bot_challenge_page 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1913d93cd52d599d33f7217bb3714fbf67c82d08a888a3025cc30e51c51e438
-  data.tar.gz: 6e06e420e625a069132ae89a3ef733c1b2c246878e771e3b459ea0cdc351d14e
+  metadata.gz: 2e582326d0a139a9407ccd31a0bbb822d99d51a7040093d22427d563997dbea8
+  data.tar.gz: 68107c7fc6a9aa2d8e3e079e401708c740e3cf6ee840b7be6cc4f7c85e8b64df
 SHA512:
-  metadata.gz: 11504f2622783e4ca4bfb06b981df28260c1903e04a8900fe1797d34cd05bc29bcf3b2a1a6b9c93b85ae0f3a4639ff115699d4a548f6912b839bee62147e595c
-  data.tar.gz: 229ed02d6173b651ffd3cbef26e6444a974a14a1e9e3390d76567774a2385ad38cb4e1c289a78dda2c66f57d0e6a54e375506c9826cdbd7df7f799a7b96f03ff
+  metadata.gz: 3748c684eeca9e6e66b50fa5e0e5fe4b97c328862799a9dee8fc19632974df5c4489e076eede3d67f0ca8d6f5dc16476ae682d938be015606837c232866256ce
+  data.tar.gz: 2b0bf202ef9c4751a07d0acebeaedd722fd4de501b0a0ae94b004b70b03fb77682cd472aa7e1d3a34ff36810ce3b532662751f3cc79c5453c5fa673977afd0db

data/README.md

@@ -169,6 +169,8 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 * Joe's [similar plugin for drupal](https://drupal.org/project/turnstile_protect)
 
+* Joe's [similar plugin for traefik reverse-proxy](https://github.com/libops/captcha-protect)
+
 * [Similar feature built into PHP VuFind app](https://github.com/vufind-org/vufind/pull/4079)
 
 * [My own blog post about this approach](https://bibwild.wordpress.com/2025/01/16/using-cloudflare-turnstile-to-protect-certain-pages-on-a-rails-app/).

data/app/models/bot_challenge_page/config.rb

@@ -71,9 +71,9 @@ module BotChallengePage
     # https://git.drupalcode.org/project/turnstile_protect/-/blob/0dae9f95d48f9d8cae5a8e61e767c69f64490983/src/EventSubscriber/Challenge.php#L140-151
     attribute :rate_limit_discriminator, default: (lambda do |req, config|
       if req.ip.index(":") # ipv6
-        IPAddr.new("#{req.ip}/24").to_string
-      else
         IPAddr.new("#{req.ip}/72").to_string
+      else
+        IPAddr.new("#{req.ip}/24").to_string
       end
     rescue IPAddr::InvalidAddressError
       req.ip

data/app/models/bot_challenge_page/simple_pow1.rb

@@ -0,0 +1,90 @@
+require 'digest'
+require "base64"
+
+module BotChallengePage
+  # A simple proof-of-work algorithm, that we can also do in javascript
+  #
+  # ## Algorithm
+  #
+  # We calculate a deterministic "challenge" based on a secret key (salt?), current time period,
+  # and the specific client request characteristics (prob just client IP).
+  #
+  # The client has to find a prefix than when prepended to the challenge yields a Sha256 hash
+  # that begins with a certain number of zeroes in the hex representtion. The number of zeroes is the "difficulty".
+  # Each zero in hex rep is 4 bits.
+  #
+  # They send the prefix back to us as a solution, and we confirm that when prefixed to
+  # our challenge, and hashed, it has the required number of leading zeroes.
+  #
+  # (TODO: Leading zeroes in a hex represnetation or what?)
+  class SimplePow1
+    # how long is a challenge good for, it will really be good for somewhere between this and 2x this,
+    # since we always try previous challenge to avoid race condition on switch
+    CHALLENGE_PERIOD = 6.minutes
+
+    # how many leading 0 *BITS* -- and time varies a LOT and expands RAPIDLY when we add, we dont' totally knokw what we're doing
+    DEFAULT_DIFFICULTY = 18
+
+    DEFAULT_SECRET = ActiveSupport::KeyGenerator.new(Rails.application.config.secret_key_base).generate_key("BotChallengePage::SimplePow1")
+
+    attr_reader :client_id, :difficulty
+
+    def initialize(client_id:, secret: DEFAULT_SECRET, difficulty: DEFAULT_DIFFICULTY)
+      @client_id = client_id # usually client ip
+      @difficulty = difficulty
+      @secret = secret
+    end
+
+    # challenge is determinsitic based on our secret, the current time, and the client_id
+    def challenge(for_time: Time.now.utc)
+      period_normalized_time = for_time - (for_time.to_i % CHALLENGE_PERIOD)
+
+      Digest::SHA256.hexdigest "#{period_normalized_time.to_s}_#{client_id.to_s}_#{@secret.to_s}"
+    end
+
+    def challenge_for_last_period
+      challenge(for_time: Time.now.utc - CHALLENGE_PERIOD)
+    end
+
+    def challenge_params
+      {
+        challenge: challenge,
+        difficulty: difficulty
+      }
+    end
+
+    # Check solution against current challenge, AND against the previous period's challenge,
+    # in case we just had a race condition, meaning our time goid is actually
+    # min CHALLENGE_PERIOD and max 2 * CHALLENGE_PERIOD
+    #
+    # @param solution [String] *Base64-encoded data*, that when prefixed to the challenge,
+    #   results in a sha256 digest with `difficulty` leading 0 bits.
+    #
+    def verify_solution(solution)
+      solution = Base64.decode64(solution)
+
+      verify_solution_for_challenge(solution, challenge) ||
+        verify_solution_for_challenge(solution, challenge(for_time: Time.now.utc - CHALLENGE_PERIOD))
+    end
+
+    # @param solution [String] actual data, **not** base64 encoded
+    #
+    def verify_solution_for_challenge(aSolution, aChallenge)
+      # there's prob a more efficient mathematical way to do this wihtout converting
+      # to hex string, but this is what we've got.
+      bindigest = Digest::SHA256.digest(aSolution + aChallenge)
+
+      # hopefully we are not going to have a problem with endian-ness here. :(
+
+      bytes_required = (difficulty / 8) + 1
+      prefix_bytes = bindigest.byteslice(0, bytes_required).bytes
+      prefix_bits = prefix_bytes.collect do |byte|
+        reversed_bits = byte.digits(2)
+        reversed_bits.fill(0, reversed_bits.length..7).reverse
+      end.compact.join.slice(0, difficulty)
+
+      prefix_bits == ("0" * difficulty)
+    end
+
+  end
+end

data/lib/bot_challenge_page/version.rb

@@ -1,3 +1,3 @@
 module BotChallengePage
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bot_challenge_page
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Jonathan Rochkind
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-19 00:00:00.000000000 Z
+date: 2025-04-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal
@@ -156,6 +156,8 @@ files:
 - app/controllers/concerns/bot_challenge_page/enforce_filter.rb
 - app/controllers/concerns/bot_challenge_page/rack_attack_init.rb
 - app/models/bot_challenge_page/config.rb
+- app/models/bot_challenge_page/simple_pow1.rb
+- app/models/bot_challenge_page/test.html
 - app/views/bot_challenge_page/_local_turnstile_script_tag.html.erb
 - app/views/bot_challenge_page/_turnstile_widget_placeholder.html.erb
 - app/views/bot_challenge_page/bot_challenge_page/challenge.html.erb