Optimize project: add client-side image compression, URL validation, CORS, rate limiting, and DB pruning

app/src/main/java/com/example/pestdetection/MainActivity.java

@@ -139,6 +139,10 @@ public class MainActivity extends AppCompatActivity {
     private void saveServerUrlFromInput() {
         String newUrl = etServerUrl.getText().toString().trim();
         if (!newUrl.isEmpty()) {
+            if (!newUrl.startsWith("http://") && !newUrl.startsWith("https://")) {
+                newUrl = "http://" + newUrl;
+            }
+            newUrl = newUrl.replaceAll("\\s+", "");
             ApiConfig.savePredictUrl(this, newUrl);
             etServerUrl.setText(ApiConfig.getPredictUrl(this));
         }
@@ -272,12 +276,12 @@ public class MainActivity extends AppCompatActivity {
             saveServerUrlFromInput();
             final String serverUrl = ApiConfig.getPredictUrl(this);
 
-            InputStream inputStream = getContentResolver().openInputStream(imageUri);
-            byte[] imageBytes = getBytes(inputStream);
-
             resultText.setText("Analyzing...");
             treatmentText.setText("Please wait...");
 
+            // Scaled and compressed image bytes on-device
+            byte[] imageBytes = getScaledAndCompressedImage(imageUri);
+
             PestApiClient.getInstance().predict(serverUrl, imageBytes, new PestApiClient.PredictCallback() {
                 @Override
                 public void onSuccess(String pest, double confidence, String treatment) {
@@ -301,15 +305,41 @@ public class MainActivity extends AppCompatActivity {
         }
     }
 
-    private byte[] getBytes(InputStream inputStream) throws Exception {
-        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
-        int nRead;
-        byte[] data = new byte[16384];
+    private byte[] getScaledAndCompressedImage(Uri uri) throws Exception {
+        InputStream input = getContentResolver().openInputStream(uri);
+        android.graphics.Bitmap bitmap = android.graphics.BitmapFactory.decodeStream(input);
+        if (input != null) {
+            input.close();
+        }
+
+        if (bitmap == null) {
+            throw new Exception("Failed to decode image");
+        }
+
+        int maxSize = 1024;
+        int width = bitmap.getWidth();
+        int height = bitmap.getHeight();
 
-        while ((nRead = inputStream.read(data)) != -1) {
-            buffer.write(data, 0, nRead);
+        if (width > maxSize || height > maxSize) {
+            float ratio = (float) width / (float) height;
+            if (ratio > 1) {
+                width = maxSize;
+                height = (int) (maxSize / ratio);
+            } else {
+                height = maxSize;
+                width = (int) (maxSize * ratio);
+            }
+            android.graphics.Bitmap resizedBitmap = android.graphics.Bitmap.createScaledBitmap(bitmap, width, height, true);
+            if (resizedBitmap != bitmap) {
+                bitmap.recycle();
+            }
+            bitmap = resizedBitmap;
         }
 
-        return buffer.toByteArray();
+        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+        bitmap.compress(android.graphics.Bitmap.CompressFormat.JPEG, 80, outputStream);
+        byte[] bytes = outputStream.toByteArray();
+        bitmap.recycle();
+        return bytes;
     }
 }

backend/app.py

@@ -1,5 +1,6 @@
 from fastapi import FastAPI, File, UploadFile, HTTPException, Request
 from fastapi.responses import PlainTextResponse
+from fastapi.middleware.cors import CORSMiddleware
 import os
 from pathlib import Path
 import threading
@@ -10,6 +11,7 @@ import json
 import io
 from PIL import Image
 from typing import Optional
+from collections import defaultdict
 
 BASE_DIR = Path(__file__).resolve().parent
 DB_FILE = BASE_DIR / "pest_detection.db"
@@ -32,6 +34,17 @@ def init_db():
         )
     """)
     conn.commit()
+    
+    # Prune audit logs older than 30 days
+    try:
+        cursor.execute("DELETE FROM audit_logs WHERE timestamp < datetime('now', '-30 days')")
+        pruned_count = cursor.rowcount
+        conn.commit()
+        if pruned_count > 0:
+            print(f"[DB] Successfully pruned {pruned_count} audit log entries older than 30 days.")
+    except Exception as e:
+        print(f"[DB] Warning: Failed to prune audit logs: {e}")
+        
     conn.close()
 
 def log_audit(username: Optional[str], endpoint: str, status: str, details: str, ip_address: str):
@@ -51,6 +64,20 @@ init_db()
 
 app = FastAPI(title="Pest Detection API")
 
+# Configure CORS Middleware
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# In-memory IP-based rate limiting
+RATE_LIMIT_WINDOW = 60  # 1 minute
+RATE_LIMIT_MAX_REQUESTS = 10
+request_history = defaultdict(list)
+
 model = None
 HAS_YOLO = False
 is_downloading = False
@@ -222,6 +249,15 @@ async def predict(
 ):
     ip = request.client.host if request.client else "unknown"
 
+    # Rate limiting check (excludes development environments)
+    if ip not in ("127.0.0.1", "10.0.2.2", "localhost", "unknown"):
+        now = time.time()
+        request_history[ip] = [t for t in request_history[ip] if now - t < RATE_LIMIT_WINDOW]
+        if len(request_history[ip]) >= RATE_LIMIT_MAX_REQUESTS:
+            log_audit("anonymous", "/predict", "rate-limited", f"Rate limit exceeded (IP: {ip})", ip)
+            raise HTTPException(status_code=429, detail="Too many requests. Please try again later.")
+        request_history[ip].append(now)
+
     if not image.filename:
         log_audit("anonymous", "/predict", "failed", "No selected file", ip)
         raise HTTPException(status_code=400, detail="No selected file")