nextUrl.pathname.startsWith('/notebooks') ||
                             nextUrl.pathname.startsWith('/note/') ||
-                             nextUrl.pathname.startsWith('/brainstorm');
+                             nextUrl.pathname.startsWith('/brainstorm') ||
+                             nextUrl.pathname.startsWith('/insights') ||
+                             nextUrl.pathname.startsWith('/graph') ||
+                             nextUrl.pathname.startsWith('/revision') ||
+                             nextUrl.pathname.startsWith('/support');
      const isAdminPage = nextUrl.pathname.startsWith('/admin');
      const isPublicPage = nextUrl.pathname === '/' ||
                          nextUrl.pathname === '/login' ||