mirror of https://github.com/requarks/wiki
NGPixel
1 month ago
parent
1105cf4b5e
commit
14e1efae41
@ -0,0 +1,180 @@
|
||||
import { actorFrom, mayOnPage, unlockedFor } from './pages.ts'
|
||||
import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'
|
||||
|
||||
/**
|
||||
* The page being watched, as this requester is allowed to see it.
|
||||
*
|
||||
* Watching a page is a thing done TO a page, so it goes through the same gate as reading one: an
|
||||
* anonymous requester never gets here at all, and a page somebody may not read is answered as though
|
||||
* it were not there. A password is not part of it — the watcher is asking to be told when the page
|
||||
* changes, not to read what it says.
|
||||
*/
|
||||
async function loadWatchablePage(req: FastifyRequest, siteId: string, pageId: string) {
|
||||
const page = await WIKI.models.pages.getPage({
|
||||
siteId,
|
||||
id: pageId,
|
||||
unlocked: (id: string) => unlockedFor(req, id)
|
||||
})
|
||||
if (!page || !mayOnPage(req, 'read:pages', page)) {
|
||||
return null
|
||||
}
|
||||
return page
|
||||
}
|
||||
|
||||
/**
|
||||
* The user doing the watching, or a refusal.
|
||||
*
|
||||
* Watching belongs to an account: it is a list somebody comes back to, and a row has to point at a
|
||||
* person for a notification to ever have a recipient. There is no permission for it beyond being
|
||||
* logged in — anybody who may read a page may ask to hear about it.
|
||||
*/
|
||||
function watcherOf(req: FastifyRequest, reply: FastifyReply): string | null {
|
||||
const actor = actorFrom(req)
|
||||
if (!actor) {
|
||||
reply.unauthorized('Watching a page requires a logged in user.')
|
||||
return null
|
||||
}
|
||||
return actor.id
|
||||
}
|
||||
|
||||
const pageParams = {
|
||||
type: 'object',
|
||||
properties: {
|
||||
siteId: { type: 'string', format: 'uuid' },
|
||||
pageId: { type: 'string', format: 'uuid' }
|
||||
},
|
||||
required: ['siteId', 'pageId']
|
||||
}
|
||||
|
||||
/**
|
||||
* Page Watching API Routes
|
||||
*
|
||||
* Who has asked to be told when a page changes. Nothing is sent yet — notifications are not built —
|
||||
* so these keep the list: the bell on a page writes to it, and the inbox reads it back.
|
||||
*/
|
||||
async function routes(app: FastifyInstance) {
|
||||
/**
|
||||
* WATCH A PAGE
|
||||
*/
|
||||
app.put<{ Params: { siteId: string; pageId: string } }>(
|
||||
'/sites/:siteId/pages/:pageId/watch',
|
||||
{
|
||||
/*
|
||||
No route-level `permissions`: this is decided per page, by whether the caller may read it —
|
||||
which comes from a group's rules and not from the group-wide list that hook consults.
|
||||
*/
|
||||
schema: {
|
||||
summary: 'Watch a page',
|
||||
description:
|
||||
'Records that the caller wants to hear about changes to this page. Watching a page already watched changes nothing and still answers 200, so the button can be pressed twice without it meaning anything different.',
|
||||
tags: ['Pages'],
|
||||
params: pageParams,
|
||||
response: {
|
||||
200: {
|
||||
description: 'The page is being watched',
|
||||
type: 'object',
|
||||
properties: {
|
||||
ok: { type: 'boolean' },
|
||||
isWatching: { type: 'boolean' }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
async (req, reply) => {
|
||||
const userId = watcherOf(req, reply)
|
||||
if (!userId) {
|
||||
return reply
|
||||
}
|
||||
const page = await loadWatchablePage(req, req.params.siteId, req.params.pageId)
|
||||
if (!page) {
|
||||
return reply.notFound('This page does not exist.')
|
||||
}
|
||||
await WIKI.models.pageWatching.watch({
|
||||
siteId: req.params.siteId,
|
||||
pageId: page.id,
|
||||
userId
|
||||
})
|
||||
return { ok: true, isWatching: true }
|
||||
}
|
||||
)
|
||||
|
||||
/**
|
||||
* UNWATCH A PAGE
|
||||
*/
|
||||
app.delete<{ Params: { siteId: string; pageId: string } }>(
|
||||
'/sites/:siteId/pages/:pageId/watch',
|
||||
{
|
||||
// -> Same as above: readable is the test, and it is per page
|
||||
schema: {
|
||||
summary: 'Stop watching a page',
|
||||
description:
|
||||
'Forgets that the caller wanted to hear about this page. A page that was not being watched answers the same way, since the outcome asked for — no longer watching it — already holds.',
|
||||
tags: ['Pages'],
|
||||
params: pageParams,
|
||||
response: {
|
||||
200: {
|
||||
description: 'The page is no longer being watched',
|
||||
type: 'object',
|
||||
properties: {
|
||||
ok: { type: 'boolean' },
|
||||
isWatching: { type: 'boolean' }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
async (req, reply) => {
|
||||
const userId = watcherOf(req, reply)
|
||||
if (!userId) {
|
||||
return reply
|
||||
}
|
||||
/*
|
||||
The page is NOT loaded first. Unwatching has to keep working for a page that has since been
|
||||
made unreadable, or the row would be stuck there with nothing in the interface able to remove
|
||||
it — and there is nothing to protect anyway: this only ever deletes the caller's own row.
|
||||
*/
|
||||
await WIKI.models.pageWatching.unwatch({ pageId: req.params.pageId, userId })
|
||||
return { ok: true, isWatching: false }
|
||||
}
|
||||
)
|
||||
|
||||
/**
|
||||
* LIST WATCHED PAGES
|
||||
*/
|
||||
app.get<{ Params: { siteId: string } }>(
|
||||
'/sites/:siteId/watching',
|
||||
{
|
||||
// -> Everything it returns is the caller's own, so being logged in is the whole of the check
|
||||
schema: {
|
||||
summary: 'List the pages the caller is watching',
|
||||
description:
|
||||
'The watch list of the caller on this site, most recently watched first. Titles and paths come from the pages themselves, so a page that has been renamed or moved is listed where it is now.',
|
||||
tags: ['Pages'],
|
||||
params: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
siteId: { type: 'string', format: 'uuid' }
|
||||
},
|
||||
required: ['siteId']
|
||||
},
|
||||
response: {
|
||||
200: {
|
||||
description: 'Watched pages',
|
||||
type: 'array',
|
||||
items: { $ref: 'WatchedPage#' }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
async (req, reply) => {
|
||||
const userId = watcherOf(req, reply)
|
||||
if (!userId) {
|
||||
return reply
|
||||
}
|
||||
return WIKI.models.pageWatching.listForUser(req.params.siteId, userId)
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
export default routes
|
||||
@ -0,0 +1,13 @@
|
||||
CREATE TABLE "pageWatching" (
|
||||
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
"createdAt" timestamp DEFAULT now() NOT NULL,
|
||||
"pageId" uuid NOT NULL,
|
||||
"siteId" uuid NOT NULL,
|
||||
"userId" uuid NOT NULL
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE INDEX "pageWatching_user_site_idx" ON "pageWatching" ("userId","siteId");--> statement-breakpoint
|
||||
CREATE UNIQUE INDEX "pageWatching_page_user_idx" ON "pageWatching" ("pageId","userId");--> statement-breakpoint
|
||||
ALTER TABLE "pageWatching" ADD CONSTRAINT "pageWatching_pageId_pages_id_fkey" FOREIGN KEY ("pageId") REFERENCES "pages"("id") ON DELETE CASCADE;--> statement-breakpoint
|
||||
ALTER TABLE "pageWatching" ADD CONSTRAINT "pageWatching_siteId_sites_id_fkey" FOREIGN KEY ("siteId") REFERENCES "sites"("id");--> statement-breakpoint
|
||||
ALTER TABLE "pageWatching" ADD CONSTRAINT "pageWatching_userId_users_id_fkey" FOREIGN KEY ("userId") REFERENCES "users"("id") ON DELETE CASCADE;
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,9 @@
|
||||
CREATE TABLE "rateLimits" (
|
||||
"key" varchar(255) PRIMARY KEY,
|
||||
"hits" integer DEFAULT 0 NOT NULL,
|
||||
"windowStartedAt" timestamp DEFAULT now() NOT NULL,
|
||||
"bannedUntil" timestamp,
|
||||
"updatedAt" timestamp DEFAULT now() NOT NULL
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE INDEX "rateLimits_updatedAt_idx" ON "rateLimits" ("updatedAt");
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,71 @@
|
||||
import { durationToSeconds } from './common.ts'
|
||||
import type { FastifyReply, FastifyRequest } from 'fastify'
|
||||
import type { RateLimitPolicy } from '../models/rateLimits.ts'
|
||||
|
||||
/**
|
||||
* Defaults for the limit on the authentication endpoints, used until an administrator saves their own
|
||||
* and whenever a stored value is missing or unusable. Ten attempts in five minutes is far more than a
|
||||
* person signing in needs and far less than guessing a password takes.
|
||||
*/
|
||||
const AUTH_DEFAULTS: RateLimitPolicy = {
|
||||
max: 10,
|
||||
windowSeconds: 300,
|
||||
banSeconds: 900
|
||||
}
|
||||
|
||||
/**
|
||||
* The configured policy.
|
||||
*
|
||||
* Every field falls back on its own, so one unusable value leaves the rest of the limit standing
|
||||
* rather than turning it off — which is the failure mode worth avoiding here. The two durations are
|
||||
* stored as an operator wrote them (`5m`, `15m`, `1d`), the way the JWT settings beside them are.
|
||||
*/
|
||||
function authPolicy(): RateLimitPolicy {
|
||||
const security = WIKI.config.security ?? {}
|
||||
const max = Number(security.authRateLimitMax)
|
||||
return {
|
||||
max: Number.isFinite(max) && max > 0 ? Math.floor(max) : AUTH_DEFAULTS.max,
|
||||
windowSeconds: durationToSeconds(security.authRateLimitWindow, AUTH_DEFAULTS.windowSeconds),
|
||||
banSeconds: durationToSeconds(security.authRateLimitBan, AUTH_DEFAULTS.banSeconds)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Refuse an attempt at an authentication endpoint once a client has made too many.
|
||||
*
|
||||
* Written as a per-route `onRequest` hook — `{ onRequest: limitAuthAttempts, schema: … }` — so that it
|
||||
* runs before the body is even parsed, and so that the routes it guards say so where they are declared
|
||||
* rather than in a list somewhere else. The endpoints that carry it are the ones where the request
|
||||
* IS the guess: signing in, answering a second factor, changing a password from the login screen,
|
||||
* a passkey ceremony, and unlocking a page.
|
||||
*
|
||||
* One counter per client address, shared by all of them: an attacker working through passwords on two
|
||||
* of these endpoints is one attacker, and splitting the count per endpoint would let them have the
|
||||
* limit twice over. `req.ip` is what the client is identified by, which behind a proxy means the
|
||||
* `trustProxy` security setting has to be on for this to see anything but the proxy.
|
||||
*
|
||||
* Attempts are counted whether or not they succeed. A limit on failures only would leave the endpoint
|
||||
* open to being hammered with valid credentials, and the numbers are set for a person signing in, who
|
||||
* does not come close to them.
|
||||
*/
|
||||
export async function limitAuthAttempts(req: FastifyRequest, reply: FastifyReply): Promise<void> {
|
||||
if (WIKI.config.security?.authRateLimitEnabled === false) {
|
||||
return
|
||||
}
|
||||
const verdict = await WIKI.models.rateLimits.consume(`auth:${req.ip}`, authPolicy())
|
||||
if (verdict.allowed) {
|
||||
return
|
||||
}
|
||||
WIKI.models.flags.authDebug(
|
||||
`Rate limit: refused ${req.method} ${req.url} from ${req.ip}, ${verdict.retryAfter}s left of its ban.`
|
||||
)
|
||||
/*
|
||||
429 rather than 403, and with `Retry-After`: this is not a refusal to serve the client, it is the
|
||||
same answer as before with a time on it — which is what a legitimate user locked out by a shared
|
||||
address needs to be told.
|
||||
*/
|
||||
reply.header('Retry-After', String(verdict.retryAfter))
|
||||
return reply.tooManyRequests(
|
||||
`Too many attempts. Try again in ${Math.ceil(verdict.retryAfter / 60)} minute(s).`
|
||||
)
|
||||
}
|
||||
@ -0,0 +1,102 @@
|
||||
import { and, desc, eq } from 'drizzle-orm'
|
||||
import { pageWatching as watchingTable, pages as pagesTable } from '../db/schema.ts'
|
||||
|
||||
/** A watched page, as the inbox lists it. */
|
||||
export interface WatchedPage {
|
||||
pageId: string
|
||||
path: string
|
||||
locale: string
|
||||
title: string
|
||||
description: string | null
|
||||
icon: string | null
|
||||
/** When the page itself last changed, which is what a watcher is watching FOR. */
|
||||
updatedAt: Date
|
||||
/** When this person started watching, i.e. how long they have been asking to be told. */
|
||||
watchedAt: Date
|
||||
}
|
||||
|
||||
/**
|
||||
* Page watching model
|
||||
*
|
||||
* Who has asked to be told about which pages. Nothing is sent yet — notifications are not built — so
|
||||
* this is the list and nothing more: the bell on a page reads it, the inbox lists it, and whatever
|
||||
* delivers the news later has one place to ask who wants it.
|
||||
*/
|
||||
class PageWatching {
|
||||
/**
|
||||
* Whether this user is watching this page.
|
||||
*
|
||||
* Answered for the page view, which asks about every page it draws, so it is a single indexed lookup
|
||||
* on the pair — and not asked at all for a guest, who cannot watch anything.
|
||||
*/
|
||||
async isWatching(pageId: string, userId: string | null): Promise<boolean> {
|
||||
if (!userId) {
|
||||
return false
|
||||
}
|
||||
const rows = await WIKI.db
|
||||
.select({ id: watchingTable.id })
|
||||
.from(watchingTable)
|
||||
.where(and(eq(watchingTable.pageId, pageId), eq(watchingTable.userId, userId)))
|
||||
.limit(1)
|
||||
return rows.length > 0
|
||||
}
|
||||
|
||||
/**
|
||||
* Start watching a page.
|
||||
*
|
||||
* Idempotent: watching a page one is already watching is what the reader asked for, and the unique
|
||||
* index turns the second row into nothing rather than into an error.
|
||||
*/
|
||||
async watch({
|
||||
siteId,
|
||||
pageId,
|
||||
userId
|
||||
}: {
|
||||
siteId: string
|
||||
pageId: string
|
||||
userId: string
|
||||
}): Promise<void> {
|
||||
await WIKI.db
|
||||
.insert(watchingTable)
|
||||
.values({ siteId, pageId, userId })
|
||||
.onConflictDoNothing({ target: [watchingTable.pageId, watchingTable.userId] })
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop watching a page. Also idempotent, for the same reason: the outcome asked for is that no row
|
||||
* exists, and it does not.
|
||||
*/
|
||||
async unwatch({ pageId, userId }: { pageId: string; userId: string }): Promise<void> {
|
||||
await WIKI.db
|
||||
.delete(watchingTable)
|
||||
.where(and(eq(watchingTable.pageId, pageId), eq(watchingTable.userId, userId)))
|
||||
}
|
||||
|
||||
/**
|
||||
* The pages this user watches on a site, most recently watched first.
|
||||
*
|
||||
* Joined to the pages rather than storing a copy of the title and the path, so a page that is
|
||||
* renamed or moved is listed where it is now — which is the point of watching it. A deleted page
|
||||
* takes its rows with it through the foreign key, so nothing here can point at one that is gone.
|
||||
*/
|
||||
async listForUser(siteId: string, userId: string): Promise<WatchedPage[]> {
|
||||
const rows = await WIKI.db
|
||||
.select({
|
||||
pageId: pagesTable.id,
|
||||
path: pagesTable.path,
|
||||
locale: pagesTable.locale,
|
||||
title: pagesTable.title,
|
||||
description: pagesTable.description,
|
||||
icon: pagesTable.icon,
|
||||
updatedAt: pagesTable.updatedAt,
|
||||
watchedAt: watchingTable.createdAt
|
||||
})
|
||||
.from(watchingTable)
|
||||
.innerJoin(pagesTable, eq(pagesTable.id, watchingTable.pageId))
|
||||
.where(and(eq(watchingTable.userId, userId), eq(watchingTable.siteId, siteId)))
|
||||
.orderBy(desc(watchingTable.createdAt))
|
||||
return rows as WatchedPage[]
|
||||
}
|
||||
}
|
||||
|
||||
export const pageWatching = new PageWatching()
|
||||
@ -0,0 +1,121 @@
|
||||
import { lt, sql } from 'drizzle-orm'
|
||||
import { rateLimits as rateLimitsTable } from '../db/schema.ts'
|
||||
|
||||
/** How a limit is configured: what it allows, over how long, and what it costs to exceed. */
|
||||
export interface RateLimitPolicy {
|
||||
/** Attempts allowed within the window. The one that exceeds it is what earns the ban. */
|
||||
max: number
|
||||
/** Length of the window, in seconds. */
|
||||
windowSeconds: number
|
||||
/** How long the ban lasts once earned, in seconds. */
|
||||
banSeconds: number
|
||||
}
|
||||
|
||||
/** What the caller does about an attempt. */
|
||||
export interface RateLimitVerdict {
|
||||
/** Whether the attempt may proceed. */
|
||||
allowed: boolean
|
||||
/** Attempts made in the current window, the one just counted included. */
|
||||
hits: number
|
||||
/** Seconds until the client may try again. Zero while it is still allowed. */
|
||||
retryAfter: number
|
||||
}
|
||||
|
||||
/**
|
||||
* Rate limits model
|
||||
*
|
||||
* A fixed window per key, with a ban for going over it — the counter that stands behind the login and
|
||||
* the other endpoints where guessing is the attack (`helpers/rateLimit.ts` is what applies it).
|
||||
*
|
||||
* Every attempt is one statement, and the statement decides everything: whether the window has rolled
|
||||
* over, whether the ban has lifted, what the count now is, and whether this attempt has just earned a
|
||||
* ban. Doing it in the database rather than in the process is the whole point — two instances behind
|
||||
* a load balancer share one counter, and a ban issued by one is honoured by both.
|
||||
*/
|
||||
class RateLimits {
|
||||
/**
|
||||
* Count an attempt against a key, and say whether it may proceed.
|
||||
*
|
||||
* The row is read, rolled over, incremented and possibly banned in a single upsert, so concurrent
|
||||
* attempts cannot both read the same count and both decide they are under the limit. What comes
|
||||
* back is the row as it now stands.
|
||||
*
|
||||
* A banned key stops counting: its ban runs for exactly as long as it was set for, rather than
|
||||
* being pushed further out by every attempt made during it. When the ban lifts, the window starts
|
||||
* again from nothing — having served it, a client is not one attempt away from serving another.
|
||||
*
|
||||
* @param key What is being limited and who by, e.g. `auth:203.0.113.4`
|
||||
*/
|
||||
async consume(key: string, policy: RateLimitPolicy): Promise<RateLimitVerdict> {
|
||||
const window = sql`make_interval(secs => ${policy.windowSeconds})`
|
||||
/*
|
||||
The three cases, in the order the CASE arms decide them:
|
||||
|
||||
1. still banned -- nothing changes; the attempt is refused
|
||||
2. window rolled over, or a ban has just expired -- the row starts again at this attempt
|
||||
3. otherwise -- one more attempt, and a ban if that is one too many
|
||||
|
||||
`"rateLimits"` rather than the aliased `excluded`: these have to read the row AS IT WAS, and
|
||||
`excluded` is the row this statement proposed.
|
||||
*/
|
||||
const rolledOver = sql`"rateLimits"."bannedUntil" is not null or "rateLimits"."windowStartedAt" <= now() - ${window}`
|
||||
const stillBanned = sql`"rateLimits"."bannedUntil" > now()`
|
||||
const rows = await WIKI.db.execute(sql`
|
||||
insert into "rateLimits" ("key", "hits", "windowStartedAt", "updatedAt")
|
||||
values (${key}, 1, now(), now())
|
||||
on conflict ("key") do update set
|
||||
"hits" = case
|
||||
when ${stillBanned} then "rateLimits"."hits"
|
||||
when ${rolledOver} then 1
|
||||
else "rateLimits"."hits" + 1
|
||||
end,
|
||||
"windowStartedAt" = case
|
||||
when ${stillBanned} then "rateLimits"."windowStartedAt"
|
||||
when ${rolledOver} then now()
|
||||
else "rateLimits"."windowStartedAt"
|
||||
end,
|
||||
"bannedUntil" = case
|
||||
when ${stillBanned} then "rateLimits"."bannedUntil"
|
||||
when ${rolledOver} then null
|
||||
when "rateLimits"."hits" + 1 > ${policy.max} then now() + make_interval(secs => ${policy.banSeconds})
|
||||
else null
|
||||
end,
|
||||
"updatedAt" = now()
|
||||
returning
|
||||
"hits",
|
||||
"bannedUntil" > now() as "isBanned",
|
||||
greatest(0, ceil(extract(epoch from coalesce("bannedUntil", now()) - now())))::int as "retryAfter"
|
||||
`)
|
||||
const row = (rows as any).rows?.[0] ?? (rows as any)[0]
|
||||
return {
|
||||
allowed: !row?.isBanned,
|
||||
hits: Number(row?.hits ?? 0),
|
||||
retryAfter: row?.isBanned ? Number(row.retryAfter) : 0
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Forget a key, e.g. once the attempt it was counting has succeeded.
|
||||
*/
|
||||
async reset(key: string): Promise<void> {
|
||||
await WIKI.db.delete(rateLimitsTable).where(sql`${rateLimitsTable.key} = ${key}`)
|
||||
}
|
||||
|
||||
/**
|
||||
* Drop rows nothing has touched for a day.
|
||||
*
|
||||
* Only ever about reclaiming space: a stale row is already harmless, since the next attempt on that
|
||||
* key rolls its window over before reading it. A key nobody has used in a day is one nobody is
|
||||
* being limited by.
|
||||
*
|
||||
* @returns How many rows were dropped
|
||||
*/
|
||||
async purgeStale(): Promise<number> {
|
||||
const result = await WIKI.db
|
||||
.delete(rateLimitsTable)
|
||||
.where(lt(rateLimitsTable.updatedAt, sql`now() - interval '1 day'`))
|
||||
return result.rowCount ?? 0
|
||||
}
|
||||
}
|
||||
|
||||
export const rateLimits = new RateLimits()
|
||||
@ -0,0 +1,13 @@
|
||||
export async function task(): Promise<void> {
|
||||
WIKI.logger.info('Purging stale rate limit counters...')
|
||||
|
||||
try {
|
||||
const purged = await WIKI.models.rateLimits.purgeStale()
|
||||
|
||||
WIKI.logger.info(`Purged ${purged} stale rate limit counters: [ COMPLETED ]`)
|
||||
} catch (err: any) {
|
||||
WIKI.logger.error('Purging stale rate limit counters: [ FAILED ]')
|
||||
WIKI.logger.error(err.message)
|
||||
throw err
|
||||
}
|
||||
}
|
||||
Loading…
Reference in new issue