Add rate limits to email routes (#2129)

* add rate limits to email routes * did based only * tweak
bluesky-social · Feb 3, 2024 · 3208420 · 3208420
1 parent 6f66197
commit 3208420
Show file tree

Hide file tree

Showing 4 changed files with 66 additions and 12 deletions.
diff --git a/packages/pds/src/api/com/atproto/server/requestAccountDelete.ts b/packages/pds/src/api/com/atproto/server/requestAccountDelete.ts
@@ -1,9 +1,22 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { DAY, HOUR } from '@atproto/common'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.requestAccountDelete({
+    rateLimit: [
+      {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+      {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+    ],
     auth: ctx.authVerifier.accessCheckTakedown,
     handler: async ({ auth }) => {
       const did = auth.credentials.did

diff --git a/packages/pds/src/api/com/atproto/server/requestEmailConfirmation.ts b/packages/pds/src/api/com/atproto/server/requestEmailConfirmation.ts
@@ -1,9 +1,22 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { DAY, HOUR } from '@atproto/common'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.requestEmailConfirmation({
+    rateLimit: [
+      {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+      {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+    ],
     auth: ctx.authVerifier.accessCheckTakedown,
     handler: async ({ auth }) => {
       const did = auth.credentials.did

diff --git a/packages/pds/src/api/com/atproto/server/requestEmailUpdate.ts b/packages/pds/src/api/com/atproto/server/requestEmailUpdate.ts
@@ -1,9 +1,22 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { DAY, HOUR } from '@atproto/common'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.requestEmailUpdate({
+    rateLimit: [
+      {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+      {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+      },
+    ],
     auth: ctx.authVerifier.accessCheckTakedown,
     handler: async ({ auth }) => {
       const did = auth.credentials.did

diff --git a/packages/pds/src/api/com/atproto/server/requestPasswordReset.ts b/packages/pds/src/api/com/atproto/server/requestPasswordReset.ts
@@ -1,20 +1,35 @@
+import { DAY, HOUR } from '@atproto/common'
 import AppContext from '../../../../context'
 import { Server } from '../../../../lexicon'
 
 export default function (server: Server, ctx: AppContext) {
-  server.com.atproto.server.requestPasswordReset(async ({ input }) => {
-    const email = input.body.email.toLowerCase()
+  server.com.atproto.server.requestPasswordReset({
+    rateLimit: [
+      {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ input }) => input.body.email.toLowerCase(),
+      },
+      {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ input }) => input.body.email.toLowerCase(),
+      },
+    ],
+    handler: async ({ input }) => {
+      const email = input.body.email.toLowerCase()
 
-    const user = await ctx.services.account(ctx.db).getAccountByEmail(email)
+      const user = await ctx.services.account(ctx.db).getAccountByEmail(email)
 
-    if (user) {
-      const token = await ctx.services
-        .account(ctx.db)
-        .createEmailToken(user.did, 'reset_password')
-      await ctx.mailer.sendResetPassword(
-        { handle: user.handle, token },
-        { to: user.email },
-      )
-    }
+      if (user) {
+        const token = await ctx.services
+          .account(ctx.db)
+          .createEmailToken(user.did, 'reset_password')
+        await ctx.mailer.sendResetPassword(
+          { handle: user.handle, token },
+          { to: user.email },
+        )
+      }
+    },
   })
 }