From 3106ae00d0f87e6ab3c23090d1c10cb6bc421683 Mon Sep 17 00:00:00 2001 From: Justin Lin Date: Tue, 3 Nov 2026 20:10:04 +1100 Subject: [PATCH 1/3] feat: set traefik always restart --- docker-compose.prod.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index a84538c..7f1732b 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -1,6 +1,7 @@ services: traefik: image: traefik:v3.6.9 + restart: always ports: - 8000:8000 - 8080:8080 From 9ffcd9fa905a08b8f6c7d5b3b0cfa960765b2db7 Mon Sep 17 00:00:00 2001 From: Justin Lin Date: Tue, 3 Nov 2026 20:18:15 +1100 Subject: [PATCH 2/3] fix: disable guest login --- app/src/components/AuthForm.vue | 23 ++++++++++++----------- docker-compose.yml | 2 -- server/src/api/routes/authRouter.ts | 2 +- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/app/src/components/AuthForm.vue b/app/src/components/AuthForm.vue index 563f744..4ec3f05 100644 --- a/app/src/components/AuthForm.vue +++ b/app/src/components/AuthForm.vue @@ -87,15 +87,16 @@ const handleChange = () => { } } -const registerGuest = async () => { - try { - await api.post('/auth/register-guest') - router.push({ name: 'map' }) - } catch (err) { - console.error(err) - toast.error('Something went wrong.') - } -} +// Guest account currently disabled +// const registerGuest = async () => { +// try { +// await api.post('/auth/register-guest') +// router.push({ name: 'map' }) +// } catch (err) { +// console.error(err) +// toast.error('Something went wrong.') +// } +// } diff --git a/docker-compose.yml b/docker-compose.yml index 716fc98..e138ed0 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,4 +1,3 @@ -version: '3' services: traefik: image: traefik:v3.6.9 @@ -22,7 +21,6 @@ services: db: image: mongo:6 - restart: always networks: - internal ports: diff --git a/server/src/api/routes/authRouter.ts b/server/src/api/routes/authRouter.ts index 0148e23..74bc788 100644 --- a/server/src/api/routes/authRouter.ts +++ b/server/src/api/routes/authRouter.ts @@ -73,7 +73,7 @@ async function recordLogin(req: Request, success: boolean, message: string) { router.post('/register', authenticateRateLimit, registerValidators, register) -router.post('/register-guest', authenticateRateLimit, registerGuest) +// router.post('/register-guest', authenticateRateLimit, registerGuest) router.post('/logout', logout) From b510d187584a30b712f80b99014e628d5beb5575 Mon Sep 17 00:00:00 2001 From: Justin Lin Date: Tue, 3 Nov 2026 20:28:04 +1100 Subject: [PATCH 3/3] feat: add rate limit to session creation --- bun.lock | 3 +++ server/package.json | 1 + server/src/middleware/rateLimiter.ts | 36 ++++++++++++++++++++++------ server/src/routers/sessionRouter.ts | 2 ++ server/src/trpc.ts | 2 +- 5 files changed, 36 insertions(+), 8 deletions(-) diff --git a/bun.lock b/bun.lock index f93bacf..6620b14 100644 --- a/bun.lock +++ b/bun.lock @@ -133,6 +133,7 @@ "passport-google-oidc": "^0.1.0", "passport-jwt": "^4.0.1", "passport-local": "^1.0.0", + "rate-limiter-flexible": "^11.2.3", "socket.io": "^4.7.1", "swagger-ui-express": "^5.0.0", "validator": "^13.15.22", @@ -1604,6 +1605,8 @@ "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="], + "rate-limiter-flexible": ["rate-limiter-flexible@11.2.3", "", {}, "sha512-w4HX4toAsEbu1VksOauZwI9d6URb6/4WqJJ5Hg1bESihMt2KJfQ2iTwvDkhIg+y2HetLh65DGu/8xIkUz/xNPA=="], + "raw-body": ["raw-body@2.5.3", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "unpipe": "~1.0.0" } }, "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA=="], "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="], diff --git a/server/package.json b/server/package.json index b42e9bc..a43f5ce 100644 --- a/server/package.json +++ b/server/package.json @@ -38,6 +38,7 @@ "passport-google-oidc": "^0.1.0", "passport-jwt": "^4.0.1", "passport-local": "^1.0.0", + "rate-limiter-flexible": "^11.2.3", "socket.io": "^4.7.1", "swagger-ui-express": "^5.0.0", "validator": "^13.15.22", diff --git a/server/src/middleware/rateLimiter.ts b/server/src/middleware/rateLimiter.ts index 43adaa5..bed6558 100644 --- a/server/src/middleware/rateLimiter.ts +++ b/server/src/middleware/rateLimiter.ts @@ -1,9 +1,12 @@ import rateLimit from 'express-rate-limit' import type { Options } from 'express-rate-limit' import type { Request, Response, NextFunction } from 'express' +import { RateLimiterMemory } from 'rate-limiter-flexible' +import { TRPCError } from '@trpc/server' import { LoginAttempt } from '@odyssey/models' import config from '../config.js' import logger from '../utils/logger.js' +import { middleware } from '../trpc.js' function createRateLimiter(options: Partial) { if (config.testing.enabled) { @@ -22,13 +25,32 @@ export const authenticateRateLimit = createRateLimiter({ max: 5, }) -export const sessionRateLimit = createRateLimiter({ - windowMs: 10 * 1000, - max: 1, - keyGenerator: (req: Request) => { - return req.user ? (req.user as any)._id : req.ip || '' - }, -}) +export function trpcRateLimit({ + points, + duration, +}: { + points: number + duration: number +}) { + const limiter = new RateLimiterMemory({ points, duration }) + return middleware(async (opts) => { + if (config.testing.enabled) { + return opts.next() + } + const key = opts.ctx.user?.id ?? opts.ctx.ip ?? '' + try { + await limiter.consume(key) + } catch { + throw new TRPCError({ + code: 'TOO_MANY_REQUESTS', + message: 'Too many requests. Please try again later.', + }) + } + return opts.next() + }) +} + +export const sessionRateLimit = trpcRateLimit({ points: 3, duration: 60 }) export async function rateLimitByAccount( req: Request, diff --git a/server/src/routers/sessionRouter.ts b/server/src/routers/sessionRouter.ts index 84fdaf5..ac814a0 100644 --- a/server/src/routers/sessionRouter.ts +++ b/server/src/routers/sessionRouter.ts @@ -8,6 +8,7 @@ import config from '../config.js' import { protectedProcedure, router } from '../trpc.js' import { questManager } from '../models/quest.js' import { genJWT } from '../utils/auth' +import { sessionRateLimit } from '../middleware/rateLimiter.js' export type SessionDetail = Awaited> @@ -47,6 +48,7 @@ async function sessionDetail(session: ISession) { export const sessionRouter = router({ createSession: protectedProcedure + .use(sessionRateLimit) .input( z.object({ questId: z.string(), diff --git a/server/src/trpc.ts b/server/src/trpc.ts index 8e7c939..a26a06c 100644 --- a/server/src/trpc.ts +++ b/server/src/trpc.ts @@ -18,7 +18,7 @@ const t = initTRPC.context().create() * Export reusable router and procedure helpers * that can be used throughout the router */ -export const { router, procedure: publicProcedure } = t +export const { router, procedure: publicProcedure, middleware } = t export const protectedProcedure = publicProcedure.use(async (opts) => { if (opts.ctx.isAuthenticated() && !('newUser' in opts.ctx.user)) {