security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/auth.py

@@ -359,7 +359,10 @@ async def oauth_callback():
         return redirect("/login?error=oauth")
 
     sub = claims.get("sub", "")
-    email = claims.get("email", "")
+    # Only trust the email claim for account linking if the provider has verified it.
+    # An unverified email could be used to hijack an existing local account.
+    email_verified = claims.get("email_verified", False)
+    email = claims.get("email", "") if email_verified else ""
     preferred_username = claims.get("preferred_username", "")
 
     if not sub:

src/fabledassistant/routes/briefing.py

@@ -71,6 +71,12 @@ async def add_feed():
     url = (data.get("url") or "").strip()
     if not url:
         return jsonify({"error": "url required"}), 400
+    scheme = url.split("://")[0].lower() if "://" in url else ""
+    if scheme not in ("http", "https"):
+        return jsonify({"error": "Feed URL must use http or https"}), 400
+    from fabledassistant.services.llm import _is_private_url
+    if _is_private_url(url):
+        return jsonify({"error": "Feed URL must not point to an internal address"}), 400
     category = data.get("category") or None
 
     async with async_session() as session:

src/fabledassistant/routes/chat.py

@@ -5,7 +5,7 @@ import logging
 import httpx
 from quart import Blueprint, Response, jsonify, request
 
-from fabledassistant.auth import login_required, get_current_user_id
+from fabledassistant.auth import admin_required, login_required, get_current_user_id
 from fabledassistant.routes.utils import not_found, parse_pagination
 from fabledassistant.config import Config
 from fabledassistant.services.chat import (
@@ -439,7 +439,7 @@ async def list_models_route():
 
 
 @chat_bp.route("/models/pull", methods=["POST"])
-@login_required
+@admin_required
 async def pull_model_route():
     """Pull a model from Ollama, streaming progress via SSE."""
     data = await request.get_json()
@@ -478,7 +478,7 @@ async def pull_model_route():
 
 
 @chat_bp.route("/models/delete", methods=["POST"])
-@login_required
+@admin_required
 async def delete_model_route():
     """Delete a model from Ollama."""
     data = await request.get_json()

src/fabledassistant/routes/images.py

@@ -1,14 +1,10 @@
-"""Serve locally-cached images.
-
-No authentication required — image IDs are opaque and unguessable (based
-on the SHA-256 of the original URL).  Images are served with a 1-day
-Cache-Control header so the browser doesn't re-request on every page load.
-"""
+"""Serve locally-cached images."""
 
 import logging
 
 from quart import Blueprint, jsonify, send_file
 
+from fabledassistant.auth import login_required
 from fabledassistant.services.images import get_image_path, get_image_record
 
 logger = logging.getLogger(__name__)
@@ -17,6 +13,7 @@ images_bp = Blueprint("images", __name__, url_prefix="/api/images")
 
 
 @images_bp.route("/<int:image_id>", methods=["GET"])
+@login_required
 async def serve_image(image_id: int):
     """Serve a locally-cached image by its DB ID."""
     record = await get_image_record(image_id)

src/fabledassistant/routes/settings.py

@@ -3,7 +3,7 @@ from quart import Blueprint, jsonify, request
 from fabledassistant.auth import login_required, get_current_user_id
 from fabledassistant.config import Config
 from fabledassistant.services.caldav import CALDAV_SETTING_KEYS, get_caldav_config, test_connection
-from fabledassistant.services.llm import get_installed_models
+from fabledassistant.services.llm import get_installed_models, _is_private_url
 from fabledassistant.services.settings import delete_setting, get_all_settings, set_settings_batch
 
 settings_bp = Blueprint("settings", __name__, url_prefix="/api/settings")
@@ -77,6 +77,16 @@ async def update_caldav():
     uid = get_current_user_id()
     data = await request.get_json()
 
+    # Validate CalDAV URL before saving — block internal/private addresses
+    if "caldav_url" in data:
+        url = str(data.get("caldav_url") or "").strip()
+        if url:
+            parsed_scheme = url.split("://")[0].lower() if "://" in url else ""
+            if parsed_scheme not in ("http", "https"):
+                return jsonify({"error": "CalDAV URL must use http or https"}), 400
+            if _is_private_url(url):
+                return jsonify({"error": "CalDAV URL must not point to an internal or private address"}), 400
+
     settings_to_save = {}
     for key in CALDAV_SETTING_KEYS:
         if key in data:

src/fabledassistant/routes/users.py

@@ -24,6 +24,6 @@ async def search_users():
             ).limit(10)
         )).scalars().all()
     return jsonify({"users": [
-        {"id": u.id, "username": u.username, "email": u.email}
+        {"id": u.id, "username": u.username}
         for u in users
     ]})