Fix: add rate limit to session and disable guest account (#222)

- Disable guest accounts in frontend and backend
- Apply in memory rate limit to new session creation (3 times per
minute)
- Add restart: always to traefik in docker compose production file

app/src/components/AuthForm.vue

@@ -87,15 +87,16 @@ const handleChange = () => {
   }
 }
 
-const registerGuest = async () => {
-  try {
-    await api.post('/auth/register-guest')
-    router.push({ name: 'map' })
-  } catch (err) {
-    console.error(err)
-    toast.error('Something went wrong.')
-  }
-}
+// Guest account currently disabled
+// const registerGuest = async () => {
+//   try {
+//     await api.post('/auth/register-guest')
+//     router.push({ name: 'map' })
+//   } catch (err) {
+//     console.error(err)
+//     toast.error('Something went wrong.')
+//   }
+// }
 </script>
 <template>
   <!-- login page -->
@@ -241,13 +242,13 @@ const registerGuest = async () => {
           </RouterLink></span
         >
       </p>
-      <button
+      <!-- <button
         id="register-guest"
         class="rounded-lg py-2 mt-3 bg-bg-primary text-text-secondary w-full border-text-secondary border-2"
         @click="registerGuest()"
       >
         {{ t('authform.continue_as_guest') }}
-      </button>
+      </button> -->
     </form>
   </div>
 </template>

bun.lock

@@ -133,6 +133,7 @@
         "passport-google-oidc": "^0.1.0",
         "passport-jwt": "^4.0.1",
         "passport-local": "^1.0.0",
+        "rate-limiter-flexible": "^11.2.3",
         "socket.io": "^4.7.1",
         "swagger-ui-express": "^5.0.0",
         "validator": "^13.15.22",
@@ -1604,6 +1605,8 @@
 
     "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],
 
+    "rate-limiter-flexible": ["rate-limiter-flexible@11.2.3", "", {}, "sha512-w4HX4toAsEbu1VksOauZwI9d6URb6/4WqJJ5Hg1bESihMt2KJfQ2iTwvDkhIg+y2HetLh65DGu/8xIkUz/xNPA=="],
+
     "raw-body": ["raw-body@2.5.3", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "unpipe": "~1.0.0" } }, "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],

docker-compose.prod.yml

@@ -1,6 +1,7 @@
 services:
   traefik:
     image: traefik:v3.6.9
+    restart: always
     ports:
       - 8000:8000
       - 8080:8080

docker-compose.yml

@@ -1,4 +1,3 @@
-version: '3'
 services:
   traefik:
     image: traefik:v3.6.9
@@ -22,7 +21,6 @@ services:
 
   db:
     image: mongo:6
-    restart: always
     networks:
       - internal
     ports:

server/package.json

@@ -38,6 +38,7 @@
     "passport-google-oidc": "^0.1.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
+    "rate-limiter-flexible": "^11.2.3",
     "socket.io": "^4.7.1",
     "swagger-ui-express": "^5.0.0",
     "validator": "^13.15.22",

server/src/api/routes/authRouter.ts

@@ -73,7 +73,7 @@ async function recordLogin(req: Request, success: boolean, message: string) {
 
 router.post('/register', authenticateRateLimit, registerValidators, register)
 
-router.post('/register-guest', authenticateRateLimit, registerGuest)
+// router.post('/register-guest', authenticateRateLimit, registerGuest)
 
 router.post('/logout', logout)
 

server/src/middleware/rateLimiter.ts

@@ -1,9 +1,12 @@
 import rateLimit from 'express-rate-limit'
 import type { Options } from 'express-rate-limit'
 import type { Request, Response, NextFunction } from 'express'
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+import { TRPCError } from '@trpc/server'
 import { LoginAttempt } from '@odyssey/models'
 import config from '../config.js'
 import logger from '../utils/logger.js'
+import { middleware } from '../trpc.js'
 
 function createRateLimiter(options: Partial<Options>) {
   if (config.testing.enabled) {
@@ -22,13 +25,32 @@ export const authenticateRateLimit = createRateLimiter({
   max: 5,
 })
 
-export const sessionRateLimit = createRateLimiter({
-  windowMs: 10 * 1000,
-  max: 1,
-  keyGenerator: (req: Request) => {
-    return req.user ? (req.user as any)._id : req.ip || ''
-  },
-})
+export function trpcRateLimit({
+  points,
+  duration,
+}: {
+  points: number
+  duration: number
+}) {
+  const limiter = new RateLimiterMemory({ points, duration })
+  return middleware(async (opts) => {
+    if (config.testing.enabled) {
+      return opts.next()
+    }
+    const key = opts.ctx.user?.id ?? opts.ctx.ip ?? ''
+    try {
+      await limiter.consume(key)
+    } catch {
+      throw new TRPCError({
+        code: 'TOO_MANY_REQUESTS',
+        message: 'Too many requests. Please try again later.',
+      })
+    }
+    return opts.next()
+  })
+}
+
+export const sessionRateLimit = trpcRateLimit({ points: 3, duration: 60 })
 
 export async function rateLimitByAccount(
   req: Request,

server/src/routers/sessionRouter.ts

@@ -8,6 +8,7 @@ import config from '../config.js'
 import { protectedProcedure, router } from '../trpc.js'
 import { questManager } from '../models/quest.js'
 import { genJWT } from '../utils/auth'
+import { sessionRateLimit } from '../middleware/rateLimiter.js'
 
 export type SessionDetail = Awaited<ReturnType<typeof sessionDetail>>
 
@@ -47,6 +48,7 @@ async function sessionDetail(session: ISession) {
 
 export const sessionRouter = router({
   createSession: protectedProcedure
+    .use(sessionRateLimit)
     .input(
       z.object({
         questId: z.string(),

server/src/trpc.ts

@@ -18,7 +18,7 @@ const t = initTRPC.context<AppContext>().create()
  * Export reusable router and procedure helpers
  * that can be used throughout the router
  */
-export const { router, procedure: publicProcedure } = t
+export const { router, procedure: publicProcedure, middleware } = t
 
 export const protectedProcedure = publicProcedure.use(async (opts) => {
   if (opts.ctx.isAuthenticated() && !('newUser' in opts.ctx.user)) {