@takosjp/yurucommu-core 3.0.0

package/src/backend/lib/strip-image-metadata.ts

@@ -0,0 +1,191 @@
+/**
+ * Strip privacy-sensitive metadata from an uploaded raster image at ingest.
+ *
+ * Phone cameras embed EXIF GPS coordinates, capture timestamps and camera serial
+ * numbers in uploaded JPEGs (and, less commonly, PNG/WebP). yurucommu serves
+ * uploaded media verbatim under a 1-year public cache, so a public post or
+ * profile image would otherwise leak the poster's location — a recognised
+ * fediverse-class privacy defect (Mastodon strips image metadata server-side for
+ * exactly this reason). This module removes the metadata segments WITHOUT
+ * re-encoding the pixels, so the visible image is unchanged.
+ *
+ * Pure byte-surgery (no native image library): it walks the container structure
+ * and drops only metadata segments/chunks, copying everything else verbatim. It
+ * NEVER corrupts: on any structural surprise it returns the original bytes
+ * unchanged (the magic-byte validation has already confirmed the declared type).
+ *
+ * Covered: JPEG (APP1 EXIF/XMP, APP13 IPTC, COM), PNG (tEXt/zTXt/iTXt/eXIf/tIME),
+ * WebP (EXIF / XMP chunks). GIF and video are passed through unchanged (GIF
+ * rarely carries geotags; video metadata stripping needs a transcode pipeline).
+ */
+
+/** Strip metadata for a supported raster image; pass other types through. */
+export function stripImageMetadata(
+  bytes: Uint8Array,
+  mimeType: string,
+): Uint8Array {
+  try {
+    switch (mimeType) {
+      case "image/jpeg":
+        return stripJpeg(bytes);
+      case "image/png":
+        return stripPng(bytes);
+      case "image/webp":
+        return stripWebp(bytes);
+      default:
+        return bytes; // gif / video / unknown: unchanged
+    }
+  } catch {
+    // Never let a parsing surprise corrupt or drop the upload.
+    return bytes;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// JPEG: a stream of marker segments. Drop APP1 (EXIF + XMP), APP13 (IPTC /
+// Photoshop) and COM (comment); keep APP0 (JFIF), APP2 (ICC), APP14 (Adobe
+// color transform), the quantization/Huffman tables, and the scan data verbatim.
+// ---------------------------------------------------------------------------
+function stripJpeg(bytes: Uint8Array): Uint8Array {
+  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return bytes;
+
+  const out: number[] = [0xff, 0xd8]; // SOI
+  let i = 2;
+
+  while (i + 1 < bytes.length) {
+    if (bytes[i] !== 0xff) return bytes; // not at a marker — bail unchanged
+    const marker = bytes[i + 1];
+
+    // Start of Scan: entropy-coded data runs to EOI — copy the rest verbatim.
+    if (marker === 0xda) {
+      for (let k = i; k < bytes.length; k++) out.push(bytes[k]);
+      return Uint8Array.from(out);
+    }
+    // Standalone markers carry no length payload.
+    if (
+      marker === 0xd8 ||
+      marker === 0xd9 ||
+      marker === 0x01 ||
+      (marker >= 0xd0 && marker <= 0xd7)
+    ) {
+      out.push(0xff, marker);
+      i += 2;
+      continue;
+    }
+    if (i + 3 >= bytes.length) return bytes; // truncated length — bail unchanged
+    const len = (bytes[i + 2] << 8) | bytes[i + 3]; // includes the 2 length bytes
+    if (len < 2 || i + 2 + len > bytes.length) return bytes; // malformed — bail
+
+    const drop =
+      marker === 0xe1 || // APP1: EXIF + XMP (the GPS carriers)
+      marker === 0xed || // APP13: IPTC / Photoshop
+      marker === 0xfe; // COM: comment
+    if (!drop) {
+      for (let k = i; k < i + 2 + len; k++) out.push(bytes[k]);
+    }
+    i += 2 + len;
+  }
+  return Uint8Array.from(out);
+}
+
+// ---------------------------------------------------------------------------
+// PNG: an 8-byte signature followed by length-prefixed chunks. Drop the textual
+// / metadata ancillary chunks; keep critical + rendering-relevant chunks.
+// ---------------------------------------------------------------------------
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+const PNG_DROP_CHUNKS = new Set(["tEXt", "zTXt", "iTXt", "eXIf", "tIME"]);
+
+function stripPng(bytes: Uint8Array): Uint8Array {
+  if (bytes.length < 8) return bytes;
+  for (let i = 0; i < 8; i++) if (bytes[i] !== PNG_SIGNATURE[i]) return bytes;
+
+  const out: number[] = [...PNG_SIGNATURE];
+  let i = 8;
+  while (i + 8 <= bytes.length) {
+    const len =
+      (bytes[i] << 24) |
+      (bytes[i + 1] << 16) |
+      (bytes[i + 2] << 8) |
+      bytes[i + 3];
+    if (len < 0) return bytes; // overflow / malformed — bail unchanged
+    const type = String.fromCharCode(
+      bytes[i + 4],
+      bytes[i + 5],
+      bytes[i + 6],
+      bytes[i + 7],
+    );
+    const chunkEnd = i + 12 + len; // length(4) + type(4) + data(len) + crc(4)
+    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+
+    if (!PNG_DROP_CHUNKS.has(type)) {
+      for (let k = i; k < chunkEnd; k++) out.push(bytes[k]);
+    }
+    i = chunkEnd;
+    if (type === "IEND") break;
+  }
+  return Uint8Array.from(out);
+}
+
+// ---------------------------------------------------------------------------
+// WebP: a RIFF container ("RIFF" <size> "WEBP" <chunks>). Drop the "EXIF" and
+// "XMP " chunks, clear the matching VP8X feature-flag bits, and rewrite the RIFF
+// size. Chunks are FourCC(4) + size(4, little-endian) + payload + 1 pad byte to
+// an even length.
+// ---------------------------------------------------------------------------
+function fourCC(bytes: Uint8Array, off: number): string {
+  return String.fromCharCode(
+    bytes[off],
+    bytes[off + 1],
+    bytes[off + 2],
+    bytes[off + 3],
+  );
+}
+
+function stripWebp(bytes: Uint8Array): Uint8Array {
+  if (bytes.length < 16) return bytes;
+  if (fourCC(bytes, 0) !== "RIFF" || fourCC(bytes, 8) !== "WEBP") return bytes;
+
+  const head: number[] = [];
+  for (let k = 0; k < 12; k++) head.push(bytes[k]); // RIFF + size + WEBP
+  const body: number[] = [];
+  let removed = false;
+
+  let i = 12;
+  while (i + 8 <= bytes.length) {
+    const cc = fourCC(bytes, i);
+    const size =
+      bytes[i + 4] |
+      (bytes[i + 5] << 8) |
+      (bytes[i + 6] << 16) |
+      (bytes[i + 7] << 24);
+    if (size < 0) return bytes; // overflow — bail unchanged
+    const padded = size + (size & 1); // chunks pad to an even length
+    const chunkEnd = i + 8 + padded;
+    if (chunkEnd > bytes.length) return bytes; // truncated — bail unchanged
+
+    if (cc === "EXIF" || cc === "XMP ") {
+      removed = true; // skip this chunk entirely
+    } else {
+      for (let k = i; k < chunkEnd; k++) body.push(bytes[k]);
+    }
+    i = chunkEnd;
+  }
+  if (!removed) return bytes; // nothing to strip — keep original bytes
+
+  // Clear the EXIF (bit 3) / XMP (bit 2) feature flags in a VP8X header so the
+  // declared features match the chunks that remain. VP8X payload byte 0 holds
+  // the flags; it sits at body offset 8 when VP8X is the first chunk.
+  if (body.length >= 9 && fourCC(Uint8Array.from(body), 0) === "VP8X") {
+    body[8] &= ~0b00001100;
+  }
+
+  // Rewrite the RIFF chunk size = bytes after the 8-byte RIFF header = "WEBP"
+  // (4) + body.
+  const riffSize = 4 + body.length;
+  head[4] = riffSize & 0xff;
+  head[5] = (riffSize >> 8) & 0xff;
+  head[6] = (riffSize >> 16) & 0xff;
+  head[7] = (riffSize >> 24) & 0xff;
+
+  return Uint8Array.from([...head, ...body]);
+}

package/src/backend/middleware/bearer-auth.ts

@@ -0,0 +1,70 @@
+import type { MiddlewareHandler } from "hono";
+import type { Env, Variables } from "../types.ts";
+import {
+  getOidcClientCredentials,
+  getOidcIssuerUrl,
+  issuerEndpoint,
+} from "../lib/oauth-providers.ts";
+
+export function requireBearerAuth(
+  requiredScope: string,
+): MiddlewareHandler<{ Bindings: Env; Variables: Variables }> {
+  return async (c, next) => {
+    const auth = c.req.header("Authorization");
+    if (!auth?.startsWith("Bearer ")) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    const token = auth.slice(7);
+    const issuer = getOidcIssuerUrl(c.env);
+    const { clientId, clientSecret } = getOidcClientCredentials(c.env);
+    if (!issuer || !clientId || !clientSecret) {
+      return c.json(
+        {
+          error: "server_error",
+          error_description: "Takosumi Accounts OIDC client not configured",
+        },
+        500,
+      );
+    }
+
+    const res = await fetch(issuerEndpoint(issuer, "/oauth/introspect"), {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token,
+        client_id: clientId,
+        client_secret: clientSecret,
+      }).toString(),
+    });
+    if (!res.ok) {
+      return c.json(
+        {
+          error: "server_error",
+          error_description: "Introspect failed",
+        },
+        500,
+      );
+    }
+
+    const info = (await res.json()) as {
+      active: boolean;
+      scope?: string;
+      sub?: string;
+      client_id?: string;
+    };
+    if (!info.active) {
+      return c.json({ error: "invalid_token" }, 401);
+    }
+    const scopes = (info.scope ?? "").split(" ");
+    if (!scopes.includes(requiredScope)) {
+      return c.json({ error: "insufficient_scope" }, 403);
+    }
+
+    c.set("oauthToken", {
+      sub: info.sub ?? "",
+      scope: info.scope ?? "",
+      client_id: info.client_id ?? "",
+    });
+    await next();
+  };
+}

package/src/backend/middleware/body-limit.ts

@@ -0,0 +1,212 @@
+import type { Context, MiddlewareHandler, Next } from "hono";
+
+import type { Env, Variables } from "../types.ts";
+import { logger } from "../lib/logger.ts";
+
+const log = logger.child({ component: "middleware.body_limit" });
+
+/**
+ * DoS body-size guard.
+ *
+ * Reads `Content-Length` before any handler runs and rejects the request with
+ * a `413 body_too_large` envelope when the declared body exceeds the
+ * configured cap. The check is conservative on purpose:
+ *
+ * - HEAD / GET / OPTIONS / DELETE without a body are skipped.
+ * - The cap is bytes. `1 MiB = 1024 * 1024`.
+ *
+ * Missing `Content-Length` is allowed by default because the Fetch `Request`
+ * constructor does not auto-populate the header for string bodies in tests,
+ * and many real callers omit it for chunked encoded uploads. A declared
+ * `Content-Length` is NOT trusted as the only line of defense: when the
+ * header is absent (chunked transfer-encoding), the request body is wrapped
+ * in a streaming counter that aborts once the byte count exceeds the cap, so
+ * an attacker cannot bypass the limit by simply omitting `Content-Length`.
+ * Set `requireContentLength: true` on routes that must refuse chunked-only
+ * requests outright with 411 instead (= the strict mode rejects the request
+ * before the body is even read).
+ *
+ * Per-route caps stack on top of the global default cap — the middleware is
+ * normally registered globally first, with stricter caps mounted on specific
+ * route paths afterward. The first registered middleware wins because Hono
+ * runs middleware in registration order; a per-route override should
+ * therefore be mounted BEFORE the global gate when it needs to LIFT the
+ * cap (e.g. media uploads). When it merely TIGHTENS the cap, mounting it
+ * after the global gate also works because the global gate already let the
+ * smaller body through.
+ */
+
+const BODY_BEARING_METHODS = new Set(["POST", "PUT", "PATCH"]);
+
+export interface BodyLimitOptions {
+  /** Maximum body size in bytes. */
+  maxBytes: number;
+  /**
+   * When true, requests without a `Content-Length` header are rejected with
+   * 411 on body-bearing methods. Defaults to false — the middleware then
+   * only validates the header value when present and lets chunked-only
+   * traffic through to the next layer (which can still enforce a stream
+   * cap).
+   */
+  requireContentLength?: boolean;
+}
+
+export const DEFAULT_BODY_LIMIT_BYTES = 1 * 1024 * 1024; // 1 MiB
+
+function parseContentLength(header: string | null): number | null {
+  if (!header) return null;
+  const trimmed = header.trim();
+  if (!trimmed) return null;
+  // RFC 7230 forbids non-digit characters; treat anything else as missing
+  // rather than zero (zero would silently pass the cap).
+  if (!/^[0-9]+$/.test(trimmed)) return null;
+  const parsed = Number.parseInt(trimmed, 10);
+  if (!Number.isFinite(parsed) || parsed < 0) return null;
+  return parsed;
+}
+
+export type BodyLimitDecision =
+  | { ok: true }
+  | {
+      ok: false;
+      reason: "body_too_large" | "body_length_required";
+      limit: number;
+      declared: number | null;
+    };
+
+/**
+ * Pure decision function. Exposed for unit tests; the middleware below is a
+ * thin Hono wrapper.
+ */
+export function evaluateBodyLimit(
+  request: Request,
+  options: BodyLimitOptions,
+): BodyLimitDecision {
+  const method = request.method.toUpperCase();
+  if (!BODY_BEARING_METHODS.has(method)) return { ok: true };
+
+  const declared = parseContentLength(request.headers.get("content-length"));
+  if (declared === null) {
+    if (!options.requireContentLength) return { ok: true };
+    return {
+      ok: false,
+      reason: "body_length_required",
+      limit: options.maxBytes,
+      declared: null,
+    };
+  }
+  if (declared > options.maxBytes) {
+    return {
+      ok: false,
+      reason: "body_too_large",
+      limit: options.maxBytes,
+      declared,
+    };
+  }
+  return { ok: true };
+}
+
+/** Sentinel error thrown by the stream counter when the cap is exceeded. */
+export class BodyTooLargeError extends Error {
+  readonly limit: number;
+  constructor(limit: number) {
+    super(`Request body exceeds the ${limit} byte cap`);
+    this.name = "BodyTooLargeError";
+    this.limit = limit;
+  }
+}
+
+/**
+ * Wrap a request body stream so that it errors (cancelling the source) once
+ * more than `maxBytes` have flowed through. This closes the chunked-transfer
+ * bypass: a request without a trusted `Content-Length` is still capped while
+ * its body is consumed downstream, instead of relying on the (omittable)
+ * header alone.
+ */
+export function capRequestBodyStream(
+  request: Request,
+  maxBytes: number,
+): Request {
+  const body = request.body;
+  if (!body) return request;
+
+  let seen = 0;
+  const capped = body.pipeThrough(
+    new TransformStream<Uint8Array, Uint8Array>({
+      transform(chunk, controller) {
+        seen += chunk.byteLength;
+        if (seen > maxBytes) {
+          controller.error(new BodyTooLargeError(maxBytes));
+          return;
+        }
+        controller.enqueue(chunk);
+      },
+    }),
+  );
+
+  // `duplex: "half"` is required when constructing a Request with a stream
+  // body. The cloned Request keeps method / headers / url so downstream
+  // handlers and signature verification see an unchanged request shape.
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body: capped,
+    redirect: request.redirect,
+    signal: request.signal,
+    // @ts-expect-error duplex is a valid RequestInit field at runtime but is
+    // not yet in the lib.dom typings shipped with this TypeScript target.
+    duplex: "half",
+  });
+}
+
+export function bodyLimit(
+  options: BodyLimitOptions,
+): MiddlewareHandler<{ Bindings: Env; Variables: Variables }> {
+  return async (
+    c: Context<{ Bindings: Env; Variables: Variables }>,
+    next: Next,
+  ) => {
+    const decision = evaluateBodyLimit(c.req.raw, options);
+    if (decision.ok) {
+      // The header check above only guards declared `Content-Length`. For
+      // body-bearing requests that omit it (chunked transfer-encoding), wrap
+      // the stream so the cap is still enforced as the body is consumed.
+      const method = c.req.method.toUpperCase();
+      if (
+        BODY_BEARING_METHODS.has(method) &&
+        c.req.raw.headers.get("content-length") === null &&
+        c.req.raw.body !== null
+      ) {
+        const capped = capRequestBodyStream(c.req.raw, options.maxBytes);
+        if (capped !== c.req.raw) {
+          // Replace the underlying Request so downstream `c.req.*` readers
+          // consume the length-capped stream.
+          c.req.raw = capped;
+        }
+      }
+      return await next();
+    }
+
+    log.warn("body limit exceeded", {
+      event: "body_limit.rejected",
+      reason: decision.reason,
+      limit: decision.limit,
+      declared: decision.declared,
+      path: new URL(c.req.url).pathname,
+      method: c.req.method,
+    });
+
+    const status = decision.reason === "body_length_required" ? 411 : 413;
+    return c.json(
+      {
+        error: decision.reason,
+        message:
+          decision.reason === "body_too_large"
+            ? `Request body exceeds the ${decision.limit} byte cap`
+            : "Content-Length header is required",
+        limit: decision.limit,
+      },
+      status,
+    );
+  };
+}