5244064 · 3166abf
@@ -359,7 +359,7 @@
import {
  undoFleetOp,
  type FleetError,
} from "../actions/fleet.ts";
import { sessionCookie } from "../web/pages/site.ts";
import { sessionCookie, signupAllowed } from "../web/pages/site.ts";
import { cookieValue, crossOrigin, type Ctx, type Handler } from "./context.ts";
import {
  apiError,
@@ -1193,6 +1193,13 @@
export function apiRoutes(router: Router<Handler>): void {
  // ── accounts ─────────────────────────────────────────────────────────
  router.add("POST", "/api/v1/users", async (ctx) => {
    const wait = signupAllowed(ctx);
      
        sentinelcrew
        28d ago
        
      
      This check runs before boundedBody, so a throttled stranger costs no read. It spends the same window as the form, keyed on clientAddress, never on a header the client wrote. Good.
    
    if (wait !== undefined)
      return json(
        { error: "rate_limited", message: "too many sign-ups; wait and send again" },
        429,
        { "retry-after": String(wait) },
      );
    // Anyone may call this, so its body is a stranger's (`http/limits.ts`).
    const input = await boundedBody(ctx.request, STRANGER_MAX);
    if (input === "too_large")
@@ -461,7 +461,8 @@
export function signinAllowed(ctx: Ctx, username: string): number | undefined {
 * Sign-ups, throttled the same way, by the socket's peer (`clientAddress`,
 * which reads a forwarding header only from a proxy the operator trusts):
 * a source may make a few accounts a minute and the forge as a whole more.
      
        sentinelcrew
        28d ago
        outdated
      
      #2322 is closed (split). The doors still to come are #2363 (form) and #2365 (passkey/OAuth), with #2374 for the terminal. Name those so the next reader lands on open work. Worth folding into whichever of them touches this comment next.
    
 * Asked by the signup form only. A refused call is not counted.
 * Asked by the signup form and the API signup, which share one window; the
 * passkey door follows (#2322). A refused call is not counted.
 */
const signupLimits = new WeakMap<Ctx["app"], RateLimiter>();
@@ -4,6 +4,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import {
  startNotifier,
  setNotifyUrl,
@@ -62,6 +63,7 @@
describe("accounts: the owner sees, suspends and removes", () => {
      edgeToken: EDGE,
    });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
    const owner = await signUp(app, {
      username: "olive",
@@ -10,6 +10,7 @@
import { mkdtemp, readFile, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { oauthCallbackUri } from "../src/http/api.ts";
import { listEvents } from "../src/core/events.ts";
@@ -173,6 +174,7 @@
describe("OAuth code flow: state, PKCE, redirects, and the callback URI", () =>
    fake = serveFakeForge(state);
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
    caller = callerFor(base);
    await createUsers(base, ["alice", "bob"]);
@@ -477,6 +479,7 @@
describe("OAuth device flow: a flow is private to the user who started it", () =
    fake = serveFakeForge(state);
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    api = callerFor(servers.url);
    await createUsers(servers.url, ["alice", "bob"]);
    proveAll(app);
@@ -589,6 +592,7 @@
describe("refresh serialisation and needs_reauth", () => {
    fake = serveFakeForge(state);
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    api = callerFor(servers.url);
    await createUsers(servers.url, ["alice"]);
    proveAll(app);
@@ -3,6 +3,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { createOrg } from "../src/actions/orgs.ts";
import { createOrg as foundOrg } from "../src/core/orgs.ts";
import { signUp, updateProfile } from "../src/actions/users.ts";
@@ -28,6 +29,7 @@
describe("reserved names", () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-reserved-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
    // The owner is the first account; the crew are agents.
    const owner = await signUp(app, {
@@ -0,0 +1,72 @@
/**
 * POST /api/v1/users asks signupAllowed: past the per-source limit it answers
 * 429 with retry-after and a JSON error, and refuses without making a user.
 * The form asks the same function, so one window serves both.
 */
import { afterAll, beforeEach, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { getUserByName } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
describe("API signup throttle", () => {
  const cleanup: Array<() => Promise<void>> = [];
  let app: App;
  let servers: Servers;
  let n = 0;
  beforeEach(async () => {
    const dataDir = await mkdtemp(join(tmpdir(), "forge-signup-throttle-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    cleanup.push(async () => {
      await servers.stop();
      await rm(dataDir, { recursive: true, force: true });
    });
  });
  afterAll(async () => {
    for (const c of cleanup) await c();
  });
  const signup = (name = `person${++n}`) =>
    fetch(`${servers.url.replace("localhost", "127.0.0.1")}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        username: name,
        email: `${name}@outsider.test`,
        password: "a-good-passphrase",
      }),
    });
  test("the sixth signup from one source is 429 with retry-after, and makes no user", async () => {
    for (let i = 0; i < 5; i++) expect((await signup()).status).toBe(201);
    const refused = await signup("sixth");
    expect(refused.status).toBe(429);
    const wait = Number(refused.headers.get("retry-after"));
    expect(wait).toBeGreaterThan(0);
    expect(wait).toBeLessThanOrEqual(60);
    expect(((await refused.json()) as { error: string }).error).toBe("rate_limited");
    expect(getUserByName(app.db, "sixth")).toBeUndefined();
  });
  test("a form signup spends the same window the API draws on", async () => {
    const url = servers.url.replace("localhost", "127.0.0.1");
    const form = await fetch(`${url}/signup`, {
      method: "POST",
      
        sentinelcrew
        28d ago
        outdated
      
      Fair stand-in, given #2364 says no other door changes. The test name says "a form signup", but what it proves is that a direct signupAllowed call and the API share one window. When #2363 wires the form, replace the direct call with a real POST /signup so this test proves what its name says.
    
      headers: { "content-type": "application/x-www-form-urlencoded", origin: url },
      body: new URLSearchParams({
        username: "formperson",
        email: "[email protected]",
        password: "a-good-passphrase",
      }),
      redirect: "manual",
    });
    expect(form.status).toBe(303);
    for (let i = 0; i < 4; i++) expect((await signup()).status).toBe(201);
    expect((await signup()).status).toBe(429);
  });
});
@@ -8,6 +8,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { setSignup, type SignupMode } from "../src/settings/signup.ts";
import { signUp, signUpWithPasskey } from "../src/actions/users.ts";
import { getUserByName } from "../src/core/users.ts";
@@ -26,6 +27,7 @@
describe("closed signup", () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signup-closed-"));
    app = createApp({ dataDir, port: 0, url: "https://forge.example", edgeToken: TOKEN });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
  });
  afterAll(async () => {
@@ -9,6 +9,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { configProblem } from "../src/kernel/preflight.ts";
import { BOOT_ACTOR, getSignup, setSignup, signupChanges, signupFromEnv } from "../src/settings/signup.ts";
import { createSession } from "../src/core/sessions.ts";
@@ -183,6 +184,7 @@
describe("signup closed (#2166)", () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-signup-closed-"));
    app = createApp({ dataDir, port: 0, edgeToken: EDGE });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
  });
  afterAll(async () => {
    await servers.stop();
@@ -4,6 +4,7 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { Database } from "bun:sqlite";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { migrations } from "../src/core/schema.ts";
import { signUp } from "../src/actions/users.ts";
import { createToken } from "../src/core/tokens.ts";
@@ -35,6 +36,7 @@
describe("verified email", () => {
      },
    });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
    // The owner predates verification; the first account is never held back.
    const owner = await signUp(app, {
		@@ -359,7 +359,7 @@ import {
359	359	undoFleetOp,
360	360	type FleetError,
361	361	} from "../actions/fleet.ts";
362		import { sessionCookie } from "../web/pages/site.ts";
	362	import { sessionCookie, signupAllowed } from "../web/pages/site.ts";
363	363	import { cookieValue, crossOrigin, type Ctx, type Handler } from "./context.ts";
364	364	import {
365	365	apiError,
		@@ -1193,6 +1193,13 @@ export function apiRoutes(router: Router<Handler>): void {
1193	1193	// ── accounts ─────────────────────────────────────────────────────────
1194	1194
1195	1195	router.add("POST", "/api/v1/users", async (ctx) => {
	1196	const wait = signupAllowed(ctx);
		sentinelcrew 28d ago This check runs before `boundedBody`, so a throttled stranger costs no read. It spends the same window as the form, keyed on `clientAddress`, never on a header the client wrote. Good.
	1197	if (wait !== undefined)
	1198	return json(
	1199	{ error: "rate_limited", message: "too many sign-ups; wait and send again" },
	1200	429,
	1201	{ "retry-after": String(wait) },
	1202	);
1196	1203	// Anyone may call this, so its body is a stranger's (`http/limits.ts`).
1197	1204	const input = await boundedBody(ctx.request, STRANGER_MAX);
1198	1205	if (input === "too_large")
		@@ -461,7 +461,8 @@ export function signinAllowed(ctx: Ctx, username: string): number \| undefined {
461	461	* Sign-ups, throttled the same way, by the socket's peer (`clientAddress`,
462	462	* which reads a forwarding header only from a proxy the operator trusts):
463	463	* a source may make a few accounts a minute and the forge as a whole more.
		sentinelcrew 28d ago outdated #2322 is closed (split). The doors still to come are #2363 (form) and #2365 (passkey/OAuth), with #2374 for the terminal. Name those so the next reader lands on open work. Worth folding into whichever of them touches this comment next.
464		* Asked by the signup form only. A refused call is not counted.
	464	* Asked by the signup form and the API signup, which share one window; the
	465	* passkey door follows (#2322). A refused call is not counted.
465	466	*/
466	467	const signupLimits = new WeakMap<Ctx["app"], RateLimiter>();
467	468
		@@ -4,6 +4,7 @@ import { mkdtemp, rm } from "node:fs/promises";
4	4	import { tmpdir } from "node:os";
5	5	import { join } from "node:path";
6	6	import { createApp, type App } from "../src/app.ts";
	7	import { setLimit } from "../src/settings/limits.ts";
7	8	import {
8	9	startNotifier,
9	10	setNotifyUrl,
		@@ -62,6 +63,7 @@ describe("accounts: the owner sees, suspends and removes", () => {
62	63	edgeToken: EDGE,
63	64	});
64	65	servers = await serve(app);
	66	setLimit(app.db, "signup.per_source", 1000, "setup");
65	67	base = servers.url;
66	68	const owner = await signUp(app, {
67	69	username: "olive",
		@@ -10,6 +10,7 @@ import { mkdtemp, readFile, rm } from "node:fs/promises";
10	10	import { tmpdir } from "node:os";
11	11	import { join } from "node:path";
12	12	import { createApp, type App } from "../src/app.ts";
	13	import { setLimit } from "../src/settings/limits.ts";
13	14	import { serve, type Servers } from "../src/http/server.ts";
14	15	import { oauthCallbackUri } from "../src/http/api.ts";
15	16	import { listEvents } from "../src/core/events.ts";
		@@ -173,6 +174,7 @@ describe("OAuth code flow: state, PKCE, redirects, and the callback URI", () =>
173	174	fake = serveFakeForge(state);
174	175	app = createApp({ dataDir, port: 0 });
175	176	servers = await serve(app);
	177	setLimit(app.db, "signup.per_source", 1000, "setup");
176	178	base = servers.url;
177	179	caller = callerFor(base);
178	180	await createUsers(base, ["alice", "bob"]);
		@@ -477,6 +479,7 @@ describe("OAuth device flow: a flow is private to the user who started it", () =
477	479	fake = serveFakeForge(state);
478	480	app = createApp({ dataDir, port: 0 });
479	481	servers = await serve(app);
	482	setLimit(app.db, "signup.per_source", 1000, "setup");
480	483	api = callerFor(servers.url);
481	484	await createUsers(servers.url, ["alice", "bob"]);
482	485	proveAll(app);
		@@ -589,6 +592,7 @@ describe("refresh serialisation and needs_reauth", () => {
589	592	fake = serveFakeForge(state);
590	593	app = createApp({ dataDir, port: 0 });
591	594	servers = await serve(app);
	595	setLimit(app.db, "signup.per_source", 1000, "setup");
592	596	api = callerFor(servers.url);
593	597	await createUsers(servers.url, ["alice"]);
594	598	proveAll(app);
		@@ -3,6 +3,7 @@ import { mkdtemp, rm } from "node:fs/promises";
3	3	import { tmpdir } from "node:os";
4	4	import { join } from "node:path";
5	5	import { createApp, type App } from "../src/app.ts";
	6	import { setLimit } from "../src/settings/limits.ts";
6	7	import { createOrg } from "../src/actions/orgs.ts";
7	8	import { createOrg as foundOrg } from "../src/core/orgs.ts";
8	9	import { signUp, updateProfile } from "../src/actions/users.ts";
		@@ -28,6 +29,7 @@ describe("reserved names", () => {
28	29	dataDir = await mkdtemp(join(tmpdir(), "forge-reserved-"));
29	30	app = createApp({ dataDir, port: 0 });
30	31	servers = await serve(app);
	32	setLimit(app.db, "signup.per_source", 1000, "setup");
31	33	base = servers.url;
32	34	// The owner is the first account; the crew are agents.
33	35	const owner = await signUp(app, {
		@@ -0,0 +1,72 @@
	1	/**
	2	* POST /api/v1/users asks signupAllowed: past the per-source limit it answers
	3	* 429 with retry-after and a JSON error, and refuses without making a user.
	4	* The form asks the same function, so one window serves both.
	5	*/
	6
	7	import { afterAll, beforeEach, describe, expect, test } from "bun:test";
	8	import { mkdtemp, rm } from "node:fs/promises";
	9	import { tmpdir } from "node:os";
	10	import { join } from "node:path";
	11	import { createApp, type App } from "../src/app.ts";
	12	import { getUserByName } from "../src/core/users.ts";
	13	import { serve, type Servers } from "../src/http/server.ts";
	14
	15	describe("API signup throttle", () => {
	16	const cleanup: Array<() => Promise<void>> = [];
	17	let app: App;
	18	let servers: Servers;
	19	let n = 0;
	20
	21	beforeEach(async () => {
	22	const dataDir = await mkdtemp(join(tmpdir(), "forge-signup-throttle-"));
	23	app = createApp({ dataDir, port: 0 });
	24	servers = await serve(app);
	25	cleanup.push(async () => {
	26	await servers.stop();
	27	await rm(dataDir, { recursive: true, force: true });
	28	});
	29	});
	30	afterAll(async () => {
	31	for (const c of cleanup) await c();
	32	});
	33
	34	const signup = (name = `person${++n}`) =>
	35	fetch(`${servers.url.replace("localhost", "127.0.0.1")}/api/v1/users`, {
	36	method: "POST",
	37	headers: { "content-type": "application/json" },
	38	body: JSON.stringify({
	39	username: name,
	40	email: `${name}@outsider.test`,
	41	password: "a-good-passphrase",
	42	}),
	43	});
	44
	45	test("the sixth signup from one source is 429 with retry-after, and makes no user", async () => {
	46	for (let i = 0; i < 5; i++) expect((await signup()).status).toBe(201);
	47	const refused = await signup("sixth");
	48	expect(refused.status).toBe(429);
	49	const wait = Number(refused.headers.get("retry-after"));
	50	expect(wait).toBeGreaterThan(0);
	51	expect(wait).toBeLessThanOrEqual(60);
	52	expect(((await refused.json()) as { error: string }).error).toBe("rate_limited");
	53	expect(getUserByName(app.db, "sixth")).toBeUndefined();
	54	});
	55
	56	test("a form signup spends the same window the API draws on", async () => {
	57	const url = servers.url.replace("localhost", "127.0.0.1");
	58	const form = await fetch(`${url}/signup`, {
	59	method: "POST",
		sentinelcrew 28d ago outdated Fair stand-in, given #2364 says no other door changes. The test name says "a form signup", but what it proves is that a direct `signupAllowed` call and the API share one window. When #2363 wires the form, replace the direct call with a real POST /signup so this test proves what its name says.
	60	headers: { "content-type": "application/x-www-form-urlencoded", origin: url },
	61	body: new URLSearchParams({
	62	username: "formperson",
	63	email: "[email protected]",
	64	password: "a-good-passphrase",
	65	}),
	66	redirect: "manual",
	67	});
	68	expect(form.status).toBe(303);
	69	for (let i = 0; i < 4; i++) expect((await signup()).status).toBe(201);
	70	expect((await signup()).status).toBe(429);
	71	});
	72	});
		@@ -8,6 +8,7 @@ import { mkdtemp, rm } from "node:fs/promises";
8	8	import { tmpdir } from "node:os";
9	9	import { join } from "node:path";
10	10	import { createApp, type App } from "../src/app.ts";
	11	import { setLimit } from "../src/settings/limits.ts";
11	12	import { setSignup, type SignupMode } from "../src/settings/signup.ts";
12	13	import { signUp, signUpWithPasskey } from "../src/actions/users.ts";
13	14	import { getUserByName } from "../src/core/users.ts";
		@@ -26,6 +27,7 @@ describe("closed signup", () => {
26	27	dataDir = await mkdtemp(join(tmpdir(), "forge-signup-closed-"));
27	28	app = createApp({ dataDir, port: 0, url: "https://forge.example", edgeToken: TOKEN });
28	29	servers = await serve(app);
	30	setLimit(app.db, "signup.per_source", 1000, "setup");
29	31	base = servers.url;
30	32	});
31	33	afterAll(async () => {
		@@ -9,6 +9,7 @@ import { mkdtemp, rm } from "node:fs/promises";
9	9	import { tmpdir } from "node:os";
10	10	import { join } from "node:path";
11	11	import { createApp, type App } from "../src/app.ts";
	12	import { setLimit } from "../src/settings/limits.ts";
12	13	import { configProblem } from "../src/kernel/preflight.ts";
13	14	import { BOOT_ACTOR, getSignup, setSignup, signupChanges, signupFromEnv } from "../src/settings/signup.ts";
14	15	import { createSession } from "../src/core/sessions.ts";
		@@ -183,6 +184,7 @@ describe("signup closed (#2166)", () => {
183	184	dataDir = await mkdtemp(join(tmpdir(), "forge-signup-closed-"));
184	185	app = createApp({ dataDir, port: 0, edgeToken: EDGE });
185	186	servers = await serve(app);
	187	setLimit(app.db, "signup.per_source", 1000, "setup");
186	188	});
187	189	afterAll(async () => {
188	190	await servers.stop();
		@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
4	4	import { join } from "node:path";
5	5	import { Database } from "bun:sqlite";
6	6	import { createApp, type App } from "../src/app.ts";
	7	import { setLimit } from "../src/settings/limits.ts";
7	8	import { migrations } from "../src/core/schema.ts";
8	9	import { signUp } from "../src/actions/users.ts";
9	10	import { createToken } from "../src/core/tokens.ts";
		@@ -35,6 +36,7 @@ describe("verified email", () => {
35	36	},
36	37	});
37	38	servers = await serve(app);
	39	setLimit(app.db, "signup.per_source", 1000, "setup");
38	40	base = servers.url;
39	41	// The owner predates verification; the first account is never held back.
40	42	const owner = await signUp(app, {