diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/api')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/api/users.py | 51 |
1 files changed, 48 insertions, 3 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py index 05bf075..702d687 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/users.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py @@ -130,6 +130,10 @@ class RefreshRequest(BaseModel): # ── Endpoints ───────────────────────────────────────────────────────────────── +# Between two verification mails to one pending account. +VERIFICATION_RESEND_COOLDOWN = 120 + + @router.post("/register", status_code=201) @limiter.limit("5/minute") async def register( @@ -147,9 +151,26 @@ async def register( if found.status == "pending" and found.email_hash == eh: # Same person retrying before validation — resend a code. # No captcha: the initial registration already passed it. - await _create_and_send_verification( - db, found, body.email, eh, body.recovery_key) - await db.commit() + # + # Which made this the widest of the three mail doors: no token, no + # captcha, and the username and address are the caller's own from + # a moment ago. Registering a victim's address once bought the + # right to mail them at the endpoint's rate limit for ever. + # `mail.py` bounds the recipient regardless, and this stops the + # door being hammered — the answer is the same either way, which + # is the one this endpoint has always given. + recent = await db.execute( + select(EmailVerification).where( + EmailVerification.user_id == found.id, + EmailVerification.purpose == "registration", + EmailVerification.created_at + > datetime.now(timezone.utc) + - timedelta(seconds=VERIFICATION_RESEND_COOLDOWN), + )) + if not recent.first(): + await _create_and_send_verification( + db, found, body.email, eh, body.recovery_key) + await db.commit() return {"user_id": found.id, "email_verification_required": True} raise HTTPException(status_code=409, detail="Username already taken") @@ -640,6 +661,7 @@ class UpdateProfileRequest(BaseModel): # the account's, not the caller's IP: the point is the mailbox on the receiving # end, and an IP is not what fills it. EMAIL_CHANGE_COOLDOWN = 60 +MAX_EMAIL_CHANGES_PER_DAY = 3 @router.patch("/me") @@ -680,6 +702,27 @@ async def update_profile( status_code=429, detail="A code was just sent. Wait a minute before asking again.") + # And a ceiling per day, because the cooldown alone still allows one + # stranger a minute — 1440 a day, from one account, on a hub where + # registration is open. This is the only path where a signed-in + # account chooses the recipient, so it is the only one that needs it. + # + # Counted from the IP log, not from EmailVerification: the block below + # deletes this account's unverified rows before writing a new one, so + # counting those would have counted one, always. (Which is what the + # first version of this did.) The log entry is worth having for its + # own sake — this endpoint wrote none, alone among the ones that mail. + today = await db.execute( + select(func.count()).select_from(IPLog).where( + IPLog.user_id == current_user.id, + IPLog.event == "email_change_request", + IPLog.timestamp > datetime.now(timezone.utc) - timedelta(days=1), + )) + if (today.scalar() or 0) >= MAX_EMAIL_CHANGES_PER_DAY: + raise HTTPException( + status_code=429, + detail="Too many address changes today. Try again tomorrow.") + # Check that no other active/pending account uses this email dup = await db.execute( select(User).where( @@ -709,6 +752,8 @@ async def update_profile( user_id=current_user.id, expires_at=datetime.now(timezone.utc) + timedelta(seconds=VERIFICATION_TTL), )) + db.add(IPLog(user_id=current_user.id, event="email_change_request", + ip_address=client_ip(request))) await db.flush() await mail.send_off_loop(mail.send_email_change_code, new_email, code) pending_email = new_email |