levix-bot 3.3.0-rc.2 → 4.0.0

package/src/middleware/forward-tracking.middleware.js

@@ -1,7 +1,7 @@
 // file: /middleware/forward-tracking.middleware.js
 import { createRequire } from "module";
-import { incrementForwardScore } from "../utils/storage.esm.js";
 import normalizeJid from "../utils/normalizeJid.esm.js";
+import { incrementForwardScore } from "../utils/storage.esm.js";
 
 const require = createRequire(import.meta.url);
 const logger = require("../utils/logger.cjs");
@@ -21,7 +21,8 @@ export async function trackForwardedMessage(msg) {
       msg.message?.audioMessage?.contextInfo;
 
     // A message is considered forwarded if it has isForwarded flag or forwardingScore > 0
-    const isForwarded = contextInfo?.isForwarded || (contextInfo?.forwardingScore && contextInfo.forwardingScore > 0);
+    const isForwarded =
+      contextInfo?.isForwarded || (contextInfo?.forwardingScore && contextInfo.forwardingScore > 0);
 
     if (!isForwarded) {
       return false;

package/src/middleware/permissions.middleware.js

@@ -1,12 +1,12 @@
 // file: /middleware/permissions.middleware.js
 import { createRequire } from "module";
 import {
-  isOwnerJid,
-  isBotAdminUser,
+  getSenderCandidates,
+  getSenderId,
   isAdminInGroup,
   isBotAdminInGroup,
-  getSenderId,
-  getSenderCandidates,
+  isBotAdminUser,
+  isOwnerJid,
 } from "../utils/permissions.esm.js";
 
 const require = createRequire(import.meta.url);
@@ -46,7 +46,7 @@ export function checkCommandPermission(commandName, msg, groupMetadata, sock) {
   const candidates = senderCandidates.length ? senderCandidates : [senderId];
 
   // fromMe is an immediate owner indicator (the bot is always its own owner).
-  let isOwner = msg.key.fromMe || candidates.some((c) => isOwnerJid(c));
+  const isOwner = msg.key.fromMe || candidates.some((c) => isOwnerJid(c));
 
   // Bot-level admins (granted with `!perm add admin`, from the dashboard, or by
   // asking the AI) count as admins everywhere — including DMs, where there is
@@ -54,8 +54,7 @@ export function checkCommandPermission(commandName, msg, groupMetadata, sock) {
   const isBotAdmin = !isOwner && candidates.some((c) => isBotAdminUser(c));
 
   const isSenderAdmin =
-    isBotAdmin ||
-    (isGroup ? candidates.some((c) => isAdminInGroup(groupMetadata, c)) : false);
+    isBotAdmin || (isGroup ? candidates.some((c) => isAdminInGroup(groupMetadata, c)) : false);
 
   const permissionLevel = resolvePermissionLevel(commandName);
 
@@ -96,9 +95,7 @@ export function checkCommandPermission(commandName, msg, groupMetadata, sock) {
       break;
 
     default:
-      logger.warn(
-        `Unknown permission level: ${permissionLevel} for command: ${commandName}`
-      );
+      logger.warn(`Unknown permission level: ${permissionLevel} for command: ${commandName}`);
       hasPermission = false;
       reason = "🚫 مستوى الصلاحية غير معروف.";
   }

package/src/panel/login-throttle.cjs

@@ -0,0 +1,43 @@
+// Guess-throttling for the panel password. Shared by /login, /setup, and
+// POST /dashboard/api/security/password so a locked-out peer cannot keep
+// trying the same secret on another door.
+//
+// Keyed on the TCP peer, never on `req.ip`: with `trust proxy` set, a client
+// picks its own `req.ip` by writing a header.
+
+const ATTEMPT_WINDOW_MS = 15 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+const attempts = new Map();
+
+function blockedFor(ip) {
+  const now = Date.now();
+  for (const [key, entry] of attempts) {
+    if (now - entry.firstAt > ATTEMPT_WINDOW_MS) attempts.delete(key);
+  }
+  const entry = attempts.get(ip);
+  if (!entry || entry.count < MAX_ATTEMPTS) return 0;
+  const remaining = ATTEMPT_WINDOW_MS - (now - entry.firstAt);
+  return remaining > 0 ? Math.ceil(remaining / 1000) : 0;
+}
+
+function recordFailure(ip) {
+  const now = Date.now();
+  const entry = attempts.get(ip);
+  if (!entry || now - entry.firstAt > ATTEMPT_WINDOW_MS) {
+    attempts.set(ip, { count: 1, firstAt: now });
+    return;
+  }
+  entry.count += 1;
+}
+
+function clearAttempts(ip) {
+  attempts.delete(ip);
+}
+
+module.exports = {
+  ATTEMPT_WINDOW_MS,
+  MAX_ATTEMPTS,
+  blockedFor,
+  recordFailure,
+  clearAttempts,
+};

package/src/panel/session-auth.cjs

@@ -0,0 +1,17 @@
+// Panel session validity. `loggedIn` alone is not enough: a leftover cookie
+// must stop working when the password is changed or wiped.
+
+const secrets = require("../config/secrets.cjs");
+
+function isPanelSessionValid(session) {
+  if (!session?.loggedIn) return false;
+  if (!secrets.hasDashboardPassword()) return false;
+  return session.passwordUpdatedAt === secrets.getPasswordUpdatedAt();
+}
+
+function stampPanelSession(session) {
+  session.loggedIn = true;
+  session.passwordUpdatedAt = secrets.getPasswordUpdatedAt();
+}
+
+module.exports = { isPanelSessionValid, stampPanelSession };