fix(api): bind daily and synastry charts to stored profiles

Stop accepting client-supplied birth data on those paths, and cap session writes plus location lookups so a logged-in caller cannot farm compute.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/app/api/sessions/[id]/route.ts

@@ -2,16 +2,30 @@ import { NextResponse } from "next/server";
 import { createServerSupabaseClient } from "@/lib/supabase/server";
 import { isSupabaseConfigurationError } from "@/lib/supabase/config";
 import {
+  ChatSessionBodyTooLargeError,
   chatSessionModelPatchSchema,
   chatSessionWriteSchema,
+  readChatSessionJson,
 } from "@/lib/chat-session-write-contract";
+import { consumeUserRequestRateLimit } from "@/lib/request-rate-limit";
 
 type RouteContext = { params: Promise<{ id: string }> };
 
 export async function PATCH(request: Request, context: RouteContext) {
   try {
     const { id } = await context.params;
-    const payload = await request.json().catch(() => null);
+    const supabase = await createServerSupabaseClient();
+    const { data: { user }, error: authError } = await supabase.auth.getUser();
+    if (authError || !user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+    const limited = consumeUserRequestRateLimit("sessionWrite", user.id);
+    if (!limited.ok) {
+      return NextResponse.json({
+        error: "请求过于频繁",
+        code: "rate_limited",
+        retryAfterSeconds: limited.retryAfterSeconds,
+      }, { status: 429, headers: { "Retry-After": String(limited.retryAfterSeconds) } });
+    }
+    const payload = await readChatSessionJson(request);
     const fullWrite = chatSessionWriteSchema.safeParse(payload);
     const modelPatch = chatSessionModelPatchSchema.safeParse(payload);
     let values: Record<string, unknown>;
@@ -22,9 +36,6 @@ export async function PATCH(request: Request, context: RouteContext) {
     } else {
       return NextResponse.json({ error: "聊天记录格式不正确" }, { status: 400 });
     }
-    const supabase = await createServerSupabaseClient();
-    const { data: { user }, error: authError } = await supabase.auth.getUser();
-    if (authError || !user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
     const { data, error } = await supabase
       .from("chat_sessions")
       .update(values)
@@ -36,6 +47,9 @@ export async function PATCH(request: Request, context: RouteContext) {
     if (!data) return NextResponse.json({ error: "聊天记录不存在或已被删除" }, { status: 404 });
     return NextResponse.json({ ok: true });
   } catch (error) {
+    if (error instanceof ChatSessionBodyTooLargeError) {
+      return NextResponse.json({ error: error.message }, { status: 413 });
+    }
     if (isSupabaseConfigurationError(error)) {
       return NextResponse.json({ error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" }, { status: 503 });
     }

frontend/src/app/api/sessions/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
-import { chatSessionCreateSchema } from "@/lib/chat-session-write-contract";
+import { chatSessionCreateSchema, ChatSessionBodyTooLargeError, readChatSessionJson } from "@/lib/chat-session-write-contract";
+import { consumeUserRequestRateLimit } from "@/lib/request-rate-limit";
 import { isSupabaseConfigurationError } from "@/lib/supabase/config";
 import { createServerSupabaseClient } from "@/lib/supabase/server";
 
@@ -28,7 +29,15 @@ export async function POST(request: Request) {
     const supabase = await createServerSupabaseClient();
     const { data: { user }, error: authError } = await supabase.auth.getUser();
     if (authError || !user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
-    const parsed = chatSessionCreateSchema.safeParse(await request.json().catch(() => null));
+    const limited = consumeUserRequestRateLimit("sessionWrite", user.id);
+    if (!limited.ok) {
+      return NextResponse.json({
+        error: "请求过于频繁",
+        code: "rate_limited",
+        retryAfterSeconds: limited.retryAfterSeconds,
+      }, { status: 429, headers: { "Retry-After": String(limited.retryAfterSeconds) } });
+    }
+    const parsed = chatSessionCreateSchema.safeParse(await readChatSessionJson(request));
     if (!parsed.success) return NextResponse.json({ error: "聊天记录格式不正确" }, { status: 400 });
     const { id, ...values } = parsed.data;
     const { error } = await supabase.from("chat_sessions").insert({
@@ -39,6 +48,9 @@ export async function POST(request: Request) {
     if (error) return NextResponse.json({ error: "聊天记录暂时无法同步" }, { status: 500 });
     return NextResponse.json({ ok: true }, { status: 201 });
   } catch (error) {
+    if (error instanceof ChatSessionBodyTooLargeError) {
+      return NextResponse.json({ error: error.message }, { status: 413 });
+    }
     if (isSupabaseConfigurationError(error)) {
       return NextResponse.json({ error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" }, { status: 503 });
     }