fix: eliminate SSRF vulnerabilities by removing all dynamic URL construction

  Closes #34, Closes #35

  BREAKING: Refactored internal API communication pattern

  Security fixes:
  - Replace all fetch() calls with direct function imports in monitor routes
  - Eliminate dynamic URL construction using process.env or request origins
  - Use direct function calls instead of HTTP requests between internal APIs
  - Remove all instances of template literals in fetch URLs

  Changes:
  - app/api/monitor/trigger/route.ts: Import and call getAllMonitors directly
  - app/api/monitor/all/route.ts: Import and call monitor handlers directly
  - Use NextRequest mock objects for internal function calls
  - Add proper type safety for all internal API communication

  This permanently fixes the recurring SSRF vulnerability pattern by:
  1. Never constructing URLs from user input or environment variables
  2. Using TypeScript imports for type-safe internal communication
  3. Eliminating the attack vector entirely (no more fetch with dynamic URLs)
  4. Improving performance by avoiding unnecessary HTTP overhead

  All tests passing:
  ✅ npm run build - successful
  ✅ npm run lint - no errors
  ✅ npm run format - code formatted
  ✅ Security scan - 0 vulnerabilities

Author: JSONbored

app/api/monitor/all/route.ts

@@ -1,11 +1,15 @@
 import { NextRequest, NextResponse } from "next/server";
+import { GET as getClankerMonitor } from "../clanker/route";
+import { GET as getDegenMonitor } from "../degen/route";
+import { GET as getPowerBadgeMonitor } from "../power-badge/route";
+import { GET as getGeneralMonitor } from "../route";
 
 // Import all monitor functions
 const monitors = [
-  { name: "Clanker", endpoint: "/api/monitor/clanker" },
-  { name: "DEGEN", endpoint: "/api/monitor/degen" },
-  { name: "Power Badge", endpoint: "/api/monitor/power-badge" },
-  { name: "General", endpoint: "/api/monitor" },
+  { name: "Clanker", handler: getClankerMonitor },
+  { name: "DEGEN", handler: getDegenMonitor },
+  { name: "Power Badge", handler: getPowerBadgeMonitor },
+  { name: "General", handler: getGeneralMonitor },
 ];
 
 interface MonitorResult {
@@ -29,26 +33,24 @@ export async function GET(request: NextRequest) {
 
     const results: MonitorResult[] = [];
 
-    // Use a fixed internal URL to prevent SSRF
-    const internalUrl = process.env.VERCEL_URL
-      ? `https://${process.env.VERCEL_URL}`
-      : process.env.NODE_ENV === "production"
-        ? "https://fardrops.xyz"
-        : "http://localhost:3000";
-
-    // Run all monitors in parallel
+    // Run all monitors in parallel - calling functions directly, no fetch needed
     const monitorPromises = monitors.map(
       async (monitor): Promise<MonitorResult> => {
         try {
           console.log(`Running ${monitor.name} monitor...`);
 
-          const response = await fetch(`${internalUrl}${monitor.endpoint}`, {
-            headers: {
-              Authorization: authHeader || "",
-              "Content-Type": "application/json",
-            },
+          // Create a mock request for the monitor function
+          const mockHeaders = new Headers();
+          mockHeaders.set("Authorization", authHeader || "");
+          mockHeaders.set("Content-Type", "application/json");
+
+          const mockRequest = new NextRequest("http://internal", {
+            headers: mockHeaders,
           });
 
+          // Call the monitor function directly - no external fetch, no SSRF risk
+          const response = await monitor.handler(mockRequest);
+
           if (response.ok) {
             const data = await response.json();
             return {

app/api/monitor/trigger/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { GET as getAllMonitors } from "../all/route";
 
 // Public endpoint that can be called by external services
 // Use with: UptimeRobot, Cron-job.org, or EasyCron (all have free tiers)
@@ -16,23 +17,20 @@ export async function GET(request: NextRequest) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
-    // Use a fixed internal URL to prevent SSRF
-    const internalUrl = process.env.VERCEL_URL
-      ? `https://${process.env.VERCEL_URL}`
-      : process.env.NODE_ENV === "production"
-        ? "https://fardrops.xyz"
-        : "http://localhost:3000";
-
-    const authHeader = `Bearer ${process.env.CRON_SECRET || "development"}`;
-
-    // Trigger all monitors with validated URL
-    const response = await fetch(`${internalUrl}/api/monitor/all`, {
-      headers: {
-        Authorization: authHeader,
-        "Content-Type": "application/json",
-      },
+    // Create a mock request with proper authorization header
+    const mockHeaders = new Headers();
+    mockHeaders.set(
+      "Authorization",
+      `Bearer ${process.env.CRON_SECRET || "development"}`,
+    );
+    mockHeaders.set("Content-Type", "application/json");
+
+    const mockRequest = new NextRequest("http://internal/api/monitor/all", {
+      headers: mockHeaders,
     });
 
+    // Call the monitor function directly - no external fetch, no SSRF risk
+    const response = await getAllMonitors(mockRequest);
     const data = await response.json();
 
     return NextResponse.json({