@vex-chat/spire 1.10.0 → 1.10.2

package/src/server/index.ts

@@ -5,7 +5,7 @@
  */
 
 import type { Database } from "../Database.ts";
-import type { Emoji } from "@vex-chat/types";
+import type { Device, Emoji } from "@vex-chat/types";
 
 import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -147,21 +147,45 @@ const checkAuth: express.RequestHandler = (req, _res, next) => {
     next();
 };
 
-const checkDevice: express.RequestHandler = (req, _res, next) => {
-    const token = req.headers["x-device-token"];
-    if (typeof token === "string" && token) {
-        try {
-            const result = jwt.verify(token, getJwtSecret());
-            const parsed = jwtDevicePayload.safeParse(result);
-            if (parsed.success) {
-                req.device = parsed.data.device;
+export function createCheckDevice(
+    db: Pick<Database, "retrieveDevice">,
+): express.RequestHandler {
+    return async (req, _res, next) => {
+        const token = req.headers["x-device-token"];
+        if (typeof token === "string" && token) {
+            try {
+                const result = jwt.verify(token, getJwtSecret());
+                const parsed = jwtDevicePayload.safeParse(result);
+                if (parsed.success) {
+                    const device = await currentTokenDevice(
+                        db,
+                        parsed.data.device,
+                    );
+                    if (
+                        device &&
+                        (!req.user || device.owner === req.user.userID)
+                    ) {
+                        req.device = device;
+                    }
+                }
+            } catch {
+                // Device token verification/revalidation failed — continue without device.
             }
-        } catch {
-            // Device token verification failed — continue without device
         }
+        next();
+    };
+}
+
+async function currentTokenDevice(
+    db: Pick<Database, "retrieveDevice">,
+    tokenDevice: Device,
+): Promise<Device | null> {
+    const device = await db.retrieveDevice(tokenDevice.deviceID);
+    if (!device || device.signKey !== tokenDevice.signKey) {
+        return null;
     }
-    next();
-};
+    return device;
+}
 
 export const protect: express.RequestHandler = (req, res, next) => {
     if (!req.user) {
@@ -282,7 +306,7 @@ export const initApp = (
     api.use(helmet());
     api.use(msgpackParser);
     api.use(checkAuth);
-    api.use(checkDevice);
+    api.use(createCheckDevice(db));
 
     api.get("/server/:id", protect, async (req, res) => {
         const server = await db.retrieveServer(getParam(req, "id"));

package/src/server/rateLimit.ts

@@ -83,14 +83,14 @@ const keyByIp = (req: Request): string => ipKeyGenerator(req.ip ?? "");
 /**
  * Global per-IP limiter. Applied app-wide via `api.use(globalLimiter)`.
  *
- * 3000 requests per 15 minutes per client IP. A human chatting via a
- * browser or the libvex client won't come close; a single-host DoS
- * gets throttled quickly.
+ * 150,000 requests per 15 minutes per client IP. This leaves room for
+ * high-throughput clients and algorithmic applications while still
+ * putting a ceiling on runaway single-host traffic.
  */
 export const globalLimiter = rateLimit({
     keyGenerator: keyByIp,
     legacyHeaders: false,
-    limit: 3000,
+    limit: 150_000,
     skip: devApiKeySkipsRateLimits,
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,