TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-09 23:21:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

[api] fix(security): bound API-owned uploads (#56)

Browse Source 
Co-authored-by: Nexi (CWN) <communityshieldofficial@gmail.com>
This commit is contained in:
Nexi
2026-09-09 22:24:02 +01:00
committed by GitHub
parent 87a1cd6b55
commit 438475e326
8 changed files with 138 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/README.md
+2
View File
@@ -8,6 +8,8 @@ API surface. Database-backed queries and on-disk JSON files are stubbed for now
- **Auth-gated routes** validate the Bearer JWT issued by the `auth` worker
(same dev secret, see `src/jwt.ts`) and 401 when it's missing/invalid.
- **API-owned uploads** enforce `RECFLARE_MAX_API_UPLOAD_BYTES` per file (64 MiB
by default) before copying a parsed file into an `ArrayBuffer` or writing it to R2.
- **Static data** is served verbatim:
- `src/default-avatar-items.ts` → `GET /api/avatar/v4/items`
- `src/default-settings.ts` → `GET /api/settings/v2`