nai-aclab 1.0.1 → 1.0.4

package/README.md

@@ -121,6 +121,12 @@ override가 입력되어 있으면 모든 프리셋 조합에서 override 값을
 
 토큰을 넣기 전에는 목업 모드로 UI 흐름을 먼저 테스트할 수 있습니다.
 
+API 토큰은 `app_state.json`에 저장하거나 `/api/state` 응답으로 다시 내려보내지 않습니다. 한 번 입력한 토큰은 별도 secret store에 저장되어 다음 실행 때 자동으로 사용됩니다.
+
+생성 히스토리에는 이미지 표시와 작가 가중치 비교에 필요한 최소 정보만 저장합니다. 최종 프롬프트, 네거티브 프롬프트, UC 프롬프트, 생성 요청 JSON, 로컬 절대 경로는 별도로 저장하지 않습니다. 이전 버전에서 생성된 `*_request.json` 파일은 앱 시작 시 자동으로 제거됩니다.
+
+로컬 API는 앱이 시작될 때 생성되는 임시 토큰으로 보호됩니다. 또한 기본 NovelAI endpoint가 아닌 주소로 이미지를 생성하려는 경우, API 토큰이 해당 endpoint로 전송된다는 확인창을 먼저 표시합니다.
+
 ## 저장 위치
 
 앱 상태, 생성 이미지, 요청 JSON은 아래 위치에 저장됩니다.

package/app.py

@@ -32,6 +32,7 @@ USER_DIR = Path(
 DATA_DIR = USER_DIR / "data"
 OUTPUT_DIR = USER_DIR / "outputs"
 STATE_PATH = DATA_DIR / "app_state.json"
+TOKEN_SECRET_PATH = DATA_DIR / ("api_token.dpapi" if os.name == "nt" else "api_token.secret")
 DEFAULT_USER_AGENT = (
     "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
     "AppleWebKit/537.36 (KHTML, like Gecko) "
@@ -44,6 +45,127 @@ def ensure_dirs() -> None:
     OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
 
 
+def _windows_protect(data: bytes) -> bytes:
+    import ctypes
+    from ctypes import wintypes
+
+    class DataBlob(ctypes.Structure):
+        _fields_ = [("cbData", wintypes.DWORD), ("pbData", ctypes.POINTER(ctypes.c_byte))]
+
+    crypt32 = ctypes.windll.crypt32
+    kernel32 = ctypes.windll.kernel32
+    buffer = ctypes.create_string_buffer(data)
+    in_blob = DataBlob(len(data), ctypes.cast(buffer, ctypes.POINTER(ctypes.c_byte)))
+    out_blob = DataBlob()
+    if not crypt32.CryptProtectData(ctypes.byref(in_blob), None, None, None, None, 0, ctypes.byref(out_blob)):
+        raise OSError("Failed to protect API token with Windows DPAPI.")
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        kernel32.LocalFree(out_blob.pbData)
+
+
+def _windows_unprotect(data: bytes) -> bytes:
+    import ctypes
+    from ctypes import wintypes
+
+    class DataBlob(ctypes.Structure):
+        _fields_ = [("cbData", wintypes.DWORD), ("pbData", ctypes.POINTER(ctypes.c_byte))]
+
+    crypt32 = ctypes.windll.crypt32
+    kernel32 = ctypes.windll.kernel32
+    buffer = ctypes.create_string_buffer(data)
+    in_blob = DataBlob(len(data), ctypes.cast(buffer, ctypes.POINTER(ctypes.c_byte)))
+    out_blob = DataBlob()
+    if not crypt32.CryptUnprotectData(ctypes.byref(in_blob), None, None, None, None, 0, ctypes.byref(out_blob)):
+        raise OSError("Failed to unprotect API token with Windows DPAPI.")
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        kernel32.LocalFree(out_blob.pbData)
+
+
+def save_api_token(token: str) -> None:
+    token = token.strip()
+    if not token:
+        return
+    ensure_dirs()
+    raw = token.encode("utf-8")
+    payload = _windows_protect(raw) if os.name == "nt" else raw
+    TOKEN_SECRET_PATH.write_bytes(payload)
+    if os.name != "nt":
+        try:
+            TOKEN_SECRET_PATH.chmod(0o600)
+        except OSError:
+            pass
+
+
+def load_api_token() -> str:
+    try:
+        payload = TOKEN_SECRET_PATH.read_bytes()
+    except OSError:
+        return ""
+    try:
+        raw = _windows_unprotect(payload) if os.name == "nt" else payload
+        return raw.decode("utf-8")
+    except Exception:
+        return ""
+
+
+def has_saved_api_token() -> bool:
+    return bool(load_api_token().strip())
+
+
+def cleanup_saved_request_jsons() -> None:
+    try:
+        for path in OUTPUT_DIR.rglob("*_request.json"):
+            if path.is_file():
+                path.unlink()
+    except OSError:
+        pass
+
+
+def state_dict_without_secrets(state: AppState | dict) -> dict:
+    data = asdict(state) if not isinstance(state, dict) else dict(state)
+    api = dict(data.get("api", {}) or {})
+    api["token"] = ""
+    data["api"] = api
+    data["history"] = [sanitize_history_entry(item) for item in data.get("history", [])]
+    return data
+
+
+def output_ref(path_value: str) -> str:
+    raw = str(path_value or "").strip()
+    if not raw:
+        return ""
+    path = Path(raw)
+    try:
+        if path.is_absolute():
+            return str(path.resolve().relative_to(OUTPUT_DIR.resolve())).replace("\\", "/")
+    except (OSError, ValueError):
+        return path.name
+    return raw.replace("\\", "/")
+
+
+def sanitize_history_item(item: dict) -> dict:
+    clean = {
+        key: value
+        for key, value in dict(item or {}).items()
+        if key not in {"prompt", "negative_prompt", "uc_prompt", "request_path", "request_url"}
+    }
+    if "path" in clean:
+        clean["path"] = output_ref(clean.get("path", ""))
+    return clean
+
+
+def sanitize_history_entry(history: dict) -> dict:
+    clean = dict(history or {})
+    if "output_dir" in clean:
+        clean["output_dir"] = output_ref(clean.get("output_dir", ""))
+    clean["items"] = [sanitize_history_item(item) for item in clean.get("items", [])]
+    return clean
+
+
 def now_id() -> str:
     return time.strftime("%Y%m%d_%H%M%S")
 
@@ -223,8 +345,11 @@ def default_state() -> AppState:
 
 def load_state() -> AppState:
     ensure_dirs()
+    cleanup_saved_request_jsons()
     if not STATE_PATH.exists():
-        return default_state()
+        state = default_state()
+        state.api.token = load_api_token()
+        return state
     data = json.loads(STATE_PATH.read_text(encoding="utf-8"))
     base_data = data.get("base_presets", [])
     quality_override = data.get("quality_override_prompt", "")
@@ -237,9 +362,24 @@ def load_state() -> AppState:
             else next((item for item in base_data if item.get("quality_override_prompt")), None)
         )
         quality_override = (fallback_base or {}).get("quality_override_prompt", "")
-    api_data = data.get("api", {})
+    api_data = dict(data.get("api", {}) or {})
+    legacy_token = str(api_data.pop("token", "") or "").strip()
+    if legacy_token and not has_saved_api_token():
+        save_api_token(legacy_token)
+        data["api"] = api_data
+        STATE_PATH.write_text(
+            json.dumps(state_dict_without_secrets(data), ensure_ascii=False, indent=2),
+            encoding="utf-8",
+        )
     if api_data.get("user_agent") in (None, "", "NAIArtistCombination/0.1"):
         api_data["user_agent"] = DEFAULT_USER_AGENT
+    sanitized_data = state_dict_without_secrets(data)
+    if sanitized_data != data:
+        STATE_PATH.write_text(
+            json.dumps(sanitized_data, ensure_ascii=False, indent=2),
+            encoding="utf-8",
+        )
+    api_data["token"] = load_api_token()
     return AppState(
         categories=[Category(**item) for item in data.get("categories", [])],
         base_presets=[PromptPreset(**item) for item in base_data],
@@ -250,14 +390,14 @@ def load_state() -> AppState:
         api=ApiSettings(**api_data),
         generation=GenerationSettings(**data.get("generation", {})),
         batting_scenes=[BattingScene(**item) for item in data.get("batting_scenes", [])],
-        history=data.get("history", []),
+        history=[sanitize_history_entry(item) for item in data.get("history", [])],
     )
 
 
 def save_state(state: AppState) -> None:
     ensure_dirs()
     STATE_PATH.write_text(
-        json.dumps(asdict(state), ensure_ascii=False, indent=2),
+        json.dumps(state_dict_without_secrets(state), ensure_ascii=False, indent=2),
         encoding="utf-8",
     )
 
@@ -334,8 +474,6 @@ class NovelAIClient:
             return
 
         payload = self.build_payload(prompt, negative_prompt, uc_prompt)
-        request_path = output_path.with_name(output_path.stem + "_request.json")
-        request_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8")
         req = urllib.request.Request(
             self.settings.endpoint,
             data=json.dumps(payload).encode("utf-8"),
@@ -1133,11 +1271,7 @@ class App(tk.Tk if tk else object):
             prompt, negative, uc_prompt, artists = self.build_prompt()
             path = out_dir / f"image_{idx + 1:03}.png"
             metadata = {
-                "path": str(path),
-                "request_path": str(path.with_name(path.stem + "_request.json")),
-                "prompt": prompt,
-                "negative_prompt": negative,
-                "uc_prompt": uc_prompt,
+                "path": output_ref(str(path)),
                 "artists": artists,
                 "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nai-aclab",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Local web UI for experimenting with NovelAI artist tag weight combinations.",
   "license": "MIT",
   "type": "commonjs",

package/web/index.html

@@ -388,10 +388,6 @@
             <strong>작가 가중치</strong>
             <div id="modalArtists" class="artist-weight-list"></div>
           </div>
-          <div class="modal-section">
-            <strong>Prompt</strong>
-            <pre id="modalPrompt"></pre>
-          </div>
         </aside>
       </section>
     </div>

package/web/main.js

@@ -56,6 +56,7 @@ const imageSizeOptions = {
   landscape: { label: "Landscape", width: 1216, height: 832 },
   square: { label: "Square", width: 1024, height: 1024 },
 };
+const defaultNovelAiEndpoint = "https://image.novelai.net/ai/generate-image";
 
 function escapeHtml(value) {
   return String(value ?? "")
@@ -109,9 +110,14 @@ function setSaveState(text) {
 }
 
 async function request(path, options = {}) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-NAI-ACLAB-Token": window.__NAI_ACLAB_TOKEN__ || "",
+    ...(options.headers || {}),
+  };
   const response = await fetch(path, {
-    headers: { "Content-Type": "application/json" },
     ...options,
+    headers,
   });
   if (!response.ok) throw new Error(await response.text());
   return response.json();
@@ -534,8 +540,13 @@ function renderSettings() {
     const wrap = document.createElement("label");
     wrap.innerHTML = `<span>${label}</span><input id="api_${key}" type="${type}" />`;
     form.appendChild(wrap);
-    $(`#api_${key}`).value = state.api[key] ?? "";
-    if (type === "number") $(`#api_${key}`).step = "any";
+    const input = $(`#api_${key}`);
+    input.value = key === "token" ? "" : state.api[key] ?? "";
+    if (key === "token") {
+      input.placeholder = state.api.token_saved ? "저장된 토큰을 사용합니다" : "API 토큰을 입력하세요";
+      input.autocomplete = "off";
+    }
+    if (type === "number") input.step = "any";
   }
   $("#mockMode").checked = !!state.api.mock_mode;
   $("#negativePrompt").value = state.negative_prompt || "";
@@ -566,32 +577,30 @@ function renderImageCard(item, context = {}) {
   card.className = `image-card ${item.error ? "error" : ""}`;
   const enriched = enrichedImageItem(item, context);
   const modalList = context.modalItems || [enriched];
-  card.innerHTML = `
-    ${item.image_url ? `<img src="${item.image_url}" alt="generated image" />` : ""}
-    <div>${item.error ? item.error : item.created_at || "생성 완료"}</div>
-  `;
-  const img = card.querySelector("img");
-  if (img) img.onclick = () => openImageModal(enriched, modalList);
-  const meta = card.querySelector("div");
-  if (meta) {
-    const label = meta.textContent;
-    meta.className = "image-card-meta";
-    meta.textContent = "";
-    const labelNode = document.createElement("span");
-    labelNode.textContent = label;
-    meta.appendChild(labelNode);
-    if (canReuseArtists(item)) {
-      const button = document.createElement("button");
-      button.className = "mini-button artist-reuse-button";
-      button.type = "button";
-      button.textContent = "가중치 불러오기";
-      button.onclick = (event) => {
-        event.stopPropagation();
-        generateFromImage(enriched);
-      };
-      meta.appendChild(button);
-    }
+  if (item.image_url) {
+    const img = document.createElement("img");
+    img.src = item.image_url;
+    img.alt = "generated image";
+    img.onclick = () => openImageModal(enriched, modalList);
+    card.appendChild(img);
   }
+  const meta = document.createElement("div");
+  meta.className = "image-card-meta";
+  const labelNode = document.createElement("span");
+  labelNode.textContent = item.error ? item.error : item.created_at || "생성 완료";
+  meta.appendChild(labelNode);
+  if (canReuseArtists(item)) {
+    const button = document.createElement("button");
+    button.className = "mini-button artist-reuse-button";
+    button.type = "button";
+    button.textContent = "가중치 불러오기";
+    button.onclick = (event) => {
+      event.stopPropagation();
+      generateFromImage(enriched);
+    };
+    meta.appendChild(button);
+  }
+  card.appendChild(meta);
   return card;
 }
 
@@ -626,7 +635,12 @@ function renderHistory() {
     };
     const button = document.createElement("button");
     button.className = `list-item ${index === historyIndex ? "active" : ""}`;
-    button.innerHTML = `<strong>${history.base_preset} + ${history.character_preset}</strong><br><span>${history.created_at} · ${(history.items || []).length}장</span>`;
+    const title = document.createElement("strong");
+    title.textContent = `${history.base_preset || ""} + ${history.character_preset || ""}`;
+    const br = document.createElement("br");
+    const meta = document.createElement("span");
+    meta.textContent = `${history.created_at || ""} · ${(history.items || []).length}장`;
+    button.append(title, br, meta);
     button.onclick = () => {
       historyIndex = index;
       renderHistory();
@@ -834,7 +848,6 @@ function renderImageModalItem(item) {
   const position = modalItems.length > 1 ? ` (${modalIndex + 1} / ${modalItems.length})` : "";
   $("#modalTitle").textContent = `${item.source_label || item.created_at || "이미지"}${position}`;
   $("#modalSubtitle").textContent = [item.source_base_preset, item.source_character_preset].filter(Boolean).join(" + ");
-  $("#modalPrompt").textContent = item.prompt || "";
   const artistList = $("#modalArtists");
   artistList.innerHTML = "";
   for (const row of artistWeightRows(item.artists || [])) artistList.appendChild(row);
@@ -1041,6 +1054,7 @@ function setBattingRunning(running, cancelling = false) {
 
 async function startBattingTest() {
   syncEditorsToState();
+  if (!confirmCustomEndpointTokenUse()) return;
   if (!currentFixedArtists().length) {
     window.alert("타율 테스트는 작가태그 가중치를 고정한 상태에서 실행하는 기능입니다. 먼저 히스토리나 가중치 비교에서 가중치를 불러와 주세요.");
     return;
@@ -1149,8 +1163,23 @@ function generationStateForRequest() {
   return requestState;
 }
 
+function shouldConfirmCustomEndpoint() {
+  const endpoint = String(state?.api?.endpoint || "").trim();
+  if (!endpoint || endpoint === defaultNovelAiEndpoint) return false;
+  return Boolean(state?.api?.token_saved || String($("#api_token")?.value || "").trim());
+}
+
+function confirmCustomEndpointTokenUse() {
+  if (!shouldConfirmCustomEndpoint()) return true;
+  return window.confirm(
+    "기본 NovelAI endpoint가 아닌 주소가 설정되어 있습니다.\n\n" +
+    "이미지 생성 시 API 토큰이 이 endpoint로 전송됩니다. 계속할까요?"
+  );
+}
+
 async function startGeneration() {
   syncEditorsToState();
+  if (!confirmCustomEndpointTokenUse()) return;
   setProgressActive(true);
   $("#jobLog").textContent = "생성 작업을 시작합니다...\n";
   if (currentFixedArtists().length) $("#jobLog").textContent = "고정 작가가중치로 생성 작업을 시작합니다...\n";
@@ -1431,6 +1460,14 @@ function deleteChar() {
 function bindAutosaveInputs(root = document) {
   root.querySelectorAll("input, textarea, select").forEach((node) => {
     if (node.id === "compareHistorySelect") return;
+    if (node.id === "api_token") {
+      node.oninput = null;
+      node.onchange = () => {
+        syncEditorsToState();
+        scheduleSave();
+      };
+      return;
+    }
     node.oninput = () => {
       syncEditorsToState();
       if (node.id === "catTags") renderRecognizedTags();

package/web_app.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import mimetypes
 import random
+import secrets
 import shutil
 import sys
 import threading
@@ -25,11 +26,17 @@ from app import (
     NovelAIClient,
     PromptPreset,
     float_range,
+    has_saved_api_token,
+    load_api_token,
     load_state,
     now_id,
+    output_ref,
     parse_artist_tags,
     safe_path_name,
+    save_api_token,
     save_state,
+    sanitize_history_entry,
+    sanitize_history_item,
     weight_tag,
 )
 
@@ -37,6 +44,7 @@ from app import (
 WEB_DIR = APP_DIR / "web"
 JOBS: dict[str, dict] = {}
 STATE_LOCK = threading.Lock()
+LOCAL_API_TOKEN = secrets.token_urlsafe(32)
 
 
 def dataclass_from_dict(cls, data: dict):
@@ -72,27 +80,42 @@ def state_from_dict(data: dict) -> AppState:
 
 def media_url(path: str) -> str:
     try:
-        rel = Path(path).resolve().relative_to(OUTPUT_DIR.resolve())
+        raw = str(path or "")
+        candidate = Path(raw)
+        root = OUTPUT_DIR.resolve()
+        resolved = candidate.resolve() if candidate.is_absolute() else (root / candidate).resolve()
+        rel = resolved.relative_to(root)
     except (ValueError, OSError):
         return ""
     return "/media/" + urllib.parse.quote(str(rel).replace("\\", "/"))
 
 
+def safe_child_path(root: Path, rel: str) -> Path | None:
+    try:
+        root_resolved = root.resolve()
+        child = (root_resolved / urllib.parse.unquote(rel)).resolve()
+        child.relative_to(root_resolved)
+        return child
+    except (ValueError, OSError):
+        return None
+
+
 def state_payload(state: AppState) -> dict:
     data = asdict(state)
+    data.setdefault("api", {})["token"] = ""
+    data["api"]["token_saved"] = has_saved_api_token()
+    data["history"] = [sanitize_history_entry(item) for item in data.get("history", [])]
     for category in data.get("categories", []):
         category["recognized_tags"] = parse_artist_tags(category.get("tags", []))
     for history in data.get("history", []):
         for item in history.get("items", []):
             item["image_url"] = media_url(item.get("path", ""))
-            item["request_url"] = media_url(item.get("request_path", ""))
     return data
 
 
 def item_payload(item: dict) -> dict:
-    data = dict(item)
+    data = sanitize_history_item(item)
     data["image_url"] = media_url(data.get("path", ""))
-    data["request_url"] = media_url(data.get("request_path", ""))
     return data
 
 
@@ -186,6 +209,12 @@ def build_prompt(state: AppState) -> tuple[str, str, str, list[dict]]:
 
 def save_incoming_state(data: dict) -> AppState:
     state = state_from_dict(data)
+    incoming_token = str((data.get("api", {}) or {}).get("token", "") or "").strip()
+    if incoming_token:
+        save_api_token(incoming_token)
+        state.api.token = incoming_token
+    else:
+        state.api.token = load_api_token()
     with STATE_LOCK:
         current = load_state()
         state.history = current.history
@@ -207,7 +236,8 @@ def delete_history_entries(ids: list[str], delete_files: bool) -> AppState:
             if not raw_dir:
                 continue
             try:
-                target = Path(raw_dir).resolve()
+                raw_path = Path(raw_dir)
+                target = raw_path.resolve() if raw_path.is_absolute() else (OUTPUT_DIR / raw_path).resolve()
             except OSError:
                 continue
             if target == output_root or output_root not in target.parents:
@@ -244,11 +274,7 @@ def run_generation(job_id: str, state: AppState) -> None:
         prompt, negative, uc_prompt, artists = build_prompt(state)
         path = out_dir / f"image_{idx + 1:03}.png"
         metadata = {
-            "path": str(path),
-            "request_path": str(path.with_name(path.stem + "_request.json")),
-            "prompt": prompt,
-            "negative_prompt": negative,
-            "uc_prompt": uc_prompt,
+            "path": output_ref(str(path)),
             "artists": artists,
             "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
         }
@@ -266,7 +292,7 @@ def run_generation(job_id: str, state: AppState) -> None:
         "base_preset": base.name if base else "",
         "character_preset": character.name if character else "",
         "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
-        "output_dir": str(out_dir),
+        "output_dir": output_ref(str(out_dir)),
         "items": items,
     }
     update = {
@@ -346,11 +372,7 @@ def run_batting_test(job_id: str, state: AppState) -> None:
             prompt, negative, uc_prompt, artists = build_prompt(current)
             path = scene_dir / f"image_{image_index + 1:03}.png"
             metadata = {
-                "path": str(path),
-                "request_path": str(path.with_name(path.stem + "_request.json")),
-                "prompt": prompt,
-                "negative_prompt": negative,
-                "uc_prompt": uc_prompt,
+                "path": output_ref(str(path)),
                 "artists": artists,
                 "scene_name": scene_name,
                 "scene_index": scene_index,
@@ -376,7 +398,7 @@ def run_batting_test(job_id: str, state: AppState) -> None:
         "base_preset": "타율 테스트",
         "character_preset": f"{len(scenes)}개 씬",
         "created_at": time.strftime("%Y-%m-%d %H:%M:%S"),
-        "output_dir": str(out_dir),
+        "output_dir": output_ref(str(out_dir)),
         "scenes": [asdict(scene) for scene in scenes],
         "items": items,
     }
@@ -424,27 +446,57 @@ class Handler(BaseHTTPRequestHandler):
         self.end_headers()
         self.wfile.write(body)
 
+    def send_index(self) -> None:
+        path = WEB_DIR / "index.html"
+        if not path.exists() or not path.is_file():
+            self.send_error(404)
+            return
+        token_script = f"<script>window.__NAI_ACLAB_TOKEN__ = {json.dumps(LOCAL_API_TOKEN)};</script>"
+        html = path.read_text(encoding="utf-8").replace("</head>", f"    {token_script}\n  </head>")
+        body = html.encode("utf-8")
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def authorized_api_request(self) -> bool:
+        return self.headers.get("X-NAI-ACLAB-Token", "") == LOCAL_API_TOKEN
+
     def do_GET(self) -> None:
         parsed = urllib.parse.urlparse(self.path)
         route = parsed.path
         if route == "/":
-            self.send_file(WEB_DIR / "index.html")
+            self.send_index()
         elif route.startswith("/web/"):
-            self.send_file((WEB_DIR / route.removeprefix("/web/")).resolve())
+            path = safe_child_path(WEB_DIR, route.removeprefix("/web/"))
+            if not path:
+                self.send_error(403)
+                return
+            self.send_file(path)
         elif route == "/api/state":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             self.send_json({"state": state_payload(load_state())})
         elif route == "/api/preview":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             state = load_state()
             prompt, negative, uc_prompt, artists = build_prompt(state)
             self.send_json({"prompt": prompt, "negative": negative, "uc": uc_prompt, "artists": artists})
         elif route == "/api/job":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             query = urllib.parse.parse_qs(parsed.query)
             job_id = query.get("id", [""])[0]
             self.send_json({"job": JOBS.get(job_id, {"status": "missing"})})
         elif route.startswith("/media/"):
-            rel = urllib.parse.unquote(route.removeprefix("/media/"))
-            path = (OUTPUT_DIR / rel).resolve()
-            if not str(path).startswith(str(OUTPUT_DIR.resolve())):
+            path = safe_child_path(OUTPUT_DIR, route.removeprefix("/media/"))
+            if not path:
                 self.send_error(403)
                 return
             self.send_file(path)
@@ -454,6 +506,9 @@ class Handler(BaseHTTPRequestHandler):
     def do_POST(self) -> None:
         parsed = urllib.parse.urlparse(self.path)
         route = parsed.path
+        if route.startswith("/api/") and not self.authorized_api_request():
+            self.send_error(403)
+            return
         data = self.read_json()
         if route == "/api/state":
             state = save_incoming_state(data.get("state", data))