chore: drop old client support (#14369)

packages/backend/server/src/plugins/copilot/context/resolver.ts

@@ -105,10 +105,6 @@ class RemoveContextDocInput {
 class AddContextFileInput {
   @Field(() => String)
   contextId!: string;
-
-  // @TODO(@darkskygit): remove this after client lower then 0.22 has been disconnected
-  @Field(() => String, { nullable: true, deprecationReason: 'Never used' })
-  blobId!: string | undefined;
 }
 
 @InputType()

packages/backend/server/src/plugins/copilot/prompt/prompts.ts

@@ -1672,42 +1672,12 @@ const imageActions: Prompt[] = [
       },
     ],
   },
-  // TODO(@darkskygit): deprecated, remove it after <0.22 version is outdated
-  {
-    name: 'debug:action:fal-remove-bg',
-    action: 'Remove background',
-    model: 'imageutils/rembg',
-    messages: [],
-  },
-  {
-    name: 'debug:action:fal-face-to-sticker',
-    action: 'Convert to sticker',
-    model: 'face-to-sticker',
-    messages: [],
-  },
   {
     name: 'debug:action:fal-teed',
     action: 'fal-teed',
     model: 'workflowutils/teed',
     messages: [{ role: 'user', content: '{{content}}' }],
   },
-  {
-    name: 'debug:action:fal-sd15',
-    action: 'image',
-    model: 'lcm-sd15-i2i',
-    messages: [],
-  },
-  {
-    name: 'debug:action:fal-upscaler',
-    action: 'Clearer',
-    model: 'clarity-upscaler',
-    messages: [
-      {
-        role: 'user',
-        content: 'best quality, 8K resolution, highres, clarity, {{content}}',
-      },
-    ],
-  },
 ];
 
 const modelActions: Prompt[] = [

packages/backend/server/src/plugins/copilot/providers/openai.ts

@@ -24,7 +24,9 @@ import {
   CopilotPromptInvalid,
   CopilotProviderNotSupported,
   CopilotProviderSideError,
+  fetchBuffer,
   metrics,
+  OneMB,
   UserFriendlyError,
 } from '../../../base';
 import { CopilotProvider } from './provider';
@@ -673,14 +675,12 @@ export class OpenAIProvider extends CopilotProvider<OpenAIConfig> {
 
     for (const [idx, entry] of attachments.entries()) {
       const url = typeof entry === 'string' ? entry : entry.attachment;
-      const resp = await fetch(url);
-      if (resp.ok) {
-        const type = resp.headers.get('content-type');
-        if (type && type.startsWith('image/')) {
-          const buffer = new Uint8Array(await resp.arrayBuffer());
-          const file = new File([buffer], `${idx}.png`, { type });
-          form.append('image[]', file);
-        }
+      try {
+        const { buffer, type } = await fetchBuffer(url, 10 * OneMB, 'image/');
+        const file = new File([buffer], `${idx}.png`, { type });
+        form.append('image[]', file);
+      } catch {
+        continue;
       }
     }
 

packages/backend/server/src/plugins/copilot/providers/utils.ts

@@ -12,11 +12,22 @@ import {
 import { GoogleAuth, GoogleAuthOptions } from 'google-auth-library';
 import z, { ZodType } from 'zod';
 
+import {
+  bufferToArrayBuffer,
+  fetchBuffer,
+  OneMinute,
+  ResponseTooLargeError,
+  safeFetch,
+  SsrfBlockedError,
+} from '../../../base';
 import { CustomAITools } from '../tools';
 import { PromptMessage, StreamObject } from './types';
 
 type ChatMessage = CoreUserMessage | CoreAssistantMessage;
 
+const ATTACHMENT_MAX_BYTES = 20 * 1024 * 1024;
+const ATTACH_HEAD_PARAMS = { timeoutMs: OneMinute / 12, maxRedirects: 3 };
+
 const SIMPLE_IMAGE_URL_REGEX = /^(https?:\/\/|data:image\/)/;
 const FORMAT_INFER_MAP: Record<string, string> = {
   pdf: 'application/pdf',
@@ -42,6 +53,11 @@ const FORMAT_INFER_MAP: Record<string, string> = {
   flv: 'video/flv',
 };
 
+async function fetchArrayBuffer(url: string): Promise<ArrayBuffer> {
+  const { buffer } = await fetchBuffer(url, ATTACHMENT_MAX_BYTES);
+  return bufferToArrayBuffer(buffer);
+}
+
 export async function inferMimeType(url: string) {
   if (url.startsWith('data:')) {
     return url.split(';')[0].split(':')[1];
@@ -53,12 +69,15 @@ export async function inferMimeType(url: string) {
     if (ext) {
       return ext;
     }
-    const mimeType = await fetch(url, {
-      method: 'HEAD',
-      redirect: 'follow',
-    }).then(res => res.headers.get('Content-Type'));
-    if (mimeType) {
-      return mimeType;
+    try {
+      const mimeType = await safeFetch(
+        url,
+        { method: 'HEAD' },
+        ATTACH_HEAD_PARAMS
+      ).then(res => res.headers.get('content-type'));
+      if (mimeType) return mimeType;
+    } catch {
+      // ignore and fallback to default
     }
   }
   return 'application/octet-stream';
@@ -106,7 +125,16 @@ export async function chatToGPTMessage(
           if (SIMPLE_IMAGE_URL_REGEX.test(attachment)) {
             const data =
               attachment.startsWith('data:') || useBase64Attachment
-                ? await fetch(attachment).then(r => r.arrayBuffer())
+                ? await fetchArrayBuffer(attachment).catch(error => {
+                    // Avoid leaking internal details for blocked URLs.
+                    if (
+                      error instanceof SsrfBlockedError ||
+                      error instanceof ResponseTooLargeError
+                    ) {
+                      throw new Error('Attachment URL is not allowed');
+                    }
+                    throw error;
+                  })
                 : new URL(attachment);
             if (mediaType.startsWith('image/')) {
               contents.push({ type: 'image', image: data, mediaType });

packages/backend/server/src/plugins/copilot/storage.ts

@@ -7,7 +7,9 @@ import {
   BlobQuotaExceeded,
   CallMetric,
   Config,
+  fetchBuffer,
   type FileUpload,
+  OneMB,
   OnEvent,
   readBuffer,
   type StorageProvider,
@@ -16,6 +18,8 @@ import {
 } from '../../base';
 import { QuotaService } from '../../core/quota';
 
+const REMOTE_BLOB_MAX_BYTES = 20 * OneMB;
+
 @Injectable()
 export class CopilotStorage {
   public provider!: StorageProvider;
@@ -88,9 +92,8 @@ export class CopilotStorage {
 
   @CallMetric('ai', 'blob_proxy_remote_url')
   async handleRemoteLink(userId: string, workspaceId: string, link: string) {
-    const response = await fetch(link);
-    const buffer = new Uint8Array(await response.arrayBuffer());
+    const { buffer } = await fetchBuffer(link, REMOTE_BLOB_MAX_BYTES, 'image/');
     const filename = createHash('sha256').update(buffer).digest('base64url');
-    return this.put(userId, workspaceId, filename, Buffer.from(buffer));
+    return this.put(userId, workspaceId, filename, buffer);
   }
 }