fix(security): close LLM-abuse gaps on /api/ask

Three ways a user could run up paid Gemini calls beyond the 5/day cap, now fixed:
1. IP spoofing — getClientIp keyed off the client-controllable left-most
   x-forwarded-for, so X-Forwarded-For:<random> minted a fresh 5/day each
   request. Prefer platform-set x-real-ip; never trust the spoofable first hop.
2. No per-call input cap — one request could send a huge context map/question.
   Reject >2000-char questions / >400 files / >120k signature chars with 413.
3. No global ceiling — per-IP limits can't stop a botnet cycling IPs. Add a hard
   daily cap (GLOBAL_ASK_LIMIT=1000) across all users as a circuit breaker.
Adds vitest.config alias + 3 spoof-resistance tests (17 total).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: manojmallick

src/app/api/ask/route.ts

@@ -1,11 +1,23 @@
 import { NextResponse } from "next/server";
 import { askCodebase, GeminiError } from "@/lib/gemini";
-import { ASK_LIMIT, checkAskLimit, getClientIp } from "@/lib/ratelimit";
+import {
+  ASK_LIMIT,
+  checkAskLimit,
+  checkGlobalAskBudget,
+  getClientIp,
+} from "@/lib/ratelimit";
 import type { ApiError, AskRequest, AskResult } from "@/lib/types";
 
 export const runtime = "nodejs";
 export const maxDuration = 60;
 
+// Per-call input caps — bound the cost/latency of a single (paid) Gemini call so
+// one request within the daily quota can't send a giant payload. A real SigMap
+// context map is tiny (that's the point), so these are generous.
+const MAX_QUESTION_CHARS = 2000;
+const MAX_CONTEXT_FILES = 400;
+const MAX_SIGNATURE_CHARS = 120_000;
+
 export async function POST(
   request: Request
 ): Promise<NextResponse<AskResult | ApiError>> {
@@ -16,13 +28,31 @@ export async function POST(
     return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
   }
 
-  if (!body?.contextMap || !body?.question?.trim()) {
+  const question = body?.question?.trim();
+  if (!body?.contextMap || !question) {
     return NextResponse.json(
       { error: "A context map and a question are required." },
       { status: 400 }
     );
   }
 
+  // Reject oversized input before spending a Gemini call.
+  const files = body.contextMap.files ?? [];
+  const sigChars = files.reduce(
+    (n, f) => n + (f.signatures?.join("").length ?? 0),
+    0
+  );
+  if (
+    question.length > MAX_QUESTION_CHARS ||
+    files.length > MAX_CONTEXT_FILES ||
+    sigChars > MAX_SIGNATURE_CHARS
+  ) {
+    return NextResponse.json(
+      { error: "Request too large. Trim the question or context map." },
+      { status: 413 }
+    );
+  }
+
   const limit = await checkAskLimit(getClientIp(request));
   if (!limit.ok) {
     return NextResponse.json(
@@ -34,8 +64,20 @@ export async function POST(
     );
   }
 
+  // Global circuit breaker: hard daily cap on paid calls across all users.
+  if (!(await checkGlobalAskBudget())) {
+    return NextResponse.json(
+      {
+        error:
+          "The demo has hit today's shared question capacity. Try again " +
+          "tomorrow, or run `npx sigmap ask` locally.",
+      },
+      { status: 429 }
+    );
+  }
+
   try {
-    const result = await askCodebase(body.contextMap, body.question);
+    const result = await askCodebase(body.contextMap, question);
     return NextResponse.json(result);
   } catch (err) {
     if (err instanceof GeminiError) {

src/lib/ratelimit.test.ts

@@ -0,0 +1,25 @@
+import { describe, it, expect } from "vitest";
+import { getClientIp } from "./ratelimit";
+
+const req = (headers: Record<string, string>) =>
+  new Request("https://example.com", { headers });
+
+describe("getClientIp — spoof resistance", () => {
+  it("prefers the platform-set x-real-ip over x-forwarded-for", () => {
+    expect(
+      getClientIp(req({ "x-real-ip": "9.9.9.9", "x-forwarded-for": "1.2.3.4" }))
+    ).toBe("9.9.9.9");
+  });
+
+  it("ignores a client-spoofed left-most x-forwarded-for (uses the last hop)", () => {
+    // Attacker prepends a fake IP to mint a fresh identity; with no x-real-ip we
+    // must NOT return the spoofable first entry.
+    const ip = getClientIp(req({ "x-forwarded-for": "6.6.6.6, 203.0.113.7" }));
+    expect(ip).not.toBe("6.6.6.6");
+    expect(ip).toBe("203.0.113.7");
+  });
+
+  it("falls back to 0.0.0.0 when no forwarding headers are present", () => {
+    expect(getClientIp(req({}))).toBe("0.0.0.0");
+  });
+});

src/lib/ratelimit.ts

@@ -35,11 +35,40 @@ export interface LimitResult {
   enforced: boolean;
 }
 
-/** Best-effort client IP from Vercel's forwarding headers. */
+/**
+ * Client IP for rate-limit keys — spoof-resistant.
+ *
+ * On Vercel, `x-real-ip` is set by the platform to the real connecting IP and
+ * is NOT overridable by the client. The LEFT-most `x-forwarded-for` entry is
+ * client-supplied, so a user can send `X-Forwarded-For: <random>` to mint a
+ * fresh identity every request and dodge per-IP limits — never key off it.
+ * Prefer `x-real-ip`; only fall back to the LAST forwarded hop off-Vercel.
+ */
 export function getClientIp(req: Request): string {
+  const real = req.headers.get("x-real-ip")?.trim();
+  if (real) return real;
   const xff = req.headers.get("x-forwarded-for");
-  if (xff) return xff.split(",")[0].trim();
-  return req.headers.get("x-real-ip") ?? "0.0.0.0";
+  if (xff) {
+    const hops = xff.split(",").map((s) => s.trim()).filter(Boolean);
+    return hops[hops.length - 1] || "0.0.0.0";
+  }
+  return "0.0.0.0";
+}
+
+/** Hard daily ceiling on paid LLM calls across ALL users (distributed-abuse cap). */
+export const GLOBAL_ASK_LIMIT = 1000;
+
+/**
+ * Circuit breaker: caps total Ask (Gemini) calls per day across every visitor.
+ * Per-IP limits can't stop a botnet cycling IPs; this bounds the worst-case
+ * spend. Increments a daily counter and returns false once the ceiling is hit.
+ */
+export async function checkGlobalAskBudget(): Promise<boolean> {
+  if (!redis) return true;
+  const key = `rl:ask:global:${utcDay()}`;
+  const n = await redis.incr(key);
+  if (n === 1) await redis.expire(key, 60 * 60 * 48);
+  return n <= GLOBAL_ASK_LIMIT;
 }
 
 function utcDay(): string {

vitest.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "vitest/config";
+import { fileURLToPath } from "node:url";
+
+export default defineConfig({
+  resolve: {
+    // Mirror the "@/*" → "src/*" path alias from tsconfig so tests can import
+    // modules the same way app code does.
+    alias: { "@": fileURLToPath(new URL("./src", import.meta.url)) },
+  },
+});