security: Phase 2 fixes — biomarker validation, input hardening, CSP, loading states

Partha-dev01 · Partha-dev01 · commit 5aaca5fc1643 · 2026-04-06T02:08:10.000+05:30
- Add biomarker sanitizer (prompt injection prevention for Bedrock LLM)
- Apply sanitizer to /api/report/clinical and /api/report/summary
- Strip HTML tags from feed post content before storage
- Validate feed action field against allowlist
- Validate animalPersonality against allowlist in chat route
- Clamp ageMonths to 0-240 across chat and report routes
- Add loading.tsx at root, intake, kid-dashboard, games
- Add error.tsx boundaries at intake, kid-dashboard, games
- Add robots.txt (disallow /api/, /intake/, /kid-dashboard/)
- Add OpenGraph + Twitter Card metadata to layout.tsx
- Harden CSP: add object-src none, base-uri self, form-action self
- Add lint + type-check to amplify.yml preBuild
- Fix DOCS.md version (16.1.6 -&gt; 16.2.2)
- Remove unused S3_MODELS_BUCKET from .env.local.example
- Document 13 deferred security items in DOCS.md
diff --git a/.env.local.example b/.env.local.example
@@ -25,8 +25,8 @@ DYNAMODB_CHILD_PROFILES_TABLE=autisense-child-profiles
 DYNAMODB_SESSION_SUMMARIES_TABLE=autisense-session-summaries
 DYNAMODB_FEED_POSTS_TABLE=autisense-feed-posts
 
-# ── S3 ────────────────────────────────────────────
-S3_MODELS_BUCKET=autisense-models
+# ── S3 (removed — models served from public/ via CDN) ──
+# S3_MODELS_BUCKET is no longer used at runtime
 
 # ── Amazon Bedrock ────────────────────────────────
 BEDROCK_REGION=us-east-1
diff --git a/amplify.yml b/amplify.yml
@@ -5,6 +5,8 @@ frontend:
       commands:
         - nvm use 22
         - npm ci
+        - npm run lint
+        - npm run type-check
         - npm run test:unit
     build:
       commands:
diff --git a/app/api/chat/conversation/route.ts b/app/api/chat/conversation/route.ts
@@ -258,7 +258,12 @@ export async function POST(req: NextRequest) {
 
   // Input length limits — prevent prompt injection + cost inflation
   const childName = String(body.childName).slice(0, 50).replace(/[^\p{L}\p{N}\s'-]/gu, "");
-  const { ageMonths, turnNumber, animalPersonality } = body;
+  const ageMonths = Math.max(0, Math.min(240, Number(body.ageMonths) || 36));
+  const { turnNumber } = body;
+  const allowedPersonalities = ["dog", "cat", "rabbit", "parrot"];
+  const animalPersonality = allowedPersonalities.includes(body.animalPersonality as string)
+    ? (body.animalPersonality as string)
+    : "dog";
   const messages = Array.isArray(body.messages) ? body.messages.slice(0, 20) : [];
 
   // Hard cap — force farewell after 15 turns
diff --git a/app/api/chat/generate-words/route.ts b/app/api/chat/generate-words/route.ts
@@ -239,7 +239,8 @@ export async function POST(request: NextRequest) {
 
   try {
     const body: GenerateRequest = await request.json();
-    const { ageMonths = 36, count = 6, mode = "words" } = body;
+    const { count = 6, mode = "words" } = body;
+    const ageMonths = Math.max(0, Math.min(240, Number(body.ageMonths) || 36));
 
     if (!["words", "sentences", "instructions"].includes(mode)) {
       return NextResponse.json({ error: "Invalid mode" }, { status: 400 });
diff --git a/app/api/feed/route.ts b/app/api/feed/route.ts
@@ -125,6 +125,10 @@ export async function POST(request: NextRequest) {
   try {
     const body = await request.json();
     const { action } = body;
+    const validActions = ["create", "react", "delete"];
+    if (action && !validActions.includes(action as string)) {
+      return NextResponse.json({ error: "Invalid action" }, { status: 400 });
+    }
 
     if (action === "react") return handleReaction(body, user.id);
     if (action === "delete") return handleDelete(body, user.id);
@@ -152,7 +156,7 @@ async function handleCreate(body: Record<string, unknown>, userId: string) {
   const post: FeedPostItem = {
     postId: crypto.randomUUID(),
     userId,
-    content: (content as string).trim(),
+    content: (content as string).trim().replace(/<[^>]*>/g, ""),
     category: category as string,
     reactions: { heart: 0, helpful: 0, relate: 0 },
     reactedBy: { heart: [], helpful: [], relate: [] },
diff --git a/app/api/report/clinical/route.ts b/app/api/report/clinical/route.ts
@@ -241,7 +241,9 @@ export async function POST(req: NextRequest) {
     );
   }
 
-  const { biomarkers, childAge } = body;
+  const { sanitizeBiomarkers } = await import("../../../lib/validation/biomarker");
+  const biomarkers = sanitizeBiomarkers(body.biomarkers) as unknown as BiomarkerAggregate;
+  const childAge = body.childAge !== undefined ? Math.max(0, Math.min(240, Number(body.childAge) || 0)) : undefined;
 
   // Always generate the deterministic template first
   const baseReport = buildTemplateReport(biomarkers, childAge);
diff --git a/app/api/report/summary/route.ts b/app/api/report/summary/route.ts
@@ -76,7 +76,8 @@ export async function POST(req: NextRequest) {
     );
   }
 
-  const { biomarkers } = body;
+  const { sanitizeBiomarkers } = await import("../../../lib/validation/biomarker");
+  const biomarkers = sanitizeBiomarkers(body.biomarkers) as unknown as BiomarkerAggregate;
 
   const prompt = `Generate a parent-friendly screening summary for a child based on the following biomarker data. Map to DSM-5 criteria. Keep it to 3-4 paragraphs.
 
diff --git a/app/games/error.tsx b/app/games/error.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+      padding: 24,
+      textAlign: "center",
+    }}>
+      <h2 style={{ color: "var(--text-primary)", fontSize: "1.2rem", fontWeight: 600 }}>
+        Something went wrong
+      </h2>
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem", maxWidth: 400 }}>
+        Don&apos;t worry — your progress is saved. Try refreshing or click below.
+      </p>
+      <button
+        onClick={reset}
+        style={{
+          padding: "10px 24px",
+          borderRadius: 12,
+          border: "2px solid var(--sage-300)",
+          background: "var(--sage-50)",
+          color: "var(--sage-600)",
+          fontWeight: 600,
+          cursor: "pointer",
+          fontSize: "0.9rem",
+        }}
+      >
+        Try again
+      </button>
+    </div>
+  );
+}
diff --git a/app/games/loading.tsx b/app/games/loading.tsx
@@ -0,0 +1,22 @@
+export default function Loading() {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+    }}>
+      <div style={{
+        width: 40,
+        height: 40,
+        border: "4px solid var(--sage-200)",
+        borderTopColor: "var(--sage-500)",
+        borderRadius: "50%",
+        animation: "spin 0.8s linear infinite",
+      }} />
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem" }}>Loading...</p>
+    </div>
+  );
+}
diff --git a/app/intake/error.tsx b/app/intake/error.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+      padding: 24,
+      textAlign: "center",
+    }}>
+      <h2 style={{ color: "var(--text-primary)", fontSize: "1.2rem", fontWeight: 600 }}>
+        Something went wrong
+      </h2>
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem", maxWidth: 400 }}>
+        Don&apos;t worry — your progress is saved. Try refreshing or click below.
+      </p>
+      <button
+        onClick={reset}
+        style={{
+          padding: "10px 24px",
+          borderRadius: 12,
+          border: "2px solid var(--sage-300)",
+          background: "var(--sage-50)",
+          color: "var(--sage-600)",
+          fontWeight: 600,
+          cursor: "pointer",
+          fontSize: "0.9rem",
+        }}
+      >
+        Try again
+      </button>
+    </div>
+  );
+}
diff --git a/app/intake/loading.tsx b/app/intake/loading.tsx
@@ -0,0 +1,22 @@
+export default function Loading() {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+    }}>
+      <div style={{
+        width: 40,
+        height: 40,
+        border: "4px solid var(--sage-200)",
+        borderTopColor: "var(--sage-500)",
+        borderRadius: "50%",
+        animation: "spin 0.8s linear infinite",
+      }} />
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem" }}>Loading...</p>
+    </div>
+  );
+}
diff --git a/app/kid-dashboard/error.tsx b/app/kid-dashboard/error.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export default function Error({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+      padding: 24,
+      textAlign: "center",
+    }}>
+      <h2 style={{ color: "var(--text-primary)", fontSize: "1.2rem", fontWeight: 600 }}>
+        Something went wrong
+      </h2>
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem", maxWidth: 400 }}>
+        Don&apos;t worry — your progress is saved. Try refreshing or click below.
+      </p>
+      <button
+        onClick={reset}
+        style={{
+          padding: "10px 24px",
+          borderRadius: 12,
+          border: "2px solid var(--sage-300)",
+          background: "var(--sage-50)",
+          color: "var(--sage-600)",
+          fontWeight: 600,
+          cursor: "pointer",
+          fontSize: "0.9rem",
+        }}
+      >
+        Try again
+      </button>
+    </div>
+  );
+}
diff --git a/app/kid-dashboard/loading.tsx b/app/kid-dashboard/loading.tsx
@@ -0,0 +1,22 @@
+export default function Loading() {
+  return (
+    <div style={{
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      minHeight: "60vh",
+      gap: 16,
+    }}>
+      <div style={{
+        width: 40,
+        height: 40,
+        border: "4px solid var(--sage-200)",
+        borderTopColor: "var(--sage-500)",
+        borderRadius: "50%",
+        animation: "spin 0.8s linear infinite",
+      }} />
+      <p style={{ color: "var(--text-muted)", fontSize: "0.9rem" }}>Loading...</p>
+    </div>
+  );
+}
diff --git a/app/layout.tsx b/app/layout.tsx
@@ -26,6 +26,18 @@ export const metadata: Metadata = {
     icon: "/icon.svg",
     apple: "/logo.jpeg",
   },
+  openGraph: {
+    title: "AutiSense — AI-Powered Autism Screening",
+    description: "Privacy-first, AI-powered autism screening platform with real-time behavioral analysis, DSM-5 aligned clinical reports, and adaptive therapy games.",
+    url: "https://autisense.imaginaerium.in",
+    siteName: "AutiSense",
+    type: "website",
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "AutiSense — AI-Powered Autism Screening",
+    description: "Privacy-first, AI-powered autism screening with edge AI and adaptive therapy games.",
+  },
 };
 
 export default function RootLayout({
diff --git a/app/lib/validation/biomarker.ts b/app/lib/validation/biomarker.ts
@@ -0,0 +1,83 @@
+/**
+ * Biomarker sanitization for LLM prompt safety.
+ *
+ * Strips unknown fields and validates types/ranges before biomarker data
+ * is interpolated into Bedrock prompts. Prevents prompt injection via
+ * malicious string fields (e.g. dominantBodyBehavior containing override
+ * instructions).
+ */
+
+const BODY_BEHAVIOR_CLASSES = [
+  "hand_flapping", "body_rocking", "head_banging",
+  "spinning", "toe_walking", "non_autistic",
+] as const;
+
+const FACE_BEHAVIOR_CLASSES = [
+  "typical_expression", "flat_affect",
+  "atypical_expression", "gaze_avoidance",
+] as const;
+
+function clampScore(v: unknown, fallback = 0): number {
+  const n = Number(v);
+  if (!Number.isFinite(n)) return fallback;
+  return Math.max(0, Math.min(1, n));
+}
+
+function clampPositive(v: unknown, fallback: number | null): number | null {
+  if (v === null || v === undefined) return fallback;
+  const n = Number(v);
+  if (!Number.isFinite(n)) return fallback;
+  return Math.max(0, n);
+}
+
+function sanitizeEnum(v: unknown, allowed: readonly string[], fallback: string): string {
+  if (typeof v !== "string") return fallback;
+  return allowed.includes(v) ? v : fallback;
+}
+
+/**
+ * Sanitize a BiomarkerAggregate object for safe LLM prompt interpolation.
+ * Returns a clean object with only known fields, validated types and ranges.
+ */
+export function sanitizeBiomarkers(raw: unknown): Record<string, unknown> {
+  if (!raw || typeof raw !== "object") {
+    return { error: "invalid_biomarker_data" };
+  }
+
+  const b = raw as Record<string, unknown>;
+
+  const clean: Record<string, unknown> = {
+    sessionId: typeof b.sessionId === "string" ? b.sessionId.slice(0, 100) : "",
+    avgGazeScore: clampScore(b.avgGazeScore),
+    avgMotorScore: clampScore(b.avgMotorScore),
+    avgVocalizationScore: clampScore(b.avgVocalizationScore),
+    avgResponseLatencyMs: clampPositive(b.avgResponseLatencyMs, null),
+    sampleCount: Math.max(0, Math.min(10000, Number(b.sampleCount) || 0)),
+    overallScore: clampScore(b.overallScore),
+    flags: {
+      socialCommunication: b.flags && typeof b.flags === "object" ? Boolean((b.flags as Record<string, unknown>).socialCommunication) : false,
+      restrictedBehavior: b.flags && typeof b.flags === "object" ? Boolean((b.flags as Record<string, unknown>).restrictedBehavior) : false,
+    },
+  };
+
+  // Optional extended fields — validate strictly
+  if (b.avgAsdRisk !== undefined) {
+    clean.avgAsdRisk = clampScore(b.avgAsdRisk);
+  }
+  if (b.dominantBodyBehavior !== undefined) {
+    clean.dominantBodyBehavior = sanitizeEnum(b.dominantBodyBehavior, BODY_BEHAVIOR_CLASSES, "non_autistic");
+  }
+  if (b.dominantFaceBehavior !== undefined) {
+    clean.dominantFaceBehavior = sanitizeEnum(b.dominantFaceBehavior, FACE_BEHAVIOR_CLASSES, "typical_expression");
+  }
+  if (b.behaviorClassDistribution !== undefined && typeof b.behaviorClassDistribution === "object" && b.behaviorClassDistribution !== null) {
+    const dist: Record<string, number> = {};
+    for (const cls of BODY_BEHAVIOR_CLASSES) {
+      const val = (b.behaviorClassDistribution as Record<string, unknown>)[cls];
+      if (val !== undefined) dist[cls] = clampScore(val);
+    }
+    clean.behaviorClassDistribution = dist;
+  }
+
+  return clean;
+}
diff --git a/app/loading.tsx b/app/loading.tsx
diff --git a/docs/DOCS.md b/docs/DOCS.md
diff --git a/next.config.ts b/next.config.ts
diff --git a/public/robots.txt b/public/robots.txt

Original file line number	Diff line number	Diff line change
`@@ -241,7 +241,9 @@ export async function POST(req: NextRequest) {`
`241`	`241`	`);`
`242`	`242`	`}`
`243`	`243`
`244`		`- const { biomarkers, childAge } = body;`
	`244`	`+ const { sanitizeBiomarkers } = await import("../../../lib/validation/biomarker");`
	`245`	`+ const biomarkers = sanitizeBiomarkers(body.biomarkers) as unknown as BiomarkerAggregate;`
	`246`	`+ const childAge = body.childAge !== undefined ? Math.max(0, Math.min(240, Number(body.childAge) \|\| 0)) : undefined;`
`245`	`247`
`246`	`248`	`// Always generate the deterministic template first`
`247`	`249`	`const baseReport = buildTemplateReport(biomarkers, childAge);`
Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,8 @@ export async function POST(req: NextRequest) {`
`76`	`76`	`);`
`77`	`77`	`}`
`78`	`78`
`79`		`- const { biomarkers } = body;`
	`79`	`+ const { sanitizeBiomarkers } = await import("../../../lib/validation/biomarker");`
	`80`	`+ const biomarkers = sanitizeBiomarkers(body.biomarkers) as unknown as BiomarkerAggregate;`
`80`	`81`
`81`	`82`	const prompt = `Generate a parent-friendly screening summary for a child based on the following biomarker data. Map to DSM-5 criteria. Keep it to 3-4 paragraphs.
`82`	`83`