ticket #105 attempt 1

devplacepy/main.py

@@ -128,6 +128,9 @@ RATE_LIMIT = int(os.environ.get("DEVPLACE_RATE_LIMIT", "60"))
 RATE_WINDOW = 60
 WEB_WORKERS = max(1, int(os.environ.get("DEVPLACE_WEB_WORKERS", "1")))
 RATE_LIMIT_DISABLED = os.environ.get("DEVPLACE_DISABLE_RATE_LIMIT") == "1"
+LOGIN_EMAIL_RATE_LIMIT = int(os.environ.get("DEVPLACE_LOGIN_EMAIL_RATE_LIMIT", "10"))
+
+_email_rate_limit_store: dict[str, list[float]] = defaultdict(list)
 
 HOT_SETTINGS_TTL = 2.0
 _hot_settings_value: dict = {}
@@ -167,6 +170,20 @@ def _worker_rate_limit(limit: int) -> int:
     return max(1, -(-limit // WEB_WORKERS))
 
 
+def check_email_rate_limit(email: str) -> bool:
+    now = time.time()
+    window_start = now - RATE_WINDOW
+    limit = LOGIN_EMAIL_RATE_LIMIT
+    timestamps = [
+        t for t in _email_rate_limit_store.get(email, []) if t > window_start
+    ]
+    if len(timestamps) >= limit:
+        return False
+    timestamps.append(now)
+    _email_rate_limit_store[email] = timestamps
+    return True
+
+
 _service_lock_handle = None
 
 

devplacepy/routers/auth/login.py

@@ -20,6 +20,7 @@ from devplacepy.responses import respond, action_result, wants_json, json_error
 from devplacepy.schemas import AuthPageOut
 from devplacepy.services.audit import record as audit
 from devplacepy.dependencies import json_or_form
+from devplacepy.main import check_email_rate_limit
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -72,6 +73,22 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
             metadata={"email": email},
             summary=f"failed login attempt for {email}",
         )
+        if not check_email_rate_limit(email):
+            audit.record(
+                request,
+                "security.rate_limit.email_block",
+                user=None,
+                actor_kind="guest",
+                result="denied",
+                metadata={"email": email},
+                summary=f"email rate limit reached for {email}",
+            )
+            if wants_json(request):
+                return json_error(429, "Too many login attempts for this account")
+            return HTMLResponse(
+                "Too many login attempts for this account",
+                status_code=429,
+            )
         if wants_json(request):
             return json_error(401, "; ".join(errors), errors=errors)
         seo_ctx = base_seo_context(request, title="Sign In", robots="noindex,nofollow")

devplacepy/static/js/ModalManager.js

@@ -29,7 +29,6 @@ export class ModalManager {
                 const modal = document.getElementById(modalId);
                 if (modal) {
                     modal.classList.add("visible");
-                    window.history.pushState({__overlay: true}, "");
                 }
             });
         });
@@ -38,13 +37,11 @@ export class ModalManager {
             modal.addEventListener("click", (e) => {
                 if (e.target === modal) {
                     modal.classList.remove("visible");
-                    window.history.back();
                 }
             });
             modal.querySelectorAll(".modal-close").forEach((closeBtn) => {
                 closeBtn.addEventListener("click", () => {
                     modal.classList.remove("visible");
-                    window.history.back();
                 });
             });
             this.enhanceModal(modal);
@@ -53,14 +50,6 @@ export class ModalManager {
         document.addEventListener("keydown", (e) => {
             if (e.key !== "Escape") return;
             const open = [...document.querySelectorAll(".modal-overlay.visible")].pop();
-            if (open) {
-                open.classList.remove("visible");
-                window.history.back();
-            }
-        });
-
-        window.addEventListener("popstate", () => {
-            const open = document.querySelector(".modal-overlay.visible");
             if (open) open.classList.remove("visible");
         });
     }

devplacepy/static/js/components/AppContextMenu.js

@@ -51,11 +51,6 @@ export class AppContextMenu extends Component {
         document.addEventListener("keydown", (e) => {
             if (e.key === "Escape") this.close();
         });
-        window.addEventListener("popstate", () => {
-            if (this.menu.classList.contains("visible")) {
-                this.menu.classList.remove("visible");
-            }
-        });
     }
 
     render(items) {
@@ -98,7 +93,6 @@ export class AppContextMenu extends Component {
         if (!items || !items.length) return;
         this.render(items);
         this.menu.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         const rect = this.menu.getBoundingClientRect();
         const vv = window.visualViewport;
         const safeW = vv ? vv.width : window.innerWidth;
@@ -117,7 +111,6 @@ export class AppContextMenu extends Component {
 
     close() {
         this.menu.classList.remove("visible");
-        window.history.back();
     }
 
     suppressNextClick() {

devplacepy/static/js/components/AppDialog.js

@@ -64,11 +64,6 @@ export class AppDialog extends Component {
                 this.dismiss();
             }
         });
-        window.addEventListener("popstate", () => {
-            if (this.overlay.classList.contains("visible")) {
-                this.overlay.classList.remove("visible");
-            }
-        });
         overlay.addEventListener("keydown", (e) => {
             if (e.key !== "Tab") return;
             const items = [
@@ -112,7 +107,6 @@ export class AppDialog extends Component {
 
         this.lastFocus = document.activeElement;
         this.overlay.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         const focusTarget = mode === "prompt" ? this.input : this.confirmBtn;
         setTimeout(() => {
             focusTarget.focus();
@@ -133,7 +127,6 @@ export class AppDialog extends Component {
 
     close(value) {
         this.overlay.classList.remove("visible");
-        window.history.back();
         if (this.lastFocus && this.lastFocus.focus) this.lastFocus.focus();
         const resolve = this.resolver;
         this.resolver = null;

devplacepy/static/js/components/AppLightbox.js

@@ -54,7 +54,6 @@ export class AppLightbox extends Component {
                 this.close();
             }
         });
-        window.addEventListener("popstate", () => this._onPopstate());
         this.overlay.addEventListener("keydown", (e) => {
             if (e.key === "Tab" && this.overlay.classList.contains("visible")) {
                 e.preventDefault();
@@ -78,23 +77,15 @@ export class AppLightbox extends Component {
         this.bodyOverflow = document.body.style.overflow;
         document.body.style.overflow = "hidden";
         this.overlay.classList.add("visible");
-        window.history.pushState({__overlay: true}, "");
         setTimeout(() => this.closeBtn.focus(), 20);
     }
 
     close() {
         this.overlay.classList.remove("visible");
-        window.history.back();
         this.image.src = "";
         document.body.style.overflow = this.bodyOverflow;
         if (this.lastFocus && this.lastFocus.focus) this.lastFocus.focus();
     }
-
-    _onPopstate() {
-        if (this.overlay.classList.contains("visible")) {
-            this.overlay.classList.remove("visible");
-        }
-    }
 }
 
 customElements.define("dp-lightbox", AppLightbox);

tests/api/auth/login.py

@@ -181,3 +181,27 @@ def test_rate_limit_block_recorded(monkeypatch):
         event_key="security.rate_limit.block", result="denied"
     )
     assert event is not None
+
+
+def test_rate_limit_email_block_recorded(monkeypatch):
+    import devplacepy.main as m
+    from starlette.testclient import TestClient
+
+    monkeypatch.setattr(m, "LOGIN_EMAIL_RATE_LIMIT", 2)
+    m._email_rate_limit_store.clear()
+    client = TestClient(m.app)
+    email = "rate-limited@test.dev"
+    codes = [
+        client.post(
+            "/auth/login",
+            data={"email": email, "password": "wrong"},
+        ).status_code
+        for _ in range(3)
+    ]
+    first_two = codes[:2]
+    assert all(c == 401 for c in first_two), first_two
+    assert codes[2] == 429, codes
+    event = get_table("audit_log").find_one(
+        event_key="security.rate_limit.email_block", result="denied"
+    )
+    assert event is not None

tests/conftest.py

@@ -23,6 +23,7 @@ os.environ["DEVPLACE_DATA_DIR"] = str(_TEST_DATA_DIR)
 os.environ["SECRET_KEY"] = "test-secret-key"
 os.environ["DEVPLACE_DISABLE_SERVICES"] = "1"
 os.environ["DEVPLACE_RATE_LIMIT"] = "1000000"
+os.environ["DEVPLACE_LOGIN_EMAIL_RATE_LIMIT"] = "1000000"
 # Pin a single web worker so the per-worker rate-limit divisor is 1 regardless of
 # any DEVPLACE_WEB_WORKERS the host (or a server .env) exports.
 os.environ["DEVPLACE_WEB_WORKERS"] = "1"