diff --git a/memento-note/app/(main)/layout.tsx b/memento-note/app/(main)/layout.tsx index 321ae86..579b063 100644 --- a/memento-note/app/(main)/layout.tsx +++ b/memento-note/app/(main)/layout.tsx @@ -41,7 +41,10 @@ export default async function MainLayout({ -
+
+ + Skip to content + {children}
diff --git a/memento-note/app/api/ai/auto-labels/route.ts b/memento-note/app/api/ai/auto-labels/route.ts index 27068f3..92f8396 100644 --- a/memento-note/app/api/ai/auto-labels/route.ts +++ b/memento-note/app/api/ai/auto-labels/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server' import { auth } from '@/auth' import { autoLabelCreationService } from '@/lib/ai/services' diff --git a/memento-note/app/api/ai/convert-markdown/route.ts b/memento-note/app/api/ai/convert-markdown/route.ts index 0e8e5b6..8ad9d3a 100644 --- a/memento-note/app/api/ai/convert-markdown/route.ts +++ b/memento-note/app/api/ai/convert-markdown/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server' import { auth } from '@/auth' import { markdownToHtml } from '@/lib/markdown-to-html' diff --git a/memento-note/app/api/ai/notebook-summary/route.ts b/memento-note/app/api/ai/notebook-summary/route.ts index f421208..5a59d67 100644 --- a/memento-note/app/api/ai/notebook-summary/route.ts +++ b/memento-note/app/api/ai/notebook-summary/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server' import { auth } from '@/auth' import { notebookSummaryService } from '@/lib/ai/services' diff --git a/memento-note/app/api/ai/search-overview/route.ts b/memento-note/app/api/ai/search-overview/route.ts index 318aa1d..9686786 100644 --- a/memento-note/app/api/ai/search-overview/route.ts +++ b/memento-note/app/api/ai/search-overview/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server' import { auth } from '@/auth' import { searchOverviewService } from '@/lib/ai/services/search-overview.service' diff --git a/memento-note/app/api/ai/tags/route.ts b/memento-note/app/api/ai/tags/route.ts index bc43cd8..aedbc4f 100644 --- a/memento-note/app/api/ai/tags/route.ts +++ b/memento-note/app/api/ai/tags/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server'; import { auth } from '@/auth'; import { contextualAutoTagService } from '@/lib/ai/services/contextual-auto-tag.service'; diff --git a/memento-note/app/api/ai/title-suggestions/route.ts b/memento-note/app/api/ai/title-suggestions/route.ts index f62ddcd..3d084fc 100644 --- a/memento-note/app/api/ai/title-suggestions/route.ts +++ b/memento-note/app/api/ai/title-suggestions/route.ts @@ -1,3 +1,4 @@ +import { rateLimit } from '@/lib/rate-limit' import { NextRequest, NextResponse } from 'next/server' import { runLaneWithBillingUser, willUseByokForLane } from '@/lib/ai/provider-for-user' import { getSystemConfig } from '@/lib/config' diff --git a/memento-note/app/api/chat/route.ts b/memento-note/app/api/chat/route.ts index 0aa302d..4871289 100644 --- a/memento-note/app/api/chat/route.ts +++ b/memento-note/app/api/chat/route.ts @@ -15,6 +15,7 @@ import { trackFeatureUsage } from '@/lib/usage-tracker' import { readFile } from 'fs/promises' import path from 'path' import { logAuditEvent, getClientIp } from '@/lib/audit-log' +import { rateLimit } from '@/lib/rate-limit' export const maxDuration = 60 @@ -53,6 +54,14 @@ export async function POST(req: Request) { } const userId = session.user.id + const rl = await rateLimit(userId, 'chat', 15, 60) + if (!rl.allowed) { + return new Response(JSON.stringify({ error: 'rate_limited' }), { + status: 429, + headers: { 'Content-Type': 'application/json', 'Retry-After': '60' }, + }) + } + // GDPR AI Consent check if (!(await hasUserAiConsent())) { return new Response(JSON.stringify({ error: 'ai_consent_required' }), { diff --git a/memento-note/app/api/link-preview/route.ts b/memento-note/app/api/link-preview/route.ts index 05403a2..66128ed 100644 --- a/memento-note/app/api/link-preview/route.ts +++ b/memento-note/app/api/link-preview/route.ts @@ -1,5 +1,6 @@ import { NextRequest, NextResponse } from 'next/server' import { auth } from '@/auth' +import { redis } from '@/lib/redis' export async function GET(req: NextRequest) { const session = await auth() @@ -12,6 +13,16 @@ export async function GET(req: NextRequest) { return NextResponse.json({ error: 'Missing url' }, { status: 400 }) } + const cacheKey = `linkpreview:${session.user.id}:${Buffer.from(url).toString('base64url').slice(0, 80)}` + try { + const cached = await redis.get(cacheKey) + if (cached) { + return NextResponse.json(JSON.parse(cached), { + headers: { 'Cache-Control': 'public, s-maxage=86400' }, + }) + } + } catch {} + try { const parsed = new URL(url) if (!['http:', 'https:'].includes(parsed.protocol)) { @@ -69,6 +80,8 @@ export async function GET(req: NextRequest) { const html = await res.text() const data = extractMetadata(html, parsed) + try { await redis.setex(cacheKey, 300, JSON.stringify(data)) } catch {} + return NextResponse.json(data, { headers: { 'Cache-Control': 'public, s-maxage=86400' }, }) diff --git a/memento-note/components/note-actions.tsx b/memento-note/components/note-actions.tsx index 12efb7a..5de7bd9 100644 --- a/memento-note/components/note-actions.tsx +++ b/memento-note/components/note-actions.tsx @@ -127,7 +127,7 @@ export function NoteActions({ @@ -198,7 +198,7 @@ export function NoteActions({ diff --git a/memento-note/components/search-modal.tsx b/memento-note/components/search-modal.tsx index 7ebacba..e88acdc 100644 --- a/memento-note/components/search-modal.tsx +++ b/memento-note/components/search-modal.tsx @@ -372,11 +372,20 @@ export function SearchModal({ isOpen, onClose }: SearchModalProps) { } } - // Keyboard navigation + // Keyboard navigation + focus trap + const modalRef = useRef(null) useEffect(() => { if (!isOpen) return const handleKeyDown = (e: KeyboardEvent) => { if (e.key === 'Escape') { e.preventDefault(); onClose() } + else if (e.key === 'Tab' && modalRef.current) { + const focusable = modalRef.current.querySelectorAll('button, a, input, [tabindex]:not([tabindex="-1"])') + if (focusable.length === 0) return + const first = focusable[0] + const last = focusable[focusable.length - 1] + if (e.shiftKey && document.activeElement === first) { e.preventDefault(); last.focus() } + else if (!e.shiftKey && document.activeElement === last) { e.preventDefault(); first.focus() } + } else if (e.key === 'ArrowDown') { e.preventDefault(); setSelectedIndex(p => Math.min(p + 1, filteredMatches.length - 1)) } else if (e.key === 'ArrowUp') { e.preventDefault(); setSelectedIndex(p => Math.max(p - 1, 0)) } else if (e.key === 'Enter') { @@ -412,6 +421,7 @@ export function SearchModal({ isOpen, onClose }: SearchModalProps) { return (
() +import { redis } from '@/lib/redis' +import { NextResponse } from 'next/server' -const WINDOW_MS = 60_000 -const MAX_ATTEMPTS = 5 +const WINDOW_SECONDS = 60 +const MAX_REQUESTS = 20 -export function rateLimit(key: string): { allowed: boolean; retryAfterMs: number } { - const now = Date.now() - const entry = attempts.get(key) - - if (!entry || now > entry.resetAt) { - attempts.set(key, { count: 1, resetAt: now + WINDOW_MS }) - return { allowed: true, retryAfterMs: 0 } +export async function rateLimit( + userId: string, + feature: string, + max: number = MAX_REQUESTS, + windowSec: number = WINDOW_SECONDS, +): Promise<{ allowed: boolean; remaining: number }> { + const key = `ratelimit:${feature}:${userId}` + try { + const count = await redis.incr(key) + if (count === 1) { + await redis.expire(key, windowSec) + } + const remaining = Math.max(0, max - count) + return { allowed: count <= max, remaining } + } catch { + return { allowed: true, remaining: max } } - - entry.count++ - - if (entry.count > MAX_ATTEMPTS) { - return { allowed: false, retryAfterMs: entry.resetAt - now } - } - - return { allowed: true, retryAfterMs: 0 } } -setInterval(() => { - const now = Date.now() - for (const [k, v] of attempts) { - if (now > v.resetAt) attempts.delete(k) - } -}, 60_000) +export function rateLimitResponse(remaining: number): NextResponse | null { + return null +}