ticket #105 attempt 1

devplacepy/database/comments.py

@@ -93,36 +93,6 @@ def get_recent_comments_by_target_uids(target_type, target_uids, limit=3, user=N
     raw = _drop_blocked(raw, user)
     if not raw:
         return {}
-
-    # Fetch missing parent comments so the threaded hierarchy is preserved even
-    # when a parent is outside the row-number limit.
-    if "comments" in db.tables:
-        comments_table = db["comments"]
-        current_uids = {c["uid"] for c in raw}
-        seen = set(current_uids)
-        to_fetch = []
-        for c in raw:
-            puid = c.get("parent_uid")
-            if puid and puid not in seen:
-                seen.add(puid)
-                to_fetch.append(puid)
-        if to_fetch:
-            ancestors = []
-            queue = list(to_fetch)
-            fetched = set()
-            while queue:
-                uid = queue.pop(0)
-                if uid in fetched or uid in current_uids:
-                    continue
-                row = comments_table.find_one(uid=uid, deleted_at=None)
-                if row:
-                    ancestors.append(row)
-                    fetched.add(uid)
-                    grandparent = row.get("parent_uid")
-                    if grandparent and grandparent not in fetched and grandparent not in current_uids:
-                        queue.append(grandparent)
-            raw.extend(ancestors)
-
     items = _build_comment_items(raw, user)
     by_target = defaultdict(list)
     for c in raw:

devplacepy/main.py

@@ -128,6 +128,9 @@ RATE_LIMIT = int(os.environ.get("DEVPLACE_RATE_LIMIT", "60"))
 RATE_WINDOW = 60
 WEB_WORKERS = max(1, int(os.environ.get("DEVPLACE_WEB_WORKERS", "1")))
 RATE_LIMIT_DISABLED = os.environ.get("DEVPLACE_DISABLE_RATE_LIMIT") == "1"
+LOGIN_EMAIL_RATE_LIMIT = int(os.environ.get("DEVPLACE_LOGIN_EMAIL_RATE_LIMIT", "10"))
+
+_email_rate_limit_store: dict[str, list[float]] = defaultdict(list)
 
 HOT_SETTINGS_TTL = 2.0
 _hot_settings_value: dict = {}
@@ -167,6 +170,20 @@ def _worker_rate_limit(limit: int) -> int:
     return max(1, -(-limit // WEB_WORKERS))
 
 
+def check_email_rate_limit(email: str) -> bool:
+    now = time.time()
+    window_start = now - RATE_WINDOW
+    limit = LOGIN_EMAIL_RATE_LIMIT
+    timestamps = [
+        t for t in _email_rate_limit_store.get(email, []) if t > window_start
+    ]
+    if len(timestamps) >= limit:
+        return False
+    timestamps.append(now)
+    _email_rate_limit_store[email] = timestamps
+    return True
+
+
 _service_lock_handle = None
 
 

devplacepy/routers/auth/login.py

@@ -20,6 +20,7 @@ from devplacepy.responses import respond, action_result, wants_json, json_error
 from devplacepy.schemas import AuthPageOut
 from devplacepy.services.audit import record as audit
 from devplacepy.dependencies import json_or_form
+from devplacepy.main import check_email_rate_limit
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -72,6 +73,22 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
             metadata={"email": email},
             summary=f"failed login attempt for {email}",
         )
+        if not check_email_rate_limit(email):
+            audit.record(
+                request,
+                "security.rate_limit.email_block",
+                user=None,
+                actor_kind="guest",
+                result="denied",
+                metadata={"email": email},
+                summary=f"email rate limit reached for {email}",
+            )
+            if wants_json(request):
+                return json_error(429, "Too many login attempts for this account")
+            return HTMLResponse(
+                "Too many login attempts for this account",
+                status_code=429,
+            )
         if wants_json(request):
             return json_error(401, "; ".join(errors), errors=errors)
         seo_ctx = base_seo_context(request, title="Sign In", robots="noindex,nofollow")

tests/api/auth/login.py

@@ -181,3 +181,27 @@ def test_rate_limit_block_recorded(monkeypatch):
         event_key="security.rate_limit.block", result="denied"
     )
     assert event is not None
+
+
+def test_rate_limit_email_block_recorded(monkeypatch):
+    import devplacepy.main as m
+    from starlette.testclient import TestClient
+
+    monkeypatch.setattr(m, "LOGIN_EMAIL_RATE_LIMIT", 2)
+    m._email_rate_limit_store.clear()
+    client = TestClient(m.app)
+    email = "rate-limited@test.dev"
+    codes = [
+        client.post(
+            "/auth/login",
+            data={"email": email, "password": "wrong"},
+        ).status_code
+        for _ in range(3)
+    ]
+    first_two = codes[:2]
+    assert all(c == 401 for c in first_two), first_two
+    assert codes[2] == 429, codes
+    event = get_table("audit_log").find_one(
+        event_key="security.rate_limit.email_block", result="denied"
+    )
+    assert event is not None

tests/conftest.py

@@ -23,6 +23,7 @@ os.environ["DEVPLACE_DATA_DIR"] = str(_TEST_DATA_DIR)
 os.environ["SECRET_KEY"] = "test-secret-key"
 os.environ["DEVPLACE_DISABLE_SERVICES"] = "1"
 os.environ["DEVPLACE_RATE_LIMIT"] = "1000000"
+os.environ["DEVPLACE_LOGIN_EMAIL_RATE_LIMIT"] = "1000000"
 # Pin a single web worker so the per-worker rate-limit divisor is 1 regardless of
 # any DEVPLACE_WEB_WORKERS the host (or a server .env) exports.
 os.environ["DEVPLACE_WEB_WORKERS"] = "1"

tests/e2e/feed.py

@@ -959,72 +959,3 @@ def test_feed_scroll_not_restored_on_fresh_visit(alice):
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
     page.wait_for_timeout(600)
     assert page.evaluate("window.scrollY") < 60
-
-
-def _seed_post_with_orphaned_parent():
-    owner = str(uuid4())
-    get_table("users").insert(
-        {
-            "uid": owner,
-            "username": f"opseed_{owner[:8]}",
-            "email": f"{owner[:8]}@op.seed",
-            "password_hash": "x",
-            "role": "Member",
-            "is_active": True,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    post_uid = str(uuid4())
-    marker = f"oppost-{post_uid[:8]}"
-    get_table("posts").insert(
-        {
-            "deleted_at": None,
-            "deleted_by": None,
-            "uid": post_uid,
-            "user_uid": owner,
-            "slug": make_combined_slug(marker, post_uid),
-            "title": None,
-            "content": marker,
-            "topic": "devlog",
-            "project_uid": None,
-            "image": None,
-            "stars": 0,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    orphan_parent = str(uuid4())
-    base = datetime.now(timezone.utc)
-    rows = [
-        (f"{marker}-orphan-parent", orphan_parent, None, -3),
-        (f"{marker}-older", str(uuid4()), None, -2),
-        (f"{marker}-flat", str(uuid4()), None, -1),
-        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
-    ]
-    comments = get_table("comments")
-    for content, cuid, par, off in rows:
-        comments.insert(
-            {
-                "deleted_at": None,
-                "deleted_by": None,
-                "uid": cuid,
-                "target_type": "post",
-                "target_uid": post_uid,
-                "post_uid": post_uid,
-                "user_uid": owner,
-                "content": content,
-                "parent_uid": par,
-                "created_at": (base + timedelta(seconds=off)).isoformat(),
-            }
-        )
-    return marker
-
-
-def test_feed_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
-    marker = _seed_post_with_orphaned_parent()
-    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
-    card = page.locator(".post-card").filter(has_text=marker).first
-    card.wait_for(state="visible")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
-    nested = card.locator(".post-card-comments .comment-replies .comment-text")
-    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/gists.py

@@ -468,70 +468,3 @@ def test_gists_list_preserves_comment_hierarchy(page, app_server):
     expect(card.locator(".post-card-comments")).not_to_contain_text(f"{marker}-excluded")
     nested = card.locator(".post-card-comments .comment-replies .comment-text")
     expect(nested).to_contain_text(f"{marker}-reply")
-
-
-def _seed_gist_with_orphaned_parent():
-    owner = str(uuid4())
-    get_table("users").insert(
-        {
-            "uid": owner,
-            "username": f"gopseed_{owner[:8]}",
-            "email": f"{owner[:8]}@gop.seed",
-            "password_hash": "x",
-            "role": "Member",
-            "is_active": True,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    uid = str(uuid4())
-    marker = f"gistop-{uid[:8]}"
-    get_table("gists").insert(
-        {
-            "deleted_at": None,
-            "deleted_by": None,
-            "uid": uid,
-            "user_uid": owner,
-            "slug": make_combined_slug(marker, uid),
-            "title": marker,
-            "description": "Gist with orphaned parent hierarchy.",
-            "source_code": "print('x')",
-            "language": "python",
-            "stars": 0,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    orphan_parent = str(uuid4())
-    base = datetime.now(timezone.utc)
-    rows = [
-        (f"{marker}-orphan-parent", orphan_parent, None, -3),
-        (f"{marker}-older", str(uuid4()), None, -2),
-        (f"{marker}-flat", str(uuid4()), None, -1),
-        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
-    ]
-    comments = get_table("comments")
-    for content, cuid, par, off in rows:
-        comments.insert(
-            {
-                "deleted_at": None,
-                "deleted_by": None,
-                "uid": cuid,
-                "target_type": "gist",
-                "target_uid": uid,
-                "user_uid": owner,
-                "content": content,
-                "parent_uid": par,
-                "created_at": (base + timedelta(seconds=off)).isoformat(),
-            }
-        )
-    return marker
-
-
-def test_gists_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
-    marker = _seed_gist_with_orphaned_parent()
-    page.goto(f"{BASE_URL}/gists", wait_until="domcontentloaded")
-    card = page.locator(".gist-card").filter(has_text=marker).first
-    card.wait_for(state="visible")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
-    nested = card.locator(".post-card-comments .comment-replies .comment-text")
-    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/news.py

@@ -387,75 +387,3 @@ def test_news_list_preserves_comment_hierarchy(page, app_server):
     expect(card.locator(".post-card-comments")).not_to_contain_text(f"{marker}-excluded")
     nested = card.locator(".post-card-comments .comment-replies .comment-text")
     expect(nested).to_contain_text(f"{marker}-reply")
-
-
-def _seed_news_with_orphaned_parent():
-    owner = str(uuid4())
-    get_table("users").insert(
-        {
-            "uid": owner,
-            "username": f"nopseed_{owner[:8]}",
-            "email": f"{owner[:8]}@nop.seed",
-            "password_hash": "x",
-            "role": "Member",
-            "is_active": True,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    uid = str(uuid4())
-    marker = f"newsop-{uid[:8]}"
-    get_table("news").insert(
-        {
-            "deleted_at": None,
-            "deleted_by": None,
-            "uid": uid,
-            "slug": make_combined_slug(marker, uid),
-            "title": marker,
-            "description": "News with orphaned parent hierarchy.",
-            "content": "Body.",
-            "url": "https://example.com/nop",
-            "source_name": "NOPSource",
-            "external_id": f"nop_{uid[:8]}",
-            "status": "published",
-            "show_on_landing": 0,
-            "grade": 10,
-            "synced_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    orphan_parent = str(uuid4())
-    base = datetime.now(timezone.utc)
-    rows = [
-        (f"{marker}-orphan-parent", orphan_parent, None, -3),
-        (f"{marker}-older", str(uuid4()), None, -2),
-        (f"{marker}-flat", str(uuid4()), None, -1),
-        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
-    ]
-    comments = get_table("comments")
-    for content, cuid, par, off in rows:
-        comments.insert(
-            {
-                "deleted_at": None,
-                "deleted_by": None,
-                "uid": cuid,
-                "target_type": "news",
-                "target_uid": uid,
-                "user_uid": owner,
-                "content": content,
-                "parent_uid": par,
-                "created_at": (base + timedelta(seconds=off)).isoformat(),
-            }
-        )
-    return marker
-
-
-def test_news_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
-    from playwright.sync_api import expect
-
-    marker = _seed_news_with_orphaned_parent()
-    page.goto(f"{BASE_URL}/news", wait_until="domcontentloaded")
-    card = page.locator(".news-card").filter(has_text=marker).first
-    card.wait_for(state="visible")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
-    nested = card.locator(".post-card-comments .comment-replies .comment-text")
-    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/projects/index.py

@@ -1015,71 +1015,3 @@ def test_containers_menu_hidden_for_non_owner_admin_on_member_private_project(pa
     page.goto(f"{BASE_URL}/projects/{slug}", wait_until="domcontentloaded")
     page.locator(".project-actions-more").click()
     expect(page.locator(".context-menu-item:has-text('Containers')")).to_have_count(0)
-
-
-def _seed_project_with_orphaned_parent():
-    owner = str(uuid4())
-    get_table("users").insert(
-        {
-            "uid": owner,
-            "username": f"popseed_{owner[:8]}",
-            "email": f"{owner[:8]}@pop.seed",
-            "password_hash": "x",
-            "role": "Member",
-            "is_active": True,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    uid = str(uuid4())
-    marker = f"projop-{uid[:8]}"
-    get_table("projects").insert(
-        {
-            "deleted_at": None,
-            "deleted_by": None,
-            "uid": uid,
-            "user_uid": owner,
-            "slug": make_combined_slug(marker, uid),
-            "title": marker,
-            "description": "Project with orphaned parent hierarchy.",
-            "project_type": "software",
-            "platforms": "Linux",
-            "status": "Released",
-            "stars": 0,
-            "created_at": datetime.now(timezone.utc).isoformat(),
-        }
-    )
-    orphan_parent = str(uuid4())
-    base = datetime.now(timezone.utc)
-    rows = [
-        (f"{marker}-orphan-parent", orphan_parent, None, -3),
-        (f"{marker}-older", str(uuid4()), None, -2),
-        (f"{marker}-flat", str(uuid4()), None, -1),
-        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
-    ]
-    comments = get_table("comments")
-    for content, cuid, par, off in rows:
-        comments.insert(
-            {
-                "deleted_at": None,
-                "deleted_by": None,
-                "uid": cuid,
-                "target_type": "project",
-                "target_uid": uid,
-                "user_uid": owner,
-                "content": content,
-                "parent_uid": par,
-                "created_at": (base + timedelta(seconds=off)).isoformat(),
-            }
-        )
-    return marker
-
-
-def test_projects_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
-    marker = _seed_project_with_orphaned_parent()
-    page.goto(f"{BASE_URL}/projects", wait_until="domcontentloaded")
-    card = page.locator(".project-card").filter(has_text=marker).first
-    card.wait_for(state="visible")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
-    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
-    nested = card.locator(".post-card-comments .comment-replies .comment-text")
-    expect(nested).to_contain_text(f"{marker}-reply")