feat(validate): implement SSRF guard for remote requests and protect sensitive settings

src/app/api/provider-nodes/validate/route.js

@@ -1,4 +1,6 @@
 import { NextResponse } from "next/server";
+import { assertPublicUrl } from "@/shared/utils/ssrfGuard.js";
+import { isLocalRequest } from "@/dashboardGuard";
 
 // Fetch with timeout wrapper
 const fetchWithTimeout = (url, options, timeout = 10000) => {
@@ -64,6 +66,15 @@ export async function POST(request) {
       return NextResponse.json({ error: "Invalid URL format" }, { status: 400 });
     }
 
+    // SSRF guard for remote callers; local host keeps self-hosted nodes (e.g. ollama-local)
+    if (!isLocalRequest(request)) {
+      try {
+        assertPublicUrl(baseUrl);
+      } catch {
+        return NextResponse.json({ error: "URL not allowed" }, { status: 400 });
+      }
+    }
+
     // Custom Embedding Validation - test POST /embeddings directly
     if (type === "custom-embedding") {
       const normalizedBase = baseUrl.trim().replace(/\/$/, "");