Add AI provider security: SSRF, consent, MCP scope

[2witstudios]

Summary

Security hardening for AI provider infrastructure, addressing four security issues:

• SSRF validation ([Security] Enforce SSRF validation for persisted AI provider base URLs #420): Validates Ollama/LM Studio base URLs in provider factory with private IP blocking, cloud metadata endpoint blocking, DNS rebinding mitigation, and safe fetch wrapper
• Consent management (No consent management for AI providers #462): Full consent lifecycle for cloud AI providers — DB schema (ai_provider_consents), API route (/api/ai/consent), repository layer, and UI dialog integrated into both AiChatView and GlobalAssistantView
• MCP scope enforcement ([Security] Enforce scoped MCP token drive boundaries across all hybrid API routes #417): Enforces drive-scoped MCP token boundaries across /api/ai/chat, /api/ai/chat/messages, and /api/tasks routes with proper 403 responses
• userId pseudonymization (userId sent to AI providers in experimental_context #464): Verified as false positive — experimental_context never leaves Node.js process in AI SDK v5.0.54 (documented in SWARM-TRACKER)

Fixes #420, Fixes #462, Fixes #417, Fixes #464

Changes

SSRF Validation (packages/lib/src/security/)

• url-validator.ts: validateLocalProviderURL(), validateExternalURL(), isBlockedIP(), safeFetch() with DNS rebinding protection
• 57 unit tests covering IPv4/IPv6 private ranges, cloud metadata, bypass techniques

Consent Management

• packages/db/src/schema/ai.ts: aiProviderConsents table with unique constraint and cascade delete
• apps/web/src/lib/repositories/ai-consent-repository.ts: hasConsent(), grantConsent(), revokeConsent(), getConsents()
• apps/web/src/app/api/ai/consent/route.ts: GET/POST/DELETE with CSRF and auth
• apps/web/src/components/ai/consent/CloudProviderConsentDialog.tsx: AlertDialog with privacy links
• apps/web/src/lib/ai/core/provider-factory.ts: Consent check before provider creation (exempt: pagespace, ollama, lmstudio)
• apps/web/src/lib/ai/core/ai-providers-config.ts: CONSENT_EXEMPT_PROVIDERS, requiresConsent()

MCP Scope Enforcement

• apps/web/src/app/api/ai/chat/messages/route.ts: checkMCPPageScope() guard
• apps/web/src/app/api/ai/chat/route.ts: checkMCPPageScope() guard
• apps/web/src/app/api/tasks/route.ts: checkMCPDriveScope() + filterDrivesByMCPScope() guards

Test plan

• 172 tests passing across all modules
• pnpm typecheck — all packages pass
• pnpm build — production build succeeds
• Run pnpm db:migrate to apply consent table migration
• Verify consent dialog appears when selecting a cloud provider for the first time
• Verify MCP-scoped tokens are rejected for out-of-scope pages/drives
• Verify Ollama/LM Studio URLs are validated on settings save and provider creation

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Rate limit exceeded

@2witstudios has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 21 minutes and 59 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch security/ai-providers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[2witstudios]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.