@vex-chat/spire 1.10.1 → 1.10.3

package/src/server/mailIngress.ts

@@ -0,0 +1,60 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, MailWS } from "@vex-chat/types";
+
+export interface ValidatedMailIngress {
+    readonly recipientDevice: Device;
+}
+
+export class MailIngressValidationError extends Error {
+    public readonly status: number;
+
+    public constructor(status: number, message: string) {
+        super(message);
+        this.name = "MailIngressValidationError";
+        this.status = status;
+    }
+}
+
+export async function validateMailIngress(
+    db: Pick<Database, "retrieveDevice">,
+    mail: MailWS,
+    authenticatedDeviceID: string,
+    authenticatedUserID: string,
+): Promise<ValidatedMailIngress> {
+    if (mail.sender !== authenticatedDeviceID) {
+        throw new MailIngressValidationError(
+            403,
+            "Mail sender does not match the authenticated device.",
+        );
+    }
+
+    if (mail.authorID !== authenticatedUserID) {
+        throw new MailIngressValidationError(
+            403,
+            "Mail author does not match the authenticated user.",
+        );
+    }
+
+    const recipientDevice = await db.retrieveDevice(mail.recipient);
+    if (recipientDevice === null) {
+        throw new MailIngressValidationError(
+            400,
+            "No associated user record found for recipient device.",
+        );
+    }
+
+    if (mail.readerID !== recipientDevice.owner) {
+        throw new MailIngressValidationError(
+            400,
+            "Mail reader does not match the recipient device owner.",
+        );
+    }
+
+    return { recipientDevice };
+}

package/src/server/rateLimit.ts

@@ -132,3 +132,24 @@ export const uploadLimiter = rateLimit({
     standardHeaders: "draft-7",
     windowMs: 60 * 1000,
 });
+
+/**
+ * Key-bundle retrieval dispenses OTKs, so it gets its own tighter bucket keyed
+ * by authenticated caller and target device. This makes OTK-drain attempts hit
+ * a per-pair budget without penalizing unrelated senders.
+ */
+export const keyBundleLimiter = rateLimit({
+    keyGenerator: (req) => {
+        const caller =
+            req.user?.userID ??
+            ipKeyGenerator(req.ip ?? req.socket.remoteAddress ?? "");
+        const target =
+            typeof req.params["id"] === "string" ? req.params["id"] : "unknown";
+        return `${caller}:${target}`;
+    },
+    legacyHeaders: false,
+    limit: 30,
+    skip: devApiKeySkipsRateLimits,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});