fix(security): Phase 1 P0 hardening from cross-project audit

Close open uploads, image-proxy SSRF, fail-open AI quotas in production,
auth gaps on app routes, and MCP tenant isolation issues.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/lib/entitlements.ts

@@ -20,12 +20,20 @@ export interface EntitlementResult {
   remaining: number;
   limit: number;
   tier: SubscriptionTier;
-  reason?: 'QUOTA_EXCEEDED' | 'TIER_LIMITED' | 'FEATURE_NOT_AVAILABLE';
+  reason?: 'QUOTA_EXCEEDED' | 'TIER_LIMITED' | 'FEATURE_NOT_AVAILABLE' | 'SERVICE_UNAVAILABLE';
   message?: string;
   upgradeTier?: 'PRO' | 'BUSINESS';
   byokConfigured?: boolean;
 }
 
+export class QuotaServiceUnavailableError extends Error {
+  code = 'QUOTA_SERVICE_UNAVAILABLE';
+
+  constructor(message = 'Quota service temporarily unavailable') {
+    super(message);
+  }
+}
+
 export class QuotaExceededError extends Error {
   code = 'QUOTA_EXCEEDED';
   upgradeTier: 'PRO' | 'BUSINESS';
@@ -77,6 +85,10 @@ export class QuotaExceededError extends Error {
 
 const TTL_SECONDS = 90 * 24 * 60 * 60;
 
+function shouldFailClosedOnRedisError(): boolean {
+  return process.env.NODE_ENV === 'production';
+}
+
 const INCREMENT_BY_LUA = `
 local count = tonumber(ARGV[1]) or 1
 local ttl = tonumber(ARGV[2])
@@ -194,7 +206,17 @@ export async function canUseFeature(
       byokConfigured: await hasAnyActiveByok(userId),
     };
   } catch (err) {
-    console.error('[entitlements] Redis unavailable, allowing request (fail-open):', err);
+    console.error('[entitlements] Redis unavailable:', err);
+    if (shouldFailClosedOnRedisError()) {
+      return {
+        allowed: false,
+        remaining: 0,
+        limit,
+        tier,
+        reason: 'SERVICE_UNAVAILABLE',
+        message: 'Quota service temporarily unavailable. Please try again later.',
+      };
+    }
     return { allowed: true, remaining: limit, limit, tier };
   }
 }
@@ -264,7 +286,10 @@ export async function reserveUsageOrThrow(
     }
   } catch (err) {
     if (err instanceof QuotaExceededError) throw err;
-    console.error('[entitlements] Redis unavailable, allowing request (fail-open):', err);
+    console.error('[entitlements] Redis unavailable:', err);
+    if (shouldFailClosedOnRedisError()) {
+      throw new QuotaServiceUnavailableError();
+    }
   }
 }
 

memento-note/lib/ssrf-guard.ts

@@ -0,0 +1,22 @@
+/** Block hosts that must not be fetched by server-side proxies. */
+export function isBlockedFetchHost(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+
+  if (!host || host === 'localhost' || host.endsWith('.localhost')) return true
+  if (host === '0.0.0.0' || host === '::' || host === '::1') return true
+  if (host.endsWith('.local') || host.endsWith('.internal')) return true
+
+  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
+  if (ipv4) {
+    const octets = ipv4.slice(1, 5).map(Number)
+    if (octets.some((n) => n > 255)) return true
+    const [a, b] = octets
+    if (a === 10 || a === 127 || a === 0) return true
+    if (a === 169 && b === 254) return true
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+    if (a === 100 && b >= 64 && b <= 127) return true
+  }
+
+  return false
+}

memento-note/lib/upload-access.ts

@@ -0,0 +1,37 @@
+import { prisma } from './prisma'
+
+/** Whether a note image upload may be served to the current viewer. */
+export async function canAccessUploadedNoteImage(
+  filename: string,
+  userId: string | null | undefined,
+): Promise<boolean> {
+  const imagePath = `/uploads/notes/${filename}`
+
+  const published = await prisma.note.findFirst({
+    where: {
+      isPublic: true,
+      trashedAt: null,
+      OR: [
+        { content: { contains: imagePath } },
+        { images: { contains: filename } },
+      ],
+    },
+    select: { id: true },
+  })
+  if (published) return true
+
+  if (!userId) return false
+
+  const owned = await prisma.note.findFirst({
+    where: {
+      userId,
+      trashedAt: null,
+      OR: [
+        { content: { contains: imagePath } },
+        { images: { contains: filename } },
+      ],
+    },
+    select: { id: true },
+  })
+  return !!owned
+}