Two reviews, both dimensions. The serious ones, verified before fixing:
Sessions never expired server-side and survived a password reset. `Max-Age` is
a request to the browser, not a rule for the server, and `readSession` only
checked the signature -- a leaked cookie stayed valid indefinitely, and the very
reset meant to rescue a compromised account left the intruder logged in. A
demoted admin also kept admin, because the role came from the cookie. Now the
cookie carries a session epoch, `verifySession` checks the account against the
database on every request and takes the role from there, and the epoch is
bumped on password reset and on any role change. This was pre-existing, but the
reset feature promised safety it did not deliver.
"Allow download: off" did nothing for images with transparency -- exactly the
cutouts and stickers this tool exists for. The view path skipped resizing when
`has_alpha`, so the untouched original went out at full resolution, right-click
saveable. Verified: now 1500x2000 instead of 2400x3200, and the download route
returns 403.
The share title went into outgoing mail HTML unescaped while the message was
escaped -- a foreign link could be posted through the account's own
SPF/DKIM-signed mailserver. Both escaped now, plus length limits.
argon2 ran on every request for passphrase-protected links, including every
image: 130 ms and 64 MiB each. A 40-image gallery would have walked into the
memory limit, and a few dozen wrong guesses could have stalled the process.
Checked once, then a short-lived signed cookie scoped to that one link. The
passphrase moved from the query string to POST (it was landing in history and
proxy logs) and wrong guesses are now rate limited.
`days` accepted nonsense and quietly produced an unlimited link -- `Number('abc')`
is NaN and `NaN > 0` is false. `[]` coerced to 0, same result. Now rejected
outright, which matters when the pictures are of children.
Rate limits keyed on `clientAddress`, which is the *first* X-Forwarded-For
value -- set by the caller. Counting from the right instead, with the number of
trusted proxies configurable (TRUSTED_PROXIES, default 1), plus per-username and
per-recipient counters, a real limit on outgoing mail, and a limiter that
expires entries individually instead of clearing everyone's counter.
Also: expired links could still be mailed; missing PUBLIC_BASE_URL sent dead
links while reporting success; the reset endpoint's response time revealed
whether an account existed (send is no longer awaited); invalid UUIDs produced
500s; the email uniqueness race returned an HTML error page; share_views grew
without bound and is now one row per visitor per hour, hashed per link, user
agent reduced to browser and system, deleted after 90 days; double provenance
marking appended a second XMP packet with the older model instead of replacing.
21 new tests (97 total) for shares, mail and provenance -- all three were
completely untested, and that is where both reviews found the most.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BNhLunz586g6DeYMa7Qsd1
Five things off the open list in the wiki.
CSP with real hashes for every inline script (Astro's experimental.csp), so no
'unsafe-inline' for scripts. style-src is deliberately reopened in middleware:
React sets styles as attributes and attributes cannot be hashed -- measured, the
hash-only policy blocks them and the print preview loses its layout. Plus
nosniff, referrer-policy, X-Frame-Options and a permissions-policy. Verified
across all pages: zero violations.
mem_limit 3g in compose. sharp can spike; without a limit an outlier takes the
whole container down instead of just the process, and the healthcheck can't
help.
AI results now carry IPTC DigitalSourceType (trainedAlgorithmicMedia, or
compositeWithTrainedAlgorithmicMedia for edited photos) plus the model, embedded
as XMP -- written by hand into PNG iTXt and JPEG APP1 rather than pulling in a
sharp upgrade with a native postinstall. exiftool reads it back from both
formats; pixels, dimensions and dpi are provably untouched.
Crop maths lived twice, in the browser preview and the server renderer, with
nothing holding them together. Now one dependency-free module, and 60000
randomised cases assert both entry points agree. That test immediately found a
real bug: the zoom limits (0.02 / 8x) also clamped the *initial* crop, so an
extreme format silently broke the aspect ratio -- "Rand lassen" would have
cropped after all. Limits are now widened to whatever the format needs.
Also: the colour flag sat exactly on the selection circle in the library and
covered it. Moved to the bottom left.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BNhLunz586g6DeYMa7Qsd1
tillandClaude Opus 5