64cf9c330d
The encrypted .infiplot format (AES-256-GCM via GALLERY_SECRET) provided no meaningful security — the payload is AI-generated story content with no credentials or PII, and the project is open source. Replace with plaintext + SHA-256 integrity check (format v2). Story share is now always enabled without requiring a server secret. - galleryCrypto.ts: AES-256-GCM → plaintext + SHA-256 hash; remove secret param - 4 API routes: remove GALLERY_SECRET guard and 503 fallback - story-unpack: forward specific error messages (v1 compat, hash mismatch) - gallery/page.tsx: remove stale AES-GCM comment - AGENTS.md: document gallery-pack/gallery-unpack routes - .env.example, wrangler.jsonc: remove GALLERY_SECRET references Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
37 lines
969 B
TypeScript
37 lines
969 B
TypeScript
import { packDoc } from "@/lib/galleryCrypto";
|
|
|
|
export const runtime = "nodejs";
|
|
|
|
const MAX_DOC_BYTES = 5_000_000;
|
|
|
|
export async function POST(req: Request): Promise<Response> {
|
|
let docStr: string;
|
|
try {
|
|
const body = (await req.json()) as { docStr?: unknown };
|
|
if (typeof body.docStr !== "string") {
|
|
return Response.json({ error: "Missing docStr" }, { status: 400 });
|
|
}
|
|
docStr = body.docStr;
|
|
} catch {
|
|
return Response.json({ error: "Bad JSON" }, { status: 400 });
|
|
}
|
|
|
|
if (new TextEncoder().encode(docStr).byteLength > MAX_DOC_BYTES) {
|
|
return Response.json(
|
|
{ error: "图集数据太大,无法打包分享" },
|
|
{ status: 413 },
|
|
);
|
|
}
|
|
|
|
const bytes = await packDoc(docStr);
|
|
const ab = new ArrayBuffer(bytes.byteLength);
|
|
new Uint8Array(ab).set(bytes);
|
|
return new Response(ab, {
|
|
status: 200,
|
|
headers: {
|
|
"Content-Type": "application/octet-stream",
|
|
"Cache-Control": "no-store",
|
|
},
|
|
});
|
|
}
|