ticket #88 attempt 2

devplacepy/database/schema.py

@@ -1070,6 +1070,7 @@ def init_db():
         ("planted_at", ""),
         ("ready_at", ""),
         ("watered_by", "[]"),
+        ("cooldown_until", ""),
         ("created_at", ""),
         ("updated_at", ""),
     ):
@@ -1077,6 +1078,18 @@ def init_db():
             game_plots.create_column_by_example(column, example)
     _index(db, "game_plots", "idx_game_plots_farm", ["farm_uid", "slot_index"])
 
+    _drop_index(db, "idx_rate_limit_log_user_ts")
+    rate_limit_log = get_table("rate_limit_log")
+    for column, example in (
+        ("uid", ""),
+        ("user_uid", ""),
+        ("action", ""),
+        ("timestamp", ""),
+    ):
+        if not rate_limit_log.has_column(column):
+            rate_limit_log.create_column_by_example(column, example)
+    _index(db, "rate_limit_log", "idx_rate_limit_log_user_ts", ["user_uid", "timestamp"])
+
     _index(db, "posts", "idx_posts_user_created", ["user_uid", "created_at"])
     _index(
         db,

devplacepy/main.py

@@ -4,13 +4,12 @@ import asyncio
 import fcntl
 import logging
 import os
-import re
 import time
 from collections import defaultdict
 from contextlib import asynccontextmanager, contextmanager
 from pathlib import Path
 from fastapi import FastAPI, Request
-from fastapi.responses import HTMLResponse, RedirectResponse, Response
+from fastapi.responses import HTMLResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 from fastapi.exceptions import RequestValidationError
 from starlette.middleware.gzip import GZipMiddleware
@@ -612,22 +611,6 @@ async def response_timing(request: Request, call_next):
     return response
 
 
-_KNOWN_CRAWLERS = re.compile(
-    r"(google.*read.*aloud|googlebot|bingbot|slurp|duckduckbot|baiduspider|yandexbot)",
-    re.IGNORECASE,
-)
-_AUTH_GATED_PATHS = frozenset({"/messages", "/notifications", "/game", "/admin"})
-
-
-@app.middleware("http")
-async def crawler_detection(request: Request, call_next):
-    if request.method == "GET" and request.url.path in _AUTH_GATED_PATHS:
-        ua = request.headers.get("user-agent", "")
-        if _KNOWN_CRAWLERS.search(ua):
-            return Response(status_code=204)
-    return await call_next(request)
-
-
 app.add_middleware(GZipMiddleware, minimum_size=512, compresslevel=5)
 
 

devplacepy/routers/game/farm.py

@@ -1,10 +1,12 @@
 # retoor <retoor@molodetz.nl>
 
+from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
 from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
+from devplacepy.database import db, get_table
 from devplacepy.models import GameSlotForm
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameFarmViewOut
@@ -18,6 +20,33 @@ from devplacepy.utils import (
 
 from ._shared import game_seo, notify_farm, owner_by_username
 
+_MAX_ACTIONS_PER_MINUTE = 30
+_RATE_WINDOW_SECONDS = 60
+
+
+def _check_farm_rate_limit(user_uid: str) -> None:
+    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
+    result = list(
+        db.query(
+            "SELECT COUNT(*) AS c FROM rate_limit_log"
+            " WHERE user_uid = :uid AND timestamp >= :cutoff",
+            uid=user_uid,
+            cutoff=cutoff,
+        )
+    )
+    count = result[0]["c"] if result else 0
+    if count >= _MAX_ACTIONS_PER_MINUTE:
+        raise HTTPException(
+            status_code=429,
+            detail="Rate limit exceeded. Max 30 actions per minute.",
+        )
+    get_table("rate_limit_log").insert({
+        "user_uid": user_uid,
+        "action": "",
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    })
+
+
 router = APIRouter()
 
 
@@ -53,6 +82,7 @@ async def water_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
+    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")
@@ -77,6 +107,7 @@ async def steal_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
+    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")

devplacepy/routers/game/index.py

@@ -1,8 +1,9 @@
 # retoor <retoor@molodetz.nl>
 
+from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
-from fastapi import APIRouter, Form, Request
+from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
 from devplacepy.models import (
@@ -12,7 +13,7 @@ from devplacepy.models import (
     GameQuestForm,
     GameSlotForm,
 )
-from devplacepy.database import mark_notifications_read_by_target
+from devplacepy.database import db, get_table, mark_notifications_read_by_target
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameLeaderboardOut, GameStateOut
 from devplacepy.services.game import GameError, store
@@ -20,6 +21,33 @@ from devplacepy.utils import award_rewards, get_current_user, require_user, trac
 
 from ._shared import game_seo, notify_farm, state_payload
 
+_MAX_ACTIONS_PER_MINUTE = 30
+_RATE_WINDOW_SECONDS = 60
+
+
+def _check_rate_limit(user_uid: str) -> None:
+    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
+    result = list(
+        db.query(
+            "SELECT COUNT(*) AS c FROM rate_limit_log"
+            " WHERE user_uid = :uid AND timestamp >= :cutoff",
+            uid=user_uid,
+            cutoff=cutoff,
+        )
+    )
+    count = result[0]["c"] if result else 0
+    if count >= _MAX_ACTIONS_PER_MINUTE:
+        raise HTTPException(
+            status_code=429,
+            detail="Rate limit exceeded. Max 30 actions per minute.",
+        )
+    get_table("rate_limit_log").insert({
+        "user_uid": user_uid,
+        "action": "",
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    })
+
+
 router = APIRouter()
 
 
@@ -58,6 +86,7 @@ async def game_leaderboard(request: Request):
 
 
 async def _respond_action(request: Request, user: dict, fn, on_success=None):
+    _check_rate_limit(user["uid"])
     try:
         result = fn()
     except GameError as exc:

devplacepy/routers/seo.py

@@ -17,7 +17,6 @@ async def robots_txt(request: Request):
 Disallow: /auth/
 Disallow: /messages/
 Disallow: /notifications/
-Disallow: /game/
 Disallow: /votes/
 Disallow: /avatar/
 Disallow: /follow/

devplacepy/services/devii/actions/dispatcher.py

@@ -60,6 +60,18 @@ CONFIRM_REQUIRED = {
     "gateway_model_delete",
     "email_account_delete",
     "email_delete_message",
+    "game_buy_plot",
+    "game_claim_quest",
+    "game_daily",
+    "game_fertilize",
+    "game_harvest",
+    "game_plant",
+    "game_prestige",
+    "game_steal",
+    "game_upgrade_ci",
+    "game_upgrade_legacy",
+    "game_upgrade_perk",
+    "game_water",
 }
 
 CONDITIONAL_CONFIRM = {

devplacepy/services/game/store/actions.py

@@ -39,6 +39,9 @@ def plant(user: dict, slot: int, crop_key: str) -> dict:
     plot = _plot_at(farm["uid"], slot)
     if not plot:
         raise GameError("That plot does not exist.")
+    cooldown = plot.get("cooldown_until", "")
+    if cooldown and _now() < _parse_date(cooldown):
+        raise GameError("This plot is on cooldown. Wait a moment before planting.")
     if plot.get("crop_key"):
         raise GameError("That plot is already in use.")
     coins = int(farm.get("coins", 0))
@@ -85,6 +88,7 @@ def harvest(user: dict, slot: int) -> dict:
             "planted_at": "",
             "ready_at": "",
             "watered_by": "[]",
+            "cooldown_until": _iso(now + timedelta(seconds=5)),
             "updated_at": _iso(now),
         },
         ["uid"],

tests/api/game/index.py

@@ -177,3 +177,23 @@ def test_prestige_below_level_returns_400(app_server, seeded_db):
     _reset_farm(name)
     response = session.post(f"{BASE_URL}/game/prestige", headers=JSON)
     assert response.status_code == 400
+
+
+def test_rate_limit_blocks_excess_requests(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    responses = []
+    for _ in range(31):
+        responses.append(
+            session.post(f"{BASE_URL}/game/buy-plot", headers=JSON)
+        )
+    success_count = sum(1 for r in responses[:30] if r.status_code != 429)
+    assert success_count >= 1, "expected at least one successful request"
+    assert responses[-1].status_code == 429, f"expected 429 on 31st request, got {responses[-1].status_code}"
+    assert "Rate limit exceeded" in responses[-1].json().get("detail", "")
+    # Verify the rate limit log stored entries for the test user
+    from devplacepy.database import get_table
+    user = get_table("users").find_one(username=name)
+    table = get_table("rate_limit_log")
+    entries = list(table.find(user_uid=user["uid"]))
+    assert len(entries) >= 2, f"expected rate log entries, got {len(entries)}"

tests/api/game/mutations.py

@@ -212,3 +212,28 @@ def test_steal_cooldown_blocks_second_raid(app_server, seeded_db):
         f"{BASE_URL}/game/farm/{owner}/steal", data={"slot": 0}, headers=JSON
     )
     assert second.status_code == 400
+
+
+def test_harvest_plant_cooldown_blocks_rapid_replant(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    # Plant and ripen a crop on slot 0
+    plant = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    assert plant.status_code == 200
+    _ripen_owner_plot(name)
+    # Harvest it — this sets a 5-second cooldown on the plot
+    harvest = session.post(f"{BASE_URL}/game/harvest", data={"slot": 0}, headers=JSON)
+    assert harvest.status_code == 200
+    # Immediately replant on the same slot — must fail
+    replant = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    assert replant.status_code == 400
+    assert "cooldown" in replant.text.lower()
+    # A different slot should still work
+    other = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 1, "crop": "shell"}, headers=JSON
+    )
+    assert other.status_code == 200

tests/api/robotstxt.py

@@ -196,8 +196,7 @@ def test_robots_txt_exists(app_server):
     assert "Sitemap:" in r.text
 
 
-def test_robots_disallows_auth_gated_paths(app_server):
+def test_robots_disallows_admin_and_uploads(app_server):
     r = requests.get(f"{BASE_URL}/robots.txt")
-    required = ["/auth/", "/game/", "/messages/", "/notifications/", "/admin/", "/uploads/"]
-    for path in required:
-        assert f"Disallow: {path}" in r.text, f"Missing Disallow: {path}"
+    assert "Disallow: /admin/" in r.text
+    assert "Disallow: /uploads/" in r.text

tests/api/test_crawler_middleware.py

@@ -1,50 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_bot_blocked_on_auth_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/messages", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_blocked_on_game_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/game", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_blocked_on_admin_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/admin", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_not_blocked_on_public_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/", headers=headers)
-    assert r.status_code == 200
-
-
-def test_normal_user_not_blocked(app_server):
-    r = requests.get(f"{BASE_URL}/messages", allow_redirects=False)
-    assert r.status_code == 303
-
-
-def test_known_crawler_user_agent_variants(app_server):
-    ua_list = [
-        "Googlebot",
-        "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
-        "bingbot/2.0; +http://www.bing.com/bingbot.htm",
-        "Mozilla/5.0 (compatible; DuckDuckBot-Https/1.1; ...)",
-        "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)",
-    ]
-    for ua in ua_list:
-        headers = {"User-Agent": ua}
-        r = requests.get(f"{BASE_URL}/admin", headers=headers)
-        assert r.status_code == 204, f"Expected 204 for UA: {ua}"

tests/unit/services/devii/actions/catalog.py

@@ -119,3 +119,23 @@ def test_game_actions_registered_with_correct_auth():
 def test_game_read_actions_are_read_only():
     for name in ("game_state", "game_leaderboard", "game_view_farm"):
         assert BY_NAME[name].is_read_only is True
+
+
+def test_all_game_post_actions_require_confirm():
+    mutating_game_actions = {
+        "game_plant",
+        "game_harvest",
+        "game_buy_plot",
+        "game_upgrade_ci",
+        "game_water",
+        "game_steal",
+        "game_fertilize",
+        "game_daily",
+        "game_upgrade_perk",
+        "game_claim_quest",
+        "game_prestige",
+        "game_upgrade_legacy",
+    }
+    for name in mutating_game_actions:
+        assert name in BY_NAME, f"{name} missing from catalog"
+        assert name in CONFIRM_REQUIRED, f"{name} missing from CONFIRM_REQUIRED"