PastilhasandClaude Opus 5
1597fccd75
Exposes sharp and ffprobe with their own vocabulary — operations are named what sharp names them, ffprobe fields come back spelled the way ffprobe spells them — so the tools' own documentation applies and there is no house dialect to learn. Safety comes from one architectural invariant rather than from filtering: the caller never supplies a path, a URL or a protocol. Input is an id we issued, output is a name we chose. That removes the entire class of attack that makes "just pass the flags through" a remote shell, which is precisely what makes it safe to open up everything else. docs/SECURITY.md has the reasoning and the specific attacks. The vocabulary is a data table, so the validator and docs/SHARP.md are generated from one source and cannot drift. Two things are deliberately absent from it: withMetadata, because that is how a client's GPS coordinates get published, and limitInputPixels, because a caller who could raise it could turn a 1 KB PNG into a 40 GB allocation. Verified against a running server, not asserted: traversal ids rejected, unknown operations and typo'd parameters rejected by name, out-of-range values rejected with the bound, a GPS-tagged photo coming out clean end to end, video probe, Range requests, and a rejected upload leaving nothing on disk. Found while building: config threw at import if AV_CLUB_TOKEN was unset, so generating documentation required a production secret. The token is read at boot in server.ts now — still a refusal to start, no longer a module-scope landmine. ffmpeg is designed in docs/API.md and not built yet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
18 lines
643 B
Bash
18 lines
643 B
Bash
# Copy to .env and fill in. The service refuses to start without AV_CLUB_TOKEN.
|
|
|
|
# The bearer token every request must carry. Generate with:
|
|
# openssl rand -hex 32
|
|
AV_CLUB_TOKEN=
|
|
|
|
AV_CLUB_PORT=3020
|
|
|
|
# Where stored assets live. Deliberately NOT inside the repo: a deploy that replaces the working
|
|
# tree would otherwise delete every original ever uploaded, silently.
|
|
# AV_CLUB_ASSETS_DIR=/var/lib/av-club/assets
|
|
|
|
# Limits. Each exists because its absence is a denial of service — see docs/SECURITY.md.
|
|
# AV_CLUB_MAX_UPLOAD_BYTES=536870912
|
|
# AV_CLUB_JOB_TIMEOUT_MS=120000
|
|
# AV_CLUB_MAX_OUTPUT_DIMENSION=16383
|
|
# AV_CLUB_MAX_CONCURRENT_JOBS=2
|