1c659ce42f
Security: - Add auth + file type/size validation to upload API - Add admin auth to /api/admin/ endpoints - Add SSRF protection to scrape action - Whitelist fields in PUT /api/notes/[id] to prevent mass assignment - Protect /lab, /agents, /chat, /canvas, /notebooks routes in middleware AI provider fixes: - Add deepseek/openrouter to factory ProviderType (was silently falling back to ollama) - Fix title-suggestion.service.ts to use factory instead of hardcoded OpenAI - Fix getAIProvider→getChatProvider in memory-echo, notebook-summary, agent-executor - Fix getAIProvider→getTagsProvider in notebook-suggestion, title-suggestions, transform-markdown Functional bugs: - Fix ALLOW_REGISTRATION AND→OR logic - Fix note-editor.tsx passing stale props to useAutoTagging instead of local state - Fix stale Note.embedding type (migrated to NoteEmbedding table) - Remove hardcoded SQLite path from prisma.ts Frontend: - Add AbortController to useAutoTagging and useTitleSuggestions hooks - Add error rollback to optimistic UI in note-inline-editor - Remove stale closure over notebookId/language in useAutoTagging Cleanup: - Rename docker-compose from keepnotes→memento - Remove unused unstable_cache import from config.ts - Remove dead useUndoRedo hook - Fix TagSuggestion type (add isNewLabel, reasoning) - Remove dead AIConfig/AIProviderType types - Fix ghost-tags unused isEmpty var and as any cast - Fix note-editor titleSuggestions typed as any[] Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
60 lines
1.7 KiB
TypeScript
60 lines
1.7 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server'
|
|
import { writeFile, mkdir } from 'fs/promises'
|
|
import path from 'path'
|
|
import { randomUUID } from 'crypto'
|
|
import { auth } from '@/auth'
|
|
|
|
const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']
|
|
const MAX_SIZE = 5 * 1024 * 1024 // 5MB
|
|
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
const session = await auth()
|
|
if (!session?.user?.id) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const formData = await request.formData()
|
|
const file = formData.get('file') as File
|
|
|
|
if (!file) {
|
|
return NextResponse.json(
|
|
{ error: 'No file uploaded' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
if (!ALLOWED_TYPES.includes(file.type)) {
|
|
return NextResponse.json({ error: 'Invalid file type' }, { status: 400 })
|
|
}
|
|
|
|
if (file.size > MAX_SIZE) {
|
|
return NextResponse.json({ error: 'File too large (max 5MB)' }, { status: 400 })
|
|
}
|
|
|
|
const buffer = Buffer.from(await file.arrayBuffer())
|
|
const ext = path.extname(file.name).toLowerCase()
|
|
if (!['.jpg', '.jpeg', '.png', '.gif', '.webp'].includes(ext)) {
|
|
return NextResponse.json({ error: 'Invalid file extension' }, { status: 400 })
|
|
}
|
|
const filename = `${randomUUID()}${ext}`
|
|
|
|
// Ensure directory exists
|
|
const uploadDir = path.join(process.cwd(), 'public/uploads/notes')
|
|
await mkdir(uploadDir, { recursive: true })
|
|
|
|
const filePath = path.join(uploadDir, filename)
|
|
await writeFile(filePath, buffer)
|
|
|
|
return NextResponse.json({
|
|
success: true,
|
|
url: `/uploads/notes/${filename}`
|
|
})
|
|
} catch (error) {
|
|
return NextResponse.json(
|
|
{ error: 'Failed to upload file' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
}
|