Files
SnapOtter/apps/api/src/routes/tools/remove-background.ts
T
SnapOtter ff8dcf63c7 fix: resolve 14 security, correctness, and robustness issues found during QA sweep
Security fixes:
- Add auth + ownership check to thumbnail endpoint (was unauthenticated)
- Validate ExifTool fieldsToRemove against safe tag name pattern
- Add SVG sanitization to pipeline execute and batch endpoints
- Replace basename() with sanitizeFilename() in 16 tool routes
- Escape SQL LIKE wildcards in file search to prevent pattern injection
- Improve settings HTML tag validation pattern

Bug fixes:
- Skip autoOrient for SVG inputs in pipeline (prevents misinterpretation)
- Remove double-encode in compress targetSize (was degrading quality)
- Fix bg-effects alpha value from 255 to 1.0 (Sharp expects float)
- Guard download stream error handler against headers-already-sent race
- Use O_EXCL atomic file creation for install lock (fixes TOCTOU race)
- Truncate collage file array to template image count

UX fixes:
- Accept empty JSON bodies on POST endpoints (install/uninstall)
- Custom JSON content type parser that treats empty body as {}
2026-05-01 18:11:49 +08:00

377 lines
15 KiB
TypeScript

import { randomUUID } from "node:crypto";
import { readFile, writeFile } from "node:fs/promises";
import { join } from "node:path";
import { removeBackground } from "@snapotter/ai";
import { getBundleForTool, TOOL_BUNDLE_MAP } from "@snapotter/shared";
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import { z } from "zod";
import { autoOrient } from "../../lib/auto-orient.js";
import { applyEffects } from "../../lib/bg-effects.js";
import { formatZodErrors } from "../../lib/errors.js";
import { isToolInstalled } from "../../lib/feature-status.js";
import { validateImageBuffer } from "../../lib/file-validation.js";
import { sanitizeFilename } from "../../lib/filename.js";
import { decodeToSharpCompat, needsCliDecode } from "../../lib/format-decoders.js";
import { decodeHeic } from "../../lib/heic-converter.js";
import { createWorkspace, getWorkspacePath } from "../../lib/workspace.js";
import { updateSingleFileProgress } from "../progress.js";
import { registerToolProcessFn } from "../tool-factory.js";
const settingsSchema = z.object({
model: z.string().optional(),
backgroundType: z.enum(["transparent", "color", "gradient", "blur", "image"]).optional(),
backgroundColor: z.string().optional(),
gradientColor1: z.string().optional(),
gradientColor2: z.string().optional(),
gradientAngle: z.number().optional(),
blurEnabled: z.boolean().optional(),
blurIntensity: z.number().min(0).max(100).optional(),
shadowEnabled: z.boolean().optional(),
shadowOpacity: z.number().min(0).max(100).optional(),
});
/**
* AI background removal with two-phase flow:
*
* Phase 1 (POST /remove-background): Python/rembg removes background.
* Returns transparent PNG + caches mask & original for effects re-apply.
* Also returns maskUrl and originalUrl for frontend CSS preview.
*
* Phase 2 (POST /remove-background/effects): Node.js/Sharp applies effects.
* Uses cached mask + original. No AI re-run. Instant response.
* Called when user adjusts blur/shadow/background and clicks download.
*/
export function registerRemoveBackground(app: FastifyInstance) {
// ── Phase 1: Background removal ──────────────────────────────────
app.post(
"/api/v1/tools/remove-background",
async (request: FastifyRequest, reply: FastifyReply) => {
const toolId = "remove-background";
if (!isToolInstalled(toolId)) {
const bundle = getBundleForTool(toolId);
return reply.status(501).send({
error: "Feature not installed",
code: "FEATURE_NOT_INSTALLED",
feature: TOOL_BUNDLE_MAP[toolId],
featureName: bundle?.name ?? toolId,
estimatedSize: bundle?.estimatedSize ?? "unknown",
});
}
let fileBuffer: Buffer | null = null;
let filename = "image";
let settingsRaw: string | null = null;
let clientJobId: string | null = null;
try {
const parts = request.parts();
for await (const part of parts) {
if (part.type === "file") {
const chunks: Buffer[] = [];
for await (const chunk of part.file) chunks.push(chunk);
fileBuffer = Buffer.concat(chunks);
filename = sanitizeFilename(part.filename ?? "image");
} else if (part.fieldname === "settings") {
settingsRaw = part.value as string;
} else if (part.fieldname === "clientJobId") {
const raw = part.value as string;
if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(raw)) {
clientJobId = raw;
}
}
}
} catch (err) {
return reply.status(400).send({
error: "Failed to parse multipart request",
details: err instanceof Error ? err.message : String(err),
});
}
if (!fileBuffer || fileBuffer.length === 0) {
return reply.status(400).send({ error: "No image file provided" });
}
const validation = await validateImageBuffer(fileBuffer, filename);
if (!validation.valid) {
return reply.status(400).send({ error: `Invalid image: ${validation.reason}` });
}
let settings: z.infer<typeof settingsSchema>;
try {
const parsed = settingsRaw ? JSON.parse(settingsRaw) : {};
const result = settingsSchema.safeParse(parsed);
if (!result.success) {
return reply
.status(400)
.send({ error: "Invalid settings", details: formatZodErrors(result.error.issues) });
}
settings = result.data;
} catch {
return reply.status(400).send({ error: "Settings must be valid JSON" });
}
try {
// Decode HEIC/HEIF before processing
if (validation.format === "heif") {
fileBuffer = await decodeHeic(fileBuffer);
const ext = filename.match(/\.[^.]+$/)?.[0];
if (ext) filename = `${filename.slice(0, -ext.length)}.png`;
}
// Decode CLI-decoded formats (RAW, TGA, PSD, EXR, HDR)
if (needsCliDecode(validation.format)) {
fileBuffer = await decodeToSharpCompat(fileBuffer, validation.format);
const ext = filename.match(/\.[^.]+$/)?.[0];
if (ext) filename = `${filename.slice(0, -ext.length)}.png`;
}
// Auto-orient to fix EXIF rotation
fileBuffer = await autoOrient(fileBuffer);
} catch (err) {
request.log.error({ err, toolId: "remove-background" }, "Input decoding failed");
return reply.status(422).send({
error: "Background removal failed",
details: err instanceof Error ? err.message : "Unknown error",
});
}
const originalSize = fileBuffer.length;
const jobId = randomUUID();
const progressJobId = clientJobId || jobId;
let workspacePath: string;
try {
workspacePath = await createWorkspace(jobId);
const inputPath = join(workspacePath, "input", filename);
await writeFile(inputPath, fileBuffer);
} catch (err) {
request.log.error({ err, toolId: "remove-background" }, "Workspace creation failed");
return reply.status(422).send({
error: "Background removal failed",
details: err instanceof Error ? err.message : "Unknown error",
});
}
const log = request.log;
log.info(
{ toolId: "remove-background", imageSize: originalSize, model: settings.model },
"Starting background removal",
);
// Reply immediately so the HTTP connection closes within proxy timeout limits.
// The result will be delivered via the SSE progress channel.
reply.status(202).send({ jobId: progressJobId, async: true });
const onProgress = (percent: number, stage: string) => {
updateSingleFileProgress({
jobId: progressJobId,
phase: "processing",
stage,
percent: Math.min(percent, 95),
});
};
// Fire-and-forget: processing happens after the response is sent
(async () => {
// Phase 1: AI background removal -> transparent PNG
const transparentResult = await removeBackground(
fileBuffer,
join(workspacePath, "output"),
{ model: settings.model },
onProgress,
);
// Cache the mask (transparent PNG) and original for effects re-apply
const maskFilename = `${filename.replace(/\.[^.]+$/, "")}_mask.png`;
const originalFilename = `${filename.replace(/\.[^.]+$/, "")}_original.png`;
await writeFile(join(workspacePath, "output", maskFilename), transparentResult);
await writeFile(join(workspacePath, "output", originalFilename), fileBuffer);
const downloadUrl = `/api/v1/download/${jobId}/${encodeURIComponent(maskFilename)}`;
const maskUrl = `/api/v1/download/${jobId}/${encodeURIComponent(maskFilename)}`;
const originalUrl = `/api/v1/download/${jobId}/${encodeURIComponent(originalFilename)}`;
updateSingleFileProgress({
jobId: progressJobId,
phase: "complete",
percent: 100,
result: {
jobId,
downloadUrl,
maskUrl,
originalUrl,
originalSize,
processedSize: transparentResult.length,
filename,
model: settings.model,
},
});
log.info(
{ toolId: "remove-background", jobId, downloadUrl },
"Background removal complete",
);
})().catch((err) => {
log.error({ err, toolId: "remove-background" }, "Background removal failed");
updateSingleFileProgress({
jobId: progressJobId,
phase: "failed",
percent: 0,
error: err instanceof Error ? err.message : "Background removal failed",
});
});
},
);
// ── Phase 2: Effects-only (no AI re-run) ─────────────────────────
app.post(
"/api/v1/tools/remove-background/effects",
async (request: FastifyRequest, reply: FastifyReply) => {
let settingsRaw: string | null = null;
let bgImageBuffer: Buffer | null = null;
let bgFilename = "background";
try {
const parts = request.parts();
for await (const part of parts) {
if (part.type === "file" && part.fieldname === "backgroundImage") {
const chunks: Buffer[] = [];
for await (const chunk of part.file) chunks.push(chunk);
bgImageBuffer = Buffer.concat(chunks);
bgFilename = sanitizeFilename(part.filename ?? "background");
} else if (part.type === "field" && part.fieldname === "settings") {
settingsRaw = part.value as string;
}
}
} catch (err) {
return reply.status(400).send({
error: "Failed to parse request",
details: err instanceof Error ? err.message : String(err),
});
}
if (!settingsRaw) {
return reply.status(400).send({ error: "No settings provided" });
}
const effectsSchema = z.object({
jobId: z.string().min(1),
filename: z.string().min(1),
backgroundType: z.enum(["transparent", "color", "gradient", "blur", "image"]).optional(),
backgroundColor: z.string().optional(),
gradientColor1: z.string().optional(),
gradientColor2: z.string().optional(),
gradientAngle: z.number().optional(),
blurEnabled: z.boolean().optional(),
blurIntensity: z.number().min(0).max(100).optional(),
shadowEnabled: z.boolean().optional(),
shadowOpacity: z.number().min(0).max(100).optional(),
});
try {
let settings: z.infer<typeof effectsSchema>;
try {
const parsed = JSON.parse(settingsRaw);
const result = effectsSchema.safeParse(parsed);
if (!result.success) {
return reply.status(400).send({
error: "Invalid settings",
details: formatZodErrors(result.error.issues),
});
}
settings = result.data;
} catch {
return reply.status(400).send({ error: "Settings must be valid JSON" });
}
const { jobId, filename } = settings;
const workspacePath = getWorkspacePath(jobId);
const baseName = filename.replace(/\.[^.]+$/, "");
const maskPath = join(workspacePath, "output", `${baseName}_mask.png`);
const originalPath = join(workspacePath, "output", `${baseName}_original.png`);
const [maskBuffer, originalBuffer] = await Promise.all([
readFile(maskPath),
readFile(originalPath),
]);
// Decode HEIC/HEIF background image if needed
if (bgImageBuffer) {
const bgValidation = await validateImageBuffer(bgImageBuffer, bgFilename);
if (bgValidation.valid && bgValidation.format === "heif") {
bgImageBuffer = await decodeHeic(bgImageBuffer);
}
if (bgValidation.valid && needsCliDecode(bgValidation.format)) {
bgImageBuffer = await decodeToSharpCompat(bgImageBuffer, bgValidation.format);
}
}
// Apply effects using cached mask + original
const resultBuffer = await applyEffects(maskBuffer, originalBuffer, {
backgroundType: settings.backgroundType,
backgroundColor: settings.backgroundColor,
gradientColor1: settings.gradientColor1,
gradientColor2: settings.gradientColor2,
gradientAngle: settings.gradientAngle,
backgroundImageBuffer: bgImageBuffer ?? undefined,
blurEnabled: settings.blurEnabled,
blurIntensity: settings.blurIntensity,
shadowEnabled: settings.shadowEnabled,
shadowOpacity: settings.shadowOpacity,
});
// Save the final output
const outputFilename = `${baseName}_nobg.png`;
const outputPath = join(workspacePath, "output", outputFilename);
await writeFile(outputPath, resultBuffer);
return reply.send({
jobId,
downloadUrl: `/api/v1/download/${jobId}/${encodeURIComponent(outputFilename)}`,
processedSize: resultBuffer.length,
});
} catch (err) {
request.log.error({ err }, "Effects processing failed");
return reply.status(422).send({
error: "Effects processing failed",
details: err instanceof Error ? err.message : "Unknown error",
});
}
},
);
// ── Pipeline/batch registry ──────────────────────────────────────
registerToolProcessFn({
toolId: "remove-background",
settingsSchema,
process: async (inputBuffer, settings, filename) => {
const s = settings as z.infer<typeof settingsSchema>;
const orientedBuffer = await autoOrient(inputBuffer);
const jobId = randomUUID();
const workspacePath = await createWorkspace(jobId);
const transparentResult = await removeBackground(
orientedBuffer,
join(workspacePath, "output"),
{ model: s.model },
);
const resultBuffer = await applyEffects(transparentResult, orientedBuffer, {
backgroundType: s.backgroundType,
backgroundColor: s.backgroundColor,
gradientColor1: s.gradientColor1,
gradientColor2: s.gradientColor2,
gradientAngle: s.gradientAngle,
blurEnabled: s.blurEnabled,
blurIntensity: s.blurIntensity,
shadowEnabled: s.shadowEnabled,
shadowOpacity: s.shadowOpacity,
});
const outputFilename = `${filename.replace(/\.[^.]+$/, "")}_nobg.png`;
return { buffer: resultBuffer, filename: outputFilename, contentType: "image/png" };
},
});
}