nai-aclab 1.0.3 → 1.0.4

package/README.md

@@ -125,6 +125,8 @@ API 토큰은 `app_state.json`에 저장하거나 `/api/state` 응답으로 다
 
 생성 히스토리에는 이미지 표시와 작가 가중치 비교에 필요한 최소 정보만 저장합니다. 최종 프롬프트, 네거티브 프롬프트, UC 프롬프트, 생성 요청 JSON, 로컬 절대 경로는 별도로 저장하지 않습니다. 이전 버전에서 생성된 `*_request.json` 파일은 앱 시작 시 자동으로 제거됩니다.
 
+로컬 API는 앱이 시작될 때 생성되는 임시 토큰으로 보호됩니다. 또한 기본 NovelAI endpoint가 아닌 주소로 이미지를 생성하려는 경우, API 토큰이 해당 endpoint로 전송된다는 확인창을 먼저 표시합니다.
+
 ## 저장 위치
 
 앱 상태, 생성 이미지, 요청 JSON은 아래 위치에 저장됩니다.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nai-aclab",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Local web UI for experimenting with NovelAI artist tag weight combinations.",
   "license": "MIT",
   "type": "commonjs",

package/web/main.js

@@ -56,6 +56,7 @@ const imageSizeOptions = {
   landscape: { label: "Landscape", width: 1216, height: 832 },
   square: { label: "Square", width: 1024, height: 1024 },
 };
+const defaultNovelAiEndpoint = "https://image.novelai.net/ai/generate-image";
 
 function escapeHtml(value) {
   return String(value ?? "")
@@ -109,9 +110,14 @@ function setSaveState(text) {
 }
 
 async function request(path, options = {}) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-NAI-ACLAB-Token": window.__NAI_ACLAB_TOKEN__ || "",
+    ...(options.headers || {}),
+  };
   const response = await fetch(path, {
-    headers: { "Content-Type": "application/json" },
     ...options,
+    headers,
   });
   if (!response.ok) throw new Error(await response.text());
   return response.json();
@@ -571,32 +577,30 @@ function renderImageCard(item, context = {}) {
   card.className = `image-card ${item.error ? "error" : ""}`;
   const enriched = enrichedImageItem(item, context);
   const modalList = context.modalItems || [enriched];
-  card.innerHTML = `
-    ${item.image_url ? `<img src="${item.image_url}" alt="generated image" />` : ""}
-    <div>${item.error ? item.error : item.created_at || "생성 완료"}</div>
-  `;
-  const img = card.querySelector("img");
-  if (img) img.onclick = () => openImageModal(enriched, modalList);
-  const meta = card.querySelector("div");
-  if (meta) {
-    const label = meta.textContent;
-    meta.className = "image-card-meta";
-    meta.textContent = "";
-    const labelNode = document.createElement("span");
-    labelNode.textContent = label;
-    meta.appendChild(labelNode);
-    if (canReuseArtists(item)) {
-      const button = document.createElement("button");
-      button.className = "mini-button artist-reuse-button";
-      button.type = "button";
-      button.textContent = "가중치 불러오기";
-      button.onclick = (event) => {
-        event.stopPropagation();
-        generateFromImage(enriched);
-      };
-      meta.appendChild(button);
-    }
+  if (item.image_url) {
+    const img = document.createElement("img");
+    img.src = item.image_url;
+    img.alt = "generated image";
+    img.onclick = () => openImageModal(enriched, modalList);
+    card.appendChild(img);
+  }
+  const meta = document.createElement("div");
+  meta.className = "image-card-meta";
+  const labelNode = document.createElement("span");
+  labelNode.textContent = item.error ? item.error : item.created_at || "생성 완료";
+  meta.appendChild(labelNode);
+  if (canReuseArtists(item)) {
+    const button = document.createElement("button");
+    button.className = "mini-button artist-reuse-button";
+    button.type = "button";
+    button.textContent = "가중치 불러오기";
+    button.onclick = (event) => {
+      event.stopPropagation();
+      generateFromImage(enriched);
+    };
+    meta.appendChild(button);
   }
+  card.appendChild(meta);
   return card;
 }
 
@@ -631,7 +635,12 @@ function renderHistory() {
     };
     const button = document.createElement("button");
     button.className = `list-item ${index === historyIndex ? "active" : ""}`;
-    button.innerHTML = `<strong>${history.base_preset} + ${history.character_preset}</strong><br><span>${history.created_at} · ${(history.items || []).length}장</span>`;
+    const title = document.createElement("strong");
+    title.textContent = `${history.base_preset || ""} + ${history.character_preset || ""}`;
+    const br = document.createElement("br");
+    const meta = document.createElement("span");
+    meta.textContent = `${history.created_at || ""} · ${(history.items || []).length}장`;
+    button.append(title, br, meta);
     button.onclick = () => {
       historyIndex = index;
       renderHistory();
@@ -1045,6 +1054,7 @@ function setBattingRunning(running, cancelling = false) {
 
 async function startBattingTest() {
   syncEditorsToState();
+  if (!confirmCustomEndpointTokenUse()) return;
   if (!currentFixedArtists().length) {
     window.alert("타율 테스트는 작가태그 가중치를 고정한 상태에서 실행하는 기능입니다. 먼저 히스토리나 가중치 비교에서 가중치를 불러와 주세요.");
     return;
@@ -1153,8 +1163,23 @@ function generationStateForRequest() {
   return requestState;
 }
 
+function shouldConfirmCustomEndpoint() {
+  const endpoint = String(state?.api?.endpoint || "").trim();
+  if (!endpoint || endpoint === defaultNovelAiEndpoint) return false;
+  return Boolean(state?.api?.token_saved || String($("#api_token")?.value || "").trim());
+}
+
+function confirmCustomEndpointTokenUse() {
+  if (!shouldConfirmCustomEndpoint()) return true;
+  return window.confirm(
+    "기본 NovelAI endpoint가 아닌 주소가 설정되어 있습니다.\n\n" +
+    "이미지 생성 시 API 토큰이 이 endpoint로 전송됩니다. 계속할까요?"
+  );
+}
+
 async function startGeneration() {
   syncEditorsToState();
+  if (!confirmCustomEndpointTokenUse()) return;
   setProgressActive(true);
   $("#jobLog").textContent = "생성 작업을 시작합니다...\n";
   if (currentFixedArtists().length) $("#jobLog").textContent = "고정 작가가중치로 생성 작업을 시작합니다...\n";

package/web_app.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import mimetypes
 import random
+import secrets
 import shutil
 import sys
 import threading
@@ -43,6 +44,7 @@ from app import (
 WEB_DIR = APP_DIR / "web"
 JOBS: dict[str, dict] = {}
 STATE_LOCK = threading.Lock()
+LOCAL_API_TOKEN = secrets.token_urlsafe(32)
 
 
 def dataclass_from_dict(cls, data: dict):
@@ -80,12 +82,24 @@ def media_url(path: str) -> str:
     try:
         raw = str(path or "")
         candidate = Path(raw)
-        rel = candidate.resolve().relative_to(OUTPUT_DIR.resolve()) if candidate.is_absolute() else Path(raw)
+        root = OUTPUT_DIR.resolve()
+        resolved = candidate.resolve() if candidate.is_absolute() else (root / candidate).resolve()
+        rel = resolved.relative_to(root)
     except (ValueError, OSError):
         return ""
     return "/media/" + urllib.parse.quote(str(rel).replace("\\", "/"))
 
 
+def safe_child_path(root: Path, rel: str) -> Path | None:
+    try:
+        root_resolved = root.resolve()
+        child = (root_resolved / urllib.parse.unquote(rel)).resolve()
+        child.relative_to(root_resolved)
+        return child
+    except (ValueError, OSError):
+        return None
+
+
 def state_payload(state: AppState) -> dict:
     data = asdict(state)
     data.setdefault("api", {})["token"] = ""
@@ -432,27 +446,57 @@ class Handler(BaseHTTPRequestHandler):
         self.end_headers()
         self.wfile.write(body)
 
+    def send_index(self) -> None:
+        path = WEB_DIR / "index.html"
+        if not path.exists() or not path.is_file():
+            self.send_error(404)
+            return
+        token_script = f"<script>window.__NAI_ACLAB_TOKEN__ = {json.dumps(LOCAL_API_TOKEN)};</script>"
+        html = path.read_text(encoding="utf-8").replace("</head>", f"    {token_script}\n  </head>")
+        body = html.encode("utf-8")
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def authorized_api_request(self) -> bool:
+        return self.headers.get("X-NAI-ACLAB-Token", "") == LOCAL_API_TOKEN
+
     def do_GET(self) -> None:
         parsed = urllib.parse.urlparse(self.path)
         route = parsed.path
         if route == "/":
-            self.send_file(WEB_DIR / "index.html")
+            self.send_index()
         elif route.startswith("/web/"):
-            self.send_file((WEB_DIR / route.removeprefix("/web/")).resolve())
+            path = safe_child_path(WEB_DIR, route.removeprefix("/web/"))
+            if not path:
+                self.send_error(403)
+                return
+            self.send_file(path)
         elif route == "/api/state":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             self.send_json({"state": state_payload(load_state())})
         elif route == "/api/preview":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             state = load_state()
             prompt, negative, uc_prompt, artists = build_prompt(state)
             self.send_json({"prompt": prompt, "negative": negative, "uc": uc_prompt, "artists": artists})
         elif route == "/api/job":
+            if not self.authorized_api_request():
+                self.send_error(403)
+                return
             query = urllib.parse.parse_qs(parsed.query)
             job_id = query.get("id", [""])[0]
             self.send_json({"job": JOBS.get(job_id, {"status": "missing"})})
         elif route.startswith("/media/"):
-            rel = urllib.parse.unquote(route.removeprefix("/media/"))
-            path = (OUTPUT_DIR / rel).resolve()
-            if not str(path).startswith(str(OUTPUT_DIR.resolve())):
+            path = safe_child_path(OUTPUT_DIR, route.removeprefix("/media/"))
+            if not path:
                 self.send_error(403)
                 return
             self.send_file(path)
@@ -462,6 +506,9 @@ class Handler(BaseHTTPRequestHandler):
     def do_POST(self) -> None:
         parsed = urllib.parse.urlparse(self.path)
         route = parsed.path
+        if route.startswith("/api/") and not self.authorized_api_request():
+            self.send_error(403)
+            return
         data = self.read_json()
         if route == "/api/state":
             state = save_incoming_state(data.get("state", data))