vrr/supermemory
2
0
Fork 0
mirror of https://github.com/supermemoryai/supermemory.git synced 2026-08-26 17:02:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
supermemory/apps/web/lib
History
Exact
MaheshtheDev 3b0fc9c959 fix(web): authenticate and bound metered /api routes (#1589) 
Cherry-picks #1579 and #1580 from @Sravanjangam (security audit #1578), plus improvements on top.

- `/api/og`, `/api/onboarding/extract-content` and `/api/onboarding/research` now verify the session against the auth backend; the middleware only checked that a cookie was present, so a forged cookie reached handlers that spend metered Exa/xAI quota.
- Bounds those routes: 2MB cap on fetched HTML, max 10 http(s) URLs per request, name/email length limits and a 60s timeout on the LLM call.
- De-duplicates URLs before calling Exa, and collapses whitespace in `name`/`email` so a newline can't forge extra prompt lines. Both adapted from @SEPURI-SAI-KRISHNA's #1528 and #1530.
- Deletes the unused, unauthenticated `account-status` route.

Verified locally: pre-fix `/api/og` returned 200 for a forged cookie, post-fix it returns 401. Five duplicate URLs collapse to two before reaching Exa, and a newline-laden `name` arrives as a single prompt line.

Supersedes #1528 and #1530.
2026-08-23 21:48:46 +00:00
..
agent-space.test.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
agent-space.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
analytics.ts feat(web): take a card before the Company Brain trial starts (#1459) 2026-08-13 06:58:47 +00:00
billing-utils.ts refactor(brain): one isCompanyBrainOrg helper in the web app (#1535) 2026-08-18 23:13:12 +00:00
chat-auto-space.ts Update chat empty state and Auto space mode (#954) 2026-05-16 23:55:34 -07:00
chat-highlight-documents.ts Draft: Add chat source annotations (#1165) 2026-06-26 20:51:40 -07:00
chat-memory-tools.test.ts Draft: Add chat source annotations (#1165) 2026-06-26 20:51:40 -07:00
chat-memory-tools.ts Draft: Add chat source annotations (#1165) 2026-06-26 20:51:40 -07:00
chat-search-memory-results.ts feat: web search and improve chat with tools (#810) 2026-03-27 01:57:13 +00:00
chat-space-label.ts fix: space selector dropdown (#898) 2026-05-04 17:15:10 +00:00
chat-stream-error.ts Upgrade Nova model picker to current runtime models (#1404) 2026-08-13 17:08:50 +05:30
chat-web-search-tools.ts feat: web search and improve chat with tools (#810) 2026-03-27 01:57:13 +00:00
company-brain-entry.ts refactor(brain): one isCompanyBrainOrg helper in the web app (#1535) 2026-08-18 23:13:12 +00:00
configure-routes.ts feat(web): add Company Brain skills settings (#1322) 2026-08-02 05:36:32 +00:00
constants.ts fix: redirect new users to onboarding from plugin connect page (#908) 2026-05-11 10:57:43 -07:00
extract-urls.test.ts fix(web): stop extractUrls treating email addresses as URLs (#1187) 2026-07-10 19:14:57 -07:00
file-cache.ts implement Nova chat attachments on the web side (#1004) 2026-06-08 06:18:28 +00:00
fonts.ts feat: deep-research on user profile and tiptap integration (#672) 2026-01-15 21:53:53 +00:00
ingest-auto-space.ts Brand own space as Nova chats (#957) 2026-05-17 00:25:22 -07:00
integration-routes.ts feat(web): make /integrations a real route with connect deeplinks (#1155) 2026-06-23 20:42:29 +00:00
mcp-client-setup.ts docs: restructure documentation site and update integration UI (#1331) 2026-07-21 20:19:30 -07:00
mcp-directory.ts feat(web): add MCP connector directory (#1461) 2026-08-20 22:58:39 +00:00
mcp-icon-domains.json feat(web): add MCP connector directory (#1461) 2026-08-20 22:58:39 +00:00
mcp-manual-instructions.ts MCP Revamp (#1120) (#1380) 2026-07-30 17:08:51 -07:00
models.tsx Upgrade Nova model picker to current runtime models (#1404) 2026-08-13 17:08:50 +05:30
oauth-plugins.ts feat(web): MCP OAuth consent page (#1118) 2026-06-16 17:33:09 +00:00
plugin-catalog.ts docs: restructure documentation site and update integration UI (#1331) 2026-07-21 20:19:30 -07:00
plugin-document.test.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
plugin-document.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
plugin-space.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
reviewer-password-login.ts validate MCP OAuth login flow (#1395) 2026-08-01 05:15:22 +00:00
search-params.ts feat(web): add Cursor to Agents (#1361) 2026-07-25 22:09:28 +00:00
source-annotations.test.ts Draft: Add chat source annotations (#1165) 2026-06-26 20:51:40 -07:00
source-annotations.ts Draft: Add chat source annotations (#1165) 2026-06-26 20:51:40 -07:00
theme-provider.tsx feat: layout design with theme improvements (#443) 2025-10-01 21:59:54 +00:00
url-helpers.test.ts fix(web): match YouTube URLs by hostname instead of substring (#1182) 2026-07-10 16:20:18 -07:00
url-helpers.ts fix(web): use backend URL fallback for direct fetches (#1212) 2026-07-10 20:02:24 -07:00
variants.ts chore: delete document, document ui (#673) 2026-01-16 21:44:26 +00:00
verify-session.ts fix(web): authenticate and bound metered /api routes (#1589) 2026-08-23 21:48:46 +00:00
view-mode-context.tsx feat(web): give Configure sections real routes under /configure (#1378) 2026-07-30 19:27:36 +00:00