@social-mail/social-mail-web-server 1.9.32 → 1.9.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@social-mail/social-mail-web-server",
-  "version": "1.9.32",
+  "version": "1.9.33",
   "description": "## Phase 1",
   "main": "index.js",
   "type": "module",

package/src/server/model/entities/User.ts

@@ -135,6 +135,9 @@ export class User {
     @Column({ dataType: "Boolean", default: () => false })
     public isGroup: boolean;
 
+    @Column({ dataType: "DateTime", nullable: true})
+    public loginLockedTill: DateTime;
+
     @JsonProperty({ help: "Save this to change password"})
     public changePassword: ChangePassword;
 

package/src/server/model/events/LoginSessionEvents.ts

@@ -18,6 +18,8 @@ import { AppStringHelper } from "../../../common/AppStringHelper.js";
 import { randomUUID } from "node:crypto";
 import RateLimiterService from "../../services/rate-limiter/RateLimiterService.js";
 import ExternalInvoke from "@entity-access/server-pages/dist/decorators/ExternalInvoke.js";
+import WorkflowContext from "@entity-access/entity-access/dist/workflows/WorkflowContext.js";
+import FailedLoginLockWorkflow from "../../workflows/user/login/FailedLoginLockWorkflow.js";
 
 export default class LoginSessionEvents extends EntityEvents<LoginSession> {
 
@@ -36,6 +38,9 @@ export default class LoginSessionEvents extends EntityEvents<LoginSession> {
     @Inject
     private rateLimiterService: RateLimiterService;
 
+    @Inject
+    private wc: WorkflowContext;
+
     @ExternalQuery
     currentUser() {
         const { sessionID = 0, userID = 0 } = this.sessionUser;
@@ -103,6 +108,9 @@ export default class LoginSessionEvents extends EntityEvents<LoginSession> {
             throw new EntityAccessError("Invalid username");
         }
 
+        if (user.loginLockedTill && DateTime.from(user.loginLockedTill).msSinceEpoch > Date.now()) {
+            throw new EntityAccessError(`Too many failed login attempts try after some time`);
+        }
 
         const { checkPassword, passwordIsAccessToken } = entity;
         const now = DateTime.now;
@@ -216,6 +224,9 @@ export default class LoginSessionEvents extends EntityEvents<LoginSession> {
     async afterInsert(entity: LoginSession, entry: ChangeEntry) {
 
         if (entity.status !== "created") {
+
+            await FailedLoginLockWorkflow.queue(this.wc, entity);
+
             await this.sessionUser.setAuthCookie({
                 userID: entity.userID,
                 sessionID: entity.sessionID,
@@ -350,6 +361,8 @@ export default class LoginSessionEvents extends EntityEvents<LoginSession> {
                 return;
             }
 
+            await FailedLoginLockWorkflow.cancel(this.wc, entity);
+
             await this.sessionUser.setAuthCookie({
                 userID: entity.userID,
                 sessionID: entity.sessionID,

package/src/server/workflows/SocialWorkflowContext.ts

@@ -57,6 +57,7 @@ import { AppWorkflowContext } from "./AppWorkflowContext.js";
 import DeleteFileHistoryWorkflow from "./files/DeleteFileHistoryWorkflow.js";
 import IndexEmailTextContentWorkflow from "./email/index/IndexEmailTextContentWorkflow.js";
 import IndexEmailAddressWorkflow from "./email/index/IndexEmailAddressWorkflow.js";
+import FailedLoginLockWorkflow from "./user/login/FailedLoginLockWorkflow.js";
 
 @RegisterSingleton
 export default class SocialWorkflowContext extends AppWorkflowContext {
@@ -100,6 +101,10 @@ export default class SocialWorkflowContext extends AppWorkflowContext {
         // this.register(MigrateEmailFilesWorkflow);
         this.register(CleanupDeletedFilesWorkflow);
 
+
+        this.register(FailedLoginLockWorkflow);
+
+
         this.register(PendingPostReceiveWorkflow);
         this.register(PendingReferencesWorkflow);
 

package/src/server/workflows/user/login/FailedLoginLockWorkflow.ts

@@ -0,0 +1,53 @@
+import TimeSpan from "@entity-access/entity-access/dist/types/TimeSpan.js";
+import Workflow, { UniqueActivity } from "@entity-access/entity-access/dist/workflows/Workflow.js";
+import SocialMailContext from "../../../model/SocialMailContext.js";
+import Inject from "@entity-access/entity-access/dist/di/di.js";
+import Sql from "@entity-access/entity-access/dist/sql/Sql.js";
+import DateTime from "@entity-access/entity-access/dist/types/DateTime.js";
+import WorkflowContext from "@entity-access/entity-access/dist/workflows/WorkflowContext.js";
+import type LoginSession from "../../../model/entities/LoginSession.js";
+
+export default class FailedLoginLockWorkflow extends Workflow<{ userID }> {
+
+    static async queue(wc: WorkflowContext, { userID, sessionID }: LoginSession) {
+        return wc.queue(FailedLoginLockWorkflow, { userID }, { id: `track-failed-login-${sessionID}`});
+    }
+
+    static async cancel(wc: WorkflowContext, { sessionID }: LoginSession) {
+        return wc.storage.delete(`track-failed-login-${sessionID}`);
+    }
+
+    async run() {
+        this.preserveTime = TimeSpan.fromMinutes(1);
+        await this.delay(TimeSpan.fromMinutes(5));
+
+        await this.lockUser();
+    }
+
+    @UniqueActivity
+    async lockUser(
+        @Inject
+        db?: SocialMailContext
+    ) {
+        const max = 5;
+
+        const all = await db.loginSessions.where(this.input, (p) => (x) => x.userID === p.userID
+                && x.status !== "created"
+                && x.dateUpdated > Sql.date.addMinutes(Sql.date.now(), -5)
+            )
+            .orderByDescending(void 0, (p) => (x) => x.sessionID)
+            .limit(max)
+            .count();
+
+        if (max !== all) {
+            return;
+        }
+
+        const loginLockedTill = DateTime.now.addHours(1);
+        const { userID } = this.input;
+
+        await db.users.statements.update({ loginLockedTill }, { userID });
+    }
+
+
+}