9d43e4b113
CRITICAL — Authentication & Access: - TOTP MFA: otpauth-based, QR setup UI, sign-in flow integration, admin disable override, /account/security self-service page - Session Timeouts: 8h absolute (maxAge), 30min idle (updateAge) - Failed Auth Logging: Pino warn for invalid password/user/totp, info for successful login, audit entries for all auth events - Concurrent Session Limit: ActiveSession model, oldest-kick strategy, max 3 per user (configurable in SystemSettings) CRITICAL — HTTP Security: - HSTS: max-age=31536000; includeSubDomains - CSP: script/style/img/font/connect-src with Gemini/OpenAI whitelist - X-XSS-Protection: 0 (CSP replaces legacy) - Auth page cache: no-store, no-cache, must-revalidate - Rate Limiting: 100/15min general API, 5/15min auth (Map-based) Data Protection: - XSS Sanitization: DOMPurify on comment bodies - autocomplete="new-password" on all password/secret fields - SameSite=Strict on all cookies (Credentials-only, no OAuth) - File Upload Magic Bytes validation (PNG/JPEG/WebP/GIF/BMP/TIFF) Logging & Monitoring: - Login/Logout audit entries (Auth entityType) - External API call logging with timing (OpenAI, Gemini) - Input validation failure logging at warn level - Concurrent session tracking in ActiveSession table Documentation: - docs/security-architecture.md (11 sections) - docs/sdlc.md (CI pipeline, security gates, incident response) - .gitea/PULL_REQUEST_TEMPLATE.md (security checklist) Schema: User.totpSecret/totpEnabled, SystemSettings.sessionMaxAge/ sessionIdleTimeout/maxConcurrentSessions, ActiveSession model Tests: 310 engine + 37 staffing pass. TypeScript clean. Co-Authored-By: claude-flow <ruv@ruv.net>
103 lines
3.7 KiB
TypeScript
103 lines
3.7 KiB
TypeScript
import { logger } from "./lib/logger.js";
|
|
|
|
type GeminiSettings = {
|
|
geminiApiKey?: string | null;
|
|
geminiModel?: string | null;
|
|
};
|
|
|
|
/** Returns true if the settings have a Gemini API key configured. */
|
|
export function isGeminiConfigured(settings: GeminiSettings | null | undefined): boolean {
|
|
return !!settings?.geminiApiKey;
|
|
}
|
|
|
|
/**
|
|
* Generates an image using the Google Gemini API.
|
|
* @returns A base64 data URL of the generated image.
|
|
*/
|
|
export async function generateGeminiImage(
|
|
apiKey: string,
|
|
prompt: string,
|
|
model = "gemini-2.5-flash-image",
|
|
): Promise<string> {
|
|
const fullPrompt = `Generate a professional, cinematic cover image for a 3D production project. ${prompt}`;
|
|
const start = performance.now();
|
|
|
|
const response = await fetch(
|
|
`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${apiKey}`,
|
|
{
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({
|
|
contents: [{ parts: [{ text: fullPrompt }] }],
|
|
generationConfig: { responseModalities: ["TEXT", "IMAGE"] },
|
|
}),
|
|
},
|
|
);
|
|
|
|
if (!response.ok) {
|
|
const responseTimeMs = Math.round(performance.now() - start);
|
|
const body = await response.text();
|
|
let msg = body;
|
|
try {
|
|
const parsed = JSON.parse(body) as { error?: { message?: string } };
|
|
if (parsed.error?.message) msg = parsed.error.message;
|
|
} catch {
|
|
/* keep raw */
|
|
}
|
|
logger.warn({ provider: "gemini", model, promptLength: fullPrompt.length, responseTimeMs, status: response.status }, "External API call failed");
|
|
throw new Error(`HTTP ${response.status}: ${msg}`);
|
|
}
|
|
|
|
const data = (await response.json()) as {
|
|
candidates?: Array<{
|
|
content?: {
|
|
parts?: Array<{
|
|
inlineData?: { data: string; mimeType: string };
|
|
text?: string;
|
|
}>;
|
|
};
|
|
}>;
|
|
};
|
|
|
|
const imagePart = data.candidates?.[0]?.content?.parts?.find(
|
|
(p) => p.inlineData,
|
|
);
|
|
|
|
if (!imagePart?.inlineData?.data) {
|
|
throw new Error("No image data returned from Gemini");
|
|
}
|
|
|
|
const responseTimeMs = Math.round(performance.now() - start);
|
|
logger.info({ provider: "gemini", model, promptLength: fullPrompt.length, responseTimeMs }, "External API call");
|
|
|
|
const base64 = imagePart.inlineData.data;
|
|
const mimeType = imagePart.inlineData.mimeType ?? "image/png";
|
|
return `data:${mimeType};base64,${base64}`;
|
|
}
|
|
|
|
/** Turns Gemini API errors into actionable human-readable messages. */
|
|
export function parseGeminiError(err: unknown): string {
|
|
const msg = err instanceof Error ? err.message : String(err);
|
|
const lower = msg.toLowerCase();
|
|
|
|
if (lower.includes("400") || lower.includes("invalid")) {
|
|
return "Invalid request — check the Gemini model name and prompt.";
|
|
}
|
|
if (lower.includes("401") || lower.includes("unauthorized") || lower.includes("api_key_invalid") || lower.includes("api key not valid")) {
|
|
return "Invalid API key — make sure you copied it correctly from Google AI Studio.";
|
|
}
|
|
if (lower.includes("403") || lower.includes("forbidden") || lower.includes("permission")) {
|
|
return "Access denied — your API key may not have permission to use image generation.";
|
|
}
|
|
if (lower.includes("404") || lower.includes("not found")) {
|
|
return "Model not found — verify the Gemini model name is correct.";
|
|
}
|
|
if (lower.includes("429") || lower.includes("rate limit") || lower.includes("quota")) {
|
|
return "Rate limit or quota exceeded — wait a moment and try again.";
|
|
}
|
|
if (lower.includes("econnrefused") || lower.includes("enotfound") || lower.includes("fetch failed")) {
|
|
return "Cannot reach the Gemini API — check your network connection.";
|
|
}
|
|
return msg.replace(/^Error: /, "").slice(0, 300);
|
|
}
|