iatoolkit 2.76.4__tar.gz → 2.76.6__tar.gz

{iatoolkit-2.76.4/src/iatoolkit.egg-info → iatoolkit-2.76.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.76.4
+Version: 2.76.6
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.76.4"
+__version__ = "2.76.6"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/core.py

@@ -460,6 +460,7 @@ class IAToolkit:
         from iatoolkit.services.sql_source_service import SqlSourceService
         from iatoolkit.services.dispatcher_service import Dispatcher
         from iatoolkit.services.branding_service import BrandingService
+        from iatoolkit.services.signup_guard_service import SignupGuardService
         from iatoolkit.services.i18n_service import I18nService
         from iatoolkit.services.language_service import LanguageService
         from iatoolkit.services.configuration_service import ConfigurationService
@@ -506,6 +507,7 @@ class IAToolkit:
         binder.bind(SqlSourceService, to=SqlSourceService)
         binder.bind(Dispatcher, to=Dispatcher)
         binder.bind(BrandingService, to=BrandingService)
+        binder.bind(SignupGuardService, to=SignupGuardService)
         binder.bind(I18nService, to=I18nService)
         binder.bind(LanguageService, to=LanguageService)
         # this class can be setup before by iatoolkit enterprise.

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/locales/en.yaml

@@ -2859,6 +2859,7 @@ errors:
     user_already_registered: "The user with email '{email}' already exists in this company."
     password_mismatch: "The passwords do not match. Please try again."
     signup_not_allowed: "Signup is not allowed for this company. Please contact an administrator."
+    form_expired: "The form has expired. Please try again."
     invitation_required: "A valid invitation is required to join this company. Ask your administrator for a new link."
   change_password:
     token_expired: "The password change link has expired. Please request a new one."

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/locales/es.yaml

@@ -2878,6 +2878,7 @@ errors:
     user_already_registered: "El usuario con email '{email}' ya existe en esta empresa."
     password_mismatch: "Las contraseñas no coinciden. Por favor, inténtalo de nuevo."
     signup_not_allowed: "El registro no está habilitado para esta empresa. Contacta a un administrador."
+    form_expired: "El formulario expiró. Por favor, inténtalo de nuevo."
     invitation_required: "Necesitas una invitación vigente para unirte a esta empresa. Solicita un nuevo enlace al administrador."
   change_password:
     token_expired: "El enlace de cambio de contraseña ha expirado. Por favor, solicita uno nuevo."

iatoolkit-2.76.6/src/iatoolkit/services/signup_guard_service.py

@@ -0,0 +1,164 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+"""Bot detection for the public signup form.
+
+Bots fill the signup form with random names and real people's emails, so every
+attempt makes us send a verification email nobody asked for. The checks here run
+before any user is created or any email is sent, and add no step for a person:
+
+- a signed form token issued when the page is rendered: a POST without it never
+  loaded the page, and one submitted a few seconds after render was not typed;
+- a honeypot field hidden from people, which bots fill in;
+- per-IP and per-email rate limits in Redis.
+
+A rejected bot is answered exactly like a successful signup (see SignupView), so
+it cannot learn which check stopped it. Only an expired token is reported, since
+that is a person who left the page open.
+"""
+
+import logging
+import os
+import time
+
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+
+from iatoolkit.infra.redis_session_manager import RedisSessionManager
+
+
+class SignupGuardService:
+    FORM_TOKEN_FIELD = 'form_token'
+    HONEYPOT_FIELD = 'website'
+
+    MIN_FILL_SECONDS = 3
+    FORM_TOKEN_MAX_AGE_SECONDS = 2 * 60 * 60
+    MAX_SIGNUPS_PER_IP = 5
+    IP_WINDOW_SECONDS = 60 * 60
+    MAX_SIGNUPS_PER_EMAIL = 3
+    EMAIL_WINDOW_SECONDS = 24 * 60 * 60
+
+    # outcomes of check()
+    ALLOWED = None
+    EXPIRED = 'form_expired'
+
+    _FORM_TOKEN_SALT = 'signup-form'
+    _GMAIL_DOMAINS = {'gmail.com', 'googlemail.com'}
+
+    def __init__(self):
+        self.serializer = URLSafeTimedSerializer(os.getenv("IATOOLKIT_SECRET_KEY"))
+
+    @staticmethod
+    def is_enabled() -> bool:
+        # automated end-to-end tests submit the form faster than a person
+        return os.getenv('IATOOLKIT_SIGNUP_BOT_GUARD', 'on').strip().lower() not in ('off', 'false', '0')
+
+    def issue_form_token(self, company_short_name: str) -> str:
+        return self.serializer.dumps(company_short_name, salt=self._FORM_TOKEN_SALT)
+
+    def check(self, company_short_name: str, form, client_ip: str | None, email: str | None) -> str | None:
+        """Return None when the signup may proceed, or the reason it was rejected."""
+        if not self.is_enabled():
+            return self.ALLOWED
+
+        reason = self._check_form(company_short_name, form)
+        if reason is None:
+            reason = self._check_rate_limits(company_short_name, client_ip, email)
+
+        if reason is not None:
+            email_domain = (email or '').rpartition('@')[2].lower() or '-'
+            logging.warning(
+                "signup rejected: reason=%s company=%s ip=%s email_domain=%s",
+                reason, company_short_name, client_ip or '-', email_domain,
+            )
+        return reason
+
+    def _check_form(self, company_short_name: str, form) -> str | None:
+        if (form.get(self.HONEYPOT_FIELD) or '').strip():
+            return 'honeypot'
+
+        token = form.get(self.FORM_TOKEN_FIELD)
+        if not token:
+            return 'missing_form_token'
+        try:
+            token_company, issued_at = self.serializer.loads(
+                token,
+                salt=self._FORM_TOKEN_SALT,
+                max_age=self.FORM_TOKEN_MAX_AGE_SECONDS,
+                return_timestamp=True,
+            )
+        except SignatureExpired:
+            return self.EXPIRED
+        except BadSignature:
+            return 'invalid_form_token'
+
+        if token_company != company_short_name:
+            return 'invalid_form_token'
+        if time.time() - issued_at.timestamp() < self.MIN_FILL_SECONDS:
+            return 'too_fast'
+        return None
+
+    def _check_rate_limits(self, company_short_name: str, client_ip: str | None, email: str | None) -> str | None:
+        if client_ip and self._hit(f'signup_guard:ip:{client_ip}', self.IP_WINDOW_SECONDS) > self.MAX_SIGNUPS_PER_IP:
+            return 'ip_rate_limit'
+
+        normalized_email = self.normalize_email(email)
+        if normalized_email and self._hit(
+                f'signup_guard:email:{normalized_email}', self.EMAIL_WINDOW_SECONDS) > self.MAX_SIGNUPS_PER_EMAIL:
+            return 'email_rate_limit'
+        return None
+
+    @staticmethod
+    def _hit(key: str, window_seconds: int) -> int:
+        """Count one attempt in a fixed window. Fails open: Redis down never blocks a signup."""
+        try:
+            pipe = RedisSessionManager.pipeline()
+            pipe.incr(key)
+            pipe.ttl(key)
+            count, ttl = pipe.execute()
+            if ttl is None or int(ttl) < 0:
+                # first hit of the window (or a key left without expiry)
+                RedisSessionManager.pipeline().expire(key, window_seconds).execute()
+            return int(count)
+        except Exception as e:
+            logging.warning("signup guard: rate limit unavailable (%s)", e)
+            return 0
+
+    @classmethod
+    def normalize_email(cls, email: str | None) -> str:
+        """One key per mailbox: Gmail ignores dots and +tags, so bots vary them."""
+        local, _, domain = str(email or '').strip().lower().partition('@')
+        if not local or not domain:
+            return ''
+        local = local.split('+', 1)[0]
+        if domain in cls._GMAIL_DOMAINS:
+            local = local.replace('.', '')
+            domain = 'gmail.com'
+        return f'{local}@{domain}'
+
+    @staticmethod
+    def client_ip(request) -> str | None:
+        """The client IP as seen by our own proxy.
+
+        Behind Cloudflare (Render's edge) the last X-Forwarded-For entry is a
+        Cloudflare node shared by many visitors, so CF-Connecting-IP wins: Cloudflare
+        always overwrites it with the visitor's address.
+
+        Otherwise the app sits behind one proxy (the platform router) that appends
+        the real client to X-Forwarded-For; anything to its left was sent by the
+        client and can be forged. IATOOLKIT_TRUSTED_PROXY_HOPS covers an extra
+        proxy in front.
+        """
+        cf_ip = request.headers.get('CF-Connecting-IP', '').strip()
+        if cf_ip:
+            return cf_ip
+
+        forwarded = [part.strip() for part in request.headers.get('X-Forwarded-For', '').split(',') if part.strip()]
+        try:
+            hops = max(1, int(os.getenv('IATOOLKIT_TRUSTED_PROXY_HOPS', '1')))
+        except ValueError:
+            hops = 1
+        if forwarded:
+            return forwarded[-hops] if len(forwarded) >= hops else forwarded[0]
+        return request.remote_addr

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/templates/signup.html

@@ -40,6 +40,12 @@
 
                         <form action="{{ url_for('signup', company_short_name=company_short_name) }}" method="post">
                             {% if invite_token %}<input type="hidden" name="invite_token" value="{{ invite_token }}">{% endif %}
+                            <input type="hidden" name="form_token" value="{{ form_token }}">
+                            <!-- honeypot: hidden from people, bots fill it in -->
+                            <div style="position: absolute; left: -10000px; top: auto; width: 1px; height: 1px; overflow: hidden;" aria-hidden="true">
+                                <label for="website">Website</label>
+                                <input type="text" id="website" name="website" tabindex="-1" autocomplete="off" value="">
+                            </div>
                             <div class="mb-3">
                                 <label for="email" class="form-label text-secondary">{{ t('ui.signup.email_label') }}</label>
                                 <input type="email" autocomplete="off" id="email" name="email"

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit/views/signup_view.py

@@ -8,6 +8,7 @@ from flask import render_template, request, url_for, redirect, flash, make_respo
 from iatoolkit.services.profile_service import ProfileService
 from iatoolkit.services.branding_service import BrandingService
 from iatoolkit.services.i18n_service import I18nService
+from iatoolkit.services.signup_guard_service import SignupGuardService
 from injector import inject
 from itsdangerous import URLSafeTimedSerializer
 import os
@@ -17,10 +18,12 @@ class SignupView(MethodView):
     @inject
     def __init__(self, profile_service: ProfileService,
                  branding_service: BrandingService,
-                 i18n_service: I18nService):
+                 i18n_service: I18nService,
+                 signup_guard_service: SignupGuardService):
         self.profile_service = profile_service
         self.branding_service = branding_service # 3. Guardar la instancia
         self.i18n_service = i18n_service
+        self.signup_guard_service = signup_guard_service
 
         self.serializer = URLSafeTimedSerializer(os.getenv("IATOOLKIT_SECRET_KEY"))
 
@@ -52,6 +55,7 @@ class SignupView(MethodView):
             "company_short_name": company_short_name,
             "branding": branding_data,
             "lang": current_lang,
+            "form_token": self.signup_guard_service.issue_form_token(company_short_name),
         }
         if invitation_required or invited_email:
             template_context.update(invite_token=invite_token, invited_email=invited_email)
@@ -80,19 +84,30 @@ class SignupView(MethodView):
             current_lang = request.form.get("lang") or request.args.get("lang")
             invite_token = request.form.get("invite_token") or request.args.get("invite_token")
 
-            # create verification token and url for verification
-            token = self.serializer.dumps(email, salt='email-confirm')
-            verification_url = url_for('verify_account',
-                                       company_short_name=company_short_name,
-                                       token=token, _external=True)
-
-            response = self.profile_service.signup(
-                company_short_name=company_short_name,
-                email=email,
-                first_name=first_name, last_name=last_name,
-                password=password, confirm_password=confirm_password,
-                verification_url=verification_url,
-                invite_token=invite_token)
+            # bots are stopped before any user is created or any email is sent
+            rejection = self.signup_guard_service.check(
+                company_short_name, request.form,
+                client_ip=self.signup_guard_service.client_ip(request), email=email)
+            if rejection == SignupGuardService.EXPIRED:
+                response = {"error": self.i18n_service.t('errors.signup.form_expired')}
+            elif rejection is not None:
+                # answer like a successful signup, so the bot can't tell what stopped it
+                flash(self.i18n_service.t('flash_messages.signup_success'), 'success')
+                return redirect(url_for('home', company_short_name=company_short_name, lang=current_lang))
+            else:
+                # create verification token and url for verification
+                token = self.serializer.dumps(email, salt='email-confirm')
+                verification_url = url_for('verify_account',
+                                           company_short_name=company_short_name,
+                                           token=token, _external=True)
+
+                response = self.profile_service.signup(
+                    company_short_name=company_short_name,
+                    email=email,
+                    first_name=first_name, last_name=last_name,
+                    password=password, confirm_password=confirm_password,
+                    verification_url=verification_url,
+                    invite_token=invite_token)
 
             if "error" in response:
                 flash(response["error"], 'error')
@@ -100,6 +115,7 @@ class SignupView(MethodView):
                     "company_short_name": company_short_name,
                     "branding": branding_data,
                     "lang": current_lang,
+                    "form_token": self.signup_guard_service.issue_form_token(company_short_name),
                     "form_data": {
                         "first_name": first_name,
                         "last_name": last_name,

{iatoolkit-2.76.4 → iatoolkit-2.76.6/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.76.4
+Version: 2.76.6
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.76.4 → iatoolkit-2.76.6}/src/iatoolkit.egg-info/SOURCES.txt

@@ -161,6 +161,7 @@ src/iatoolkit/services/prompt_resource_service.py
 src/iatoolkit/services/prompt_service.py
 src/iatoolkit/services/query_service.py
 src/iatoolkit/services/resource_access_scope.py
+src/iatoolkit/services/signup_guard_service.py
 src/iatoolkit/services/signup_policy_resolver.py
 src/iatoolkit/services/sql_catalog_service.py
 src/iatoolkit/services/sql_dataset_service.py