From 5f653a4c9f7c76d461ee4377fb4e025771cff872 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Wed, 17 Jun 2026 22:27:47 +0900
Subject: Add image proxy endpoint to avoid mixed content issues

Serve external event images through /api/image?url=<encoded> so HTTP
image URLs from venue sites are fetched server-side and delivered over
HTTPS. Validates Content-Type is image/*, blocks private IPs (SSRF),
and caches responses in memory (24h TTL, 200-entry LRU).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/routes.ts | 1 +
 1 file changed, 1 insertion(+)

(limited to 'app/routes.ts')

diff --git a/app/routes.ts b/app/routes.ts
index 91757b5..21a950d 100644
--- a/app/routes.ts
+++ b/app/routes.ts
@@ -16,5 +16,6 @@ export default [
     route("events/:id/calendar.ics", "routes/api.events.$id.ics.ts"),
     route("venues", "routes/api.venues.ts"),
     route("openapi.json", "routes/api.openapi.ts"),
+    route("image", "routes/api.image.ts"),
   ]),
 ] satisfies RouteConfig;
-- 
cgit v1.2.3