Close the door the edge gate used to hold

A security review of the whole repo. The queries were already scoped, the
OIDC flow already did state and nonce and PKCE, the session tokens were
already stored as hashes. What it found was mostly the seam between the
code and the deployment — and one place where the deployment quietly
undid the code.

The one that matters: with any AUTHENTIK_* variable missing, Petal fell
back to resolving every request to the single `local` user. That is right
on a laptop and a catastrophe on a public host, and Phase 16 removed the
Traefik basic-auth gate that used to stand behind the mistake. A typo in
the client secret would have served her journals to the open internet and
said so only in a log line nobody reads. It now refuses to start, guarded
by default for any BASE_URL that isn't loopback.

Then the one that would have been fixed and wasn't: stored images now
serve under `default-src 'none'; sandbox`, so an SVG pasted into a
document can't run as a page on Petal's own origin. Traefik's
customresponseheaders *overwrites*, so the CSP declared in the compose
labels would have silently replaced that per-route policy in production.
The whole header block moved into the binary, where a route can tighten
its own and a test can prove it; only HSTS stays at the edge, where TLS
actually terminates.

The rest, smaller:

  - PETAL_ALLOWED_SUBS empty means everyone authentik authenticates, and
    authentik here fronts half a dozen applications. Still legal, now
    said out loud every boot, and set in both env examples.
  - LLM failures relayed err.Error() to the browser, which carries the
    address of the inference box on the far side of the VPN. Logged
    instead; the client only ever rendered "the helper is resting".
  - Exports scheme-check their links. Escaping makes a URL safe to sit
    in an attribute and says nothing about following it, and an export
    is the one artifact here meant to leave. Writing the test found the
    markdown image src, which I'd missed reading it.
  - The draft rescue is namespaced per account and cleared on sign-out.
    Everything else in localStorage is a preference; this is her unsaved
    writing, sitting in a profile two people share.
  - /auth/logout is POST-only. With SameSite=Lax a GET route lets any
    page on the internet sign her out mid-draft.
  - Image uploads get a per-account allowance and the TTS cache a size
    cap. Both share the encrypted volume the database is on, and a full
    disk is SQLite failing to write, not a feature degrading.
  - The session cookie takes the __Host- prefix over https, so nothing
    else under parodia.dev can plant one. Old cookies still resolve;
    nobody is signed out to get there.
  - npm audit: linkify-it and postcss.

Verified: go build, go vet, the full Go suite, tsc, 195 frontend tests,
npm audit clean. The startup guard and both CSPs checked against a
running server rather than only asserted.

Claude-Session: https://claude.ai/code/session_016y6gyuHkQXPiEuW8RGQyua

internal/images/handler.go

@@ -37,6 +37,17 @@ import (
 // small enough to keep a careless paste from filling the disk.
 const maxUploadBytes = 10 << 20
 
+// maxUserBytes caps what one account may keep stored, at 1 GiB. The per-upload
+// limit bounds a single careless paste; nothing bounded ten thousand of them,
+// and Petal's data directory is an 8 GiB encrypted volume shared with the
+// database, the backups and the TTS cache — the disk filling is the database
+// losing writes, not just images failing.
+//
+// A tenth of the volume per writer is far past any real use: a heavily
+// illustrated journal is tens of megabytes. It is a runaway backstop, and it is
+// deliberately generous enough that nobody writing normally will ever meet it.
+const maxUserBytes = 1 << 30
+
 // extByContentType maps the image types we accept to a canonical extension. The
 // allowlist doubles as validation: anything not here is rejected.
 var extByContentType = map[string]string{
@@ -177,6 +188,19 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request) {
 	name := hex.EncodeToString(sum[:])[:32] + ext
 	path := filepath.Join(h.dir, name)
 
+	userID := auth.UserID(r.Context())
+	within, err := h.withinQuota(userID, name, int64(len(data)))
+	if err != nil {
+		log.Printf("images: quota check failed for %s: %v", userID, err)
+		http.Error(w, "could not store image", http.StatusInternalServerError)
+		return
+	}
+	if !within {
+		http.Error(w, "you've filled Petal's picture store — delete a few images and try again",
+			http.StatusInsufficientStorage)
+		return
+	}
+
 	// Skip the write if this exact content is already stored.
 	if _, statErr := os.Stat(path); errors.Is(statErr, os.ErrNotExist) {
 		if err := os.WriteFile(path, data, 0o644); err != nil {
@@ -190,7 +214,7 @@ func (h *Handler) upload(w http.ResponseWriter, r *http.Request) {
 	if _, err := h.db.Exec(
 		`INSERT INTO images (name, user_id, content_type, size) VALUES (?, ?, ?, ?)
 		 ON CONFLICT (name, user_id) DO NOTHING`,
-		name, auth.UserID(r.Context()), ct, len(data),
+		name, userID, ct, len(data),
 	); err != nil {
 		log.Printf("images: could not record ownership of %s: %v", name, err)
 		http.Error(w, "could not store image", http.StatusInternalServerError)
@@ -221,6 +245,20 @@ func (h *Handler) serve(w http.ResponseWriter, r *http.Request) {
 	}
 	// Private: a shared cache must never hand one writer's image to another.
 	w.Header().Set("Cache-Control", "private, max-age=31536000, immutable")
+
+	// SVG is a document format wearing an image's name: it can carry <script>,
+	// and this route serves it from Petal's own origin. Rendered through an
+	// <img> — the only way the editor ever shows one — that script never runs.
+	// Navigated to directly, which is one "open image in new tab" away, it does,
+	// and it runs with the API of whoever opened it.
+	//
+	// So every stored image answers with a CSP that permits nothing at all
+	// except the inline styles an illustration legitimately carries. It costs
+	// pasted SVGs nothing (an <img> was already a script-free context) and
+	// leaves the direct-navigation case inert. nosniff is set at the edge, but
+	// repeated here so the guarantee doesn't depend on Traefik's config.
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	http.ServeFile(w, r, path)
 }
 
@@ -261,6 +299,29 @@ func (h *Handler) remove(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// withinQuota reports whether userID may store one more image of size bytes.
+//
+// An image the caller already owns is free: content addressing means re-pasting
+// the same picture stores nothing new, and charging for it would let a document
+// that merely repeats one illustration walk into the limit. Deduplication
+// across *accounts* is not credited the same way — two people each keep their
+// own claim on a shared file, because either of them deleting it must not
+// depend on what the other did.
+func (h *Handler) withinQuota(userID, name string, size int64) (bool, error) {
+	var used, already sql.NullInt64
+	if err := h.db.QueryRow(
+		`SELECT (SELECT COALESCE(SUM(size), 0) FROM images WHERE user_id = ?),
+		        (SELECT size FROM images WHERE user_id = ? AND name = ?)`,
+		userID, userID, name,
+	).Scan(&used, &already); err != nil {
+		return false, err
+	}
+	if already.Valid {
+		return true, nil // already stored for this account — costs nothing more
+	}
+	return used.Int64+size <= maxUserBytes, nil
+}
+
 // owns reports whether userID has a claim on a stored image.
 func (h *Handler) owns(name, userID string) bool {
 	var ok bool