spam.ts

2.4 KB · raw
1import type { Database } from "bun:sqlite";2import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";3import type { Context } from "hono";4import { getCookie, setCookie } from "hono/cookie";5import { clientIp } from "../server/client.ts";6import { setting } from "../server/db.ts";78// §23's spam defenses, all server-side: nothing here trusts a clock or a value from the browser.9export const MIN_SECONDS_ON_PAGE = 3;10const STAMP_MAX_AGE = 86400;11export const FILINGS_PER_HOUR = 5;12export const REPLIES_PER_HOUR = 20;13export const MAX_CHARS = 20_000;14const FORM_COOKIE = "kepr_form";15const HEX = /^[0-9a-f]{32,64}$/;1617/** One random key, made on first use and kept in kepr.db, for the IP hash and the form stamps. */18function secret(db: Database): string {19	db.query("INSERT OR IGNORE INTO settings (key, value) VALUES ('issue_secret', ?)").run(20		randomBytes(32).toString("hex"),21	);22	return setting(db, "issue_secret") as string;23}2425function mac(db: Database, message: string): string {26	return createHmac("sha256", secret(db)).update(message).digest("hex");27}2829/** A keyed hash, so the stored value can't be reversed by hashing every IPv4 address. */30export function ipHash(db: Database, c: Context): string {31	return mac(db, `ip:${clientIp(c)}`);32}3334/**35 * SameSite=Strict so a cross-site post arrives without it, and a form stamp36 * `<unix time>.<HMAC(time, cookie)>`.37 */38export function formStamp(db: Database, c: Context, now: number): string {39	let cookie = getCookie(c, FORM_COOKIE);40	if (!cookie || !HEX.test(cookie)) {41		cookie = randomBytes(16).toString("hex");42		setCookie(c, FORM_COOKIE, cookie, {43			httpOnly: true,44			secure: true,45			sameSite: "Strict",46			path: "/",47		});48	}49	return `${now}.${mac(db, `form:${now}:${cookie}`)}`;50}5152export type StampCheck = "ok" | "invalid" | "too-fast";5354export function checkStamp(db: Database, c: Context, stamp: string, now: number): StampCheck {55	const cookie = getCookie(c, FORM_COOKIE);56	const [time, signature] = stamp.split(".");57	if (!cookie || !time || !signature || !/^\d{1,12}$/.test(time)) return "invalid";58	const expected = Buffer.from(mac(db, `form:${time}:${cookie}`));59	const given = Buffer.from(signature);60	if (given.length !== expected.length || !timingSafeEqual(given, expected)) return "invalid";61	const age = now - Number(time);62	if (age > STAMP_MAX_AGE || age < 0) return "invalid";63	return age < MIN_SECONDS_ON_PAGE ? "too-fast" : "ok";64}