bvandeusenandClaude Opus 5.5
3bfddd0862
test-go / test (push) Successful in 1m54s
test-web / test (push) Successful in 1m34s
test-go / integration (push) Successful in 4m56s
android / Build + lint + test (push) Successful in 5m41s
release / Build signed APK (releases and dev) (push) Successful in 5m52s
release / Build + push container image (push) Canceled after 0s
release / Verify release artifacts (tag releases only) (push) Canceled after 0s
Every password-shaped check was mounted bare, so guessing was limited only by bcrypt cost. A shared in-memory AttemptLimiter now sits in front of them: - login: 10 failures per account and 50 per address per 15 min, checked before the user lookup and bcrypt; 429 with Retry-After. A success clears the account's count but not the address's. - unknown usernames run a dummy bcrypt compare, so timing no longer says which accounts exist. - register: 10 per address per hour; forgot-password: 5 per address and 3 per email per hour (applied whether or not the email matches); reset: 20 failed tokens per address per 15 min. - Subsonic /rest: same limits as login, counting only wrong credentials, since clients authenticate on every request. Web login, register, reset and forgot-password screens say how long to wait; web and Android carry copy for the rate_limited code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
70 lines
2.0 KiB
Go
70 lines
2.0 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"log/slog"
|
|
"math"
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
|
|
)
|
|
|
|
// errorBody / errorPayload preserve the existing wire envelope:
|
|
//
|
|
// {"error": {"code": "...", "message": "..."}}
|
|
//
|
|
// Kept separate from the Subsonic envelope so native clients don't have
|
|
// to parse two shapes.
|
|
type errorBody struct {
|
|
Error errorPayload `json:"error"`
|
|
}
|
|
|
|
type errorPayload struct {
|
|
Code string `json:"code"`
|
|
Message string `json:"message"`
|
|
}
|
|
|
|
// writeErr emits the failure envelope for err. If err is or wraps
|
|
// *apierror.Error, its Status/Code/Message drive the response;
|
|
// otherwise it's mapped to a 500 server_error.
|
|
func writeErr(w http.ResponseWriter, err error) {
|
|
apiErr := apierror.From(err)
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(apiErr.Status)
|
|
_ = json.NewEncoder(w).Encode(errorBody{Error: errorPayload{
|
|
Code: apiErr.Code,
|
|
Message: apiErr.Message,
|
|
}})
|
|
}
|
|
|
|
// writeRateLimited answers 429 with Retry-After in whole seconds, rounded
|
|
// up so a client that honours it never arrives a moment early.
|
|
func writeRateLimited(w http.ResponseWriter, wait time.Duration) {
|
|
secs := int(math.Ceil(wait.Seconds()))
|
|
if secs < 1 {
|
|
secs = 1
|
|
}
|
|
w.Header().Set("Retry-After", strconv.Itoa(secs))
|
|
writeErr(w, apierror.TooManyRequests("rate_limited", "too many attempts; try again later"))
|
|
}
|
|
|
|
// writeErrWithLog logs the error at Error level and writes the response.
|
|
// Use for 500-class errors where the operator needs the cause in logs.
|
|
func writeErrWithLog(w http.ResponseWriter, logger *slog.Logger, msg string, err error) {
|
|
if logger != nil {
|
|
logger.Error(msg, "err", err)
|
|
}
|
|
writeErr(w, err)
|
|
}
|
|
|
|
// writeJSON emits a 2xx response with the given body JSON-encoded. Mirrors
|
|
// writeErr's shape so handlers have one shape for success and one for
|
|
// failure.
|
|
func writeJSON(w http.ResponseWriter, status int, body any) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(status)
|
|
_ = json.NewEncoder(w).Encode(body)
|
|
}
|