Changeset 74c5abc in Klonkt for src/server.js

Timestamp:

06/28/2026 04:46:38 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

99989f9

Parents:

f79a471

Message:

feat(images): downscale remote (fediverse) avatars via a signed proxy

Remote avatars live on other servers, so the browser shrank full-res line-art to ~44px
(jagged). Fetch them once (SSRF-safe via safeFetch), downscale identically (lanczos -> WebP),
cache, serve. HMAC-signed proxy URLs → not an open resizer.

• services/ActivityPubService.js — export safeFetch
• services/ThumbnailService.js — getRemoteThumbnail + signed imgProxyUrl/verifyImg; +128px size
• server.js — GET /img/a/:w signed proxy route
• middleware/render.js — avatar(url,w) helper (local thumb / remote proxy)
• views: news.ejs, fedi-node.ejs, following.ejs avatars -> avatar()

File:

• src/server.js (modified) (2 diffs)

src/server.js

@@ -20 +20 @@
 import { SqliteSessionStore } from './services/SqliteSessionStore.js';
 import { ensurePrimarySite } from './services/ensurePrimarySite.js';
-import { getThumbnail, THUMB_SIZES } from './services/ThumbnailService.js';
+import { getThumbnail, getRemoteThumbnail, verifyImg, THUMB_SIZES } from './services/ThumbnailService.js';
 import { resolveSite, loadAudioTracks, loadTheme } from './middleware/site.js';
 import { isViewer } from './middleware/auth.js';
@@ -234 +234 @@
 });
 
+// Signed remote-image proxy: downscale a REMOTE avatar/image (SSRF-safe via safeFetch)
+// to a cached WebP, so line-art fediverse avatars don't render jagged. Only HMAC-signed
+// URLs (produced by the avatar() view helper) are accepted — not an open resizer.
+app.get('/img/a/:w', async (req, res) => {
+  const w = parseInt(req.params.w, 10);
+  const url = typeof req.query.u === 'string' ? req.query.u : '';
+  const sig = typeof req.query.s === 'string' ? req.query.s : '';
+  if (!THUMB_SIZES.has(w) || !verifyImg(url, w, sig)) return res.status(400).end();
+  let file = null;
+  try { file = await getRemoteThumbnail(url, w); } catch { /* fall through to original */ }
+  if (!file) return res.redirect(302, url); // fetch/downscale failed → let the browser load the remote original
+  res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+  res.setHeader('Cache-Control', isDev ? 'no-cache' : 'public, max-age=604800');
+  res.type('webp');
+  res.sendFile(file);
+});
+
 app.use('/media', express.static(process.env.MEDIA_PATH || './storage/media', {
   // Public media (post covers, avatars) must be cross-origin embeddable by other