ticket #105 attempt 1

devplacepy/main.py

@@ -128,6 +128,9 @@ RATE_LIMIT = int(os.environ.get("DEVPLACE_RATE_LIMIT", "60"))
 RATE_WINDOW = 60
 WEB_WORKERS = max(1, int(os.environ.get("DEVPLACE_WEB_WORKERS", "1")))
 RATE_LIMIT_DISABLED = os.environ.get("DEVPLACE_DISABLE_RATE_LIMIT") == "1"
+LOGIN_EMAIL_RATE_LIMIT = int(os.environ.get("DEVPLACE_LOGIN_EMAIL_RATE_LIMIT", "10"))
+
+_email_rate_limit_store: dict[str, list[float]] = defaultdict(list)
 
 HOT_SETTINGS_TTL = 2.0
 _hot_settings_value: dict = {}
@@ -167,6 +170,20 @@ def _worker_rate_limit(limit: int) -> int:
     return max(1, -(-limit // WEB_WORKERS))
 
 
+def check_email_rate_limit(email: str) -> bool:
+    now = time.time()
+    window_start = now - RATE_WINDOW
+    limit = LOGIN_EMAIL_RATE_LIMIT
+    timestamps = [
+        t for t in _email_rate_limit_store.get(email, []) if t > window_start
+    ]
+    if len(timestamps) >= limit:
+        return False
+    timestamps.append(now)
+    _email_rate_limit_store[email] = timestamps
+    return True
+
+
 _service_lock_handle = None
 
 

devplacepy/routers/auth/login.py

@@ -20,6 +20,7 @@ from devplacepy.responses import respond, action_result, wants_json, json_error
 from devplacepy.schemas import AuthPageOut
 from devplacepy.services.audit import record as audit
 from devplacepy.dependencies import json_or_form
+from devplacepy.main import check_email_rate_limit
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -72,6 +73,22 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
             metadata={"email": email},
             summary=f"failed login attempt for {email}",
         )
+        if not check_email_rate_limit(email):
+            audit.record(
+                request,
+                "security.rate_limit.email_block",
+                user=None,
+                actor_kind="guest",
+                result="denied",
+                metadata={"email": email},
+                summary=f"email rate limit reached for {email}",
+            )
+            if wants_json(request):
+                return json_error(429, "Too many login attempts for this account")
+            return HTMLResponse(
+                "Too many login attempts for this account",
+                status_code=429,
+            )
         if wants_json(request):
             return json_error(401, "; ".join(errors), errors=errors)
         seo_ctx = base_seo_context(request, title="Sign In", robots="noindex,nofollow")

devplacepy/templates/_comment.html

@@ -1,4 +1,4 @@
-{% macro comment_cell(item, depth, parent_author=None, parent_url=None) %}
+{% macro comment_cell(item, depth, parent_author=None) %}
 <div class="comment" style="--comment-depth: {{ depth }};" data-depth="{{ depth }}">
     <div class="comment-votes" role="group" aria-label="Comment votes">
         <form method="POST" action="/votes/comment/{{ item.comment['uid'] }}">
@@ -26,7 +26,6 @@
         {% endif %}
         <div class="comment-actions">
             <button type="button" class="comment-action-btn" data-action="reply"{{ guest_disabled(user) }}><span class="icon">💬</span><span class="label"> Reply</span></button>
-            <button type="button" class="comment-action-btn" data-share="{{ parent_url }}#comment-{{ item.comment['uid'] }}"><span class="icon">&#x1F517;</span><span class="label"> Share</span></button>
             {% if owns(item.comment, user) %}
             <button type="button" class="comment-action-btn" data-action="edit" data-edit-url="/comments/edit/{{ item.comment['uid'] }}"><span class="icon">✏️</span><span class="label"> Edit</span></button>
             <form method="POST" action="/comments/delete/{{ item.comment['uid'] }}" class="inline-form comment-delete-form" data-comment-uid="{{ item.comment['uid'] }}">
@@ -40,21 +39,21 @@
 </div>
 {% endmacro %}
 
-{% macro render_comment(item, depth=0, parent_url=None) %}
+{% macro render_comment(item, depth=0) %}
 {% set max_depth = 2 %}
 {% set visual_depth = depth if depth < max_depth else max_depth %}
-{% call comment_cell(item, visual_depth, parent_url=parent_url) %}
+{% call comment_cell(item, visual_depth) %}
     {% if item.children %}
     {% if depth < max_depth %}
     <div class="comment-replies">
         {% for child in item.children %}
-        {{ render_comment(child, depth + 1, parent_url) }}
+        {{ render_comment(child, depth + 1) }}
         {% endfor %}
     </div>
     {% else %}
     <div class="comment-replies comment-replies-flat">
         {% for child in item.children %}
-        {{ render_comment_flat(child, max_depth, item.author, parent_url) }}
+        {{ render_comment_flat(child, max_depth, item.author) }}
         {% endfor %}
     </div>
     {% endif %}
@@ -62,9 +61,9 @@
 {% endcall %}
 {% endmacro %}
 
-{% macro render_comment_flat(item, depth, parent_author, parent_url=None) %}
-{% call comment_cell(item, depth, parent_author, parent_url=parent_url) %}{% endcall %}
+{% macro render_comment_flat(item, depth, parent_author) %}
+{% call comment_cell(item, depth, parent_author) %}{% endcall %}
 {% for child in item.children %}
-{{ render_comment_flat(child, depth, item.author, parent_url) }}
+{{ render_comment_flat(child, depth, item.author) }}
 {% endfor %}
 {% endmacro %}

devplacepy/templates/_comment_section.html

@@ -3,10 +3,8 @@
 
     {% from "_comment.html" import render_comment with context %}
 
-    {% set parent_url = resolve_object_url(target_type, target_uid) %}
-
     {% for item in comments %}
-    {{ render_comment(item, 0, parent_url) }}
+    {{ render_comment(item, 0) }}
     {% else %}
     <p class="no-comments-msg">No comments yet. Start the discussion.</p>
     {% endfor %}

devplacepy/templating.py

@@ -9,7 +9,6 @@ from devplacepy.cache import TTLCache
 from devplacepy.config import STATIC_VERSION, TEMPLATES_DIR, TEMPLATE_AUTO_RELOAD, PRESENCE_TIMEOUT_SECONDS
 from devplacepy.constants import TOPICS, REACTION_EMOJI
 from devplacepy.database import get_int_setting, get_setting, get_table
-from devplacepy.database.content import resolve_object_url
 from devplacepy.avatar import avatar_url, avatar_seed
 from devplacepy.utils import format_date as _format_date
 from devplacepy.utils import time_ago as _time_ago
@@ -50,7 +49,6 @@ templates.env.globals["is_self"] = is_self
 templates.env.globals["guest_disabled"] = guest_disabled
 templates.env.globals["is_online"] = presence.is_online
 templates.env.globals["presence_timeout"] = PRESENCE_TIMEOUT_SECONDS
-templates.env.globals["resolve_object_url"] = resolve_object_url
 
 from devplacepy.docs_devrant import devrant_endpoints
 

tests/api/auth/login.py

@@ -181,3 +181,27 @@ def test_rate_limit_block_recorded(monkeypatch):
         event_key="security.rate_limit.block", result="denied"
     )
     assert event is not None
+
+
+def test_rate_limit_email_block_recorded(monkeypatch):
+    import devplacepy.main as m
+    from starlette.testclient import TestClient
+
+    monkeypatch.setattr(m, "LOGIN_EMAIL_RATE_LIMIT", 2)
+    m._email_rate_limit_store.clear()
+    client = TestClient(m.app)
+    email = "rate-limited@test.dev"
+    codes = [
+        client.post(
+            "/auth/login",
+            data={"email": email, "password": "wrong"},
+        ).status_code
+        for _ in range(3)
+    ]
+    first_two = codes[:2]
+    assert all(c == 401 for c in first_two), first_two
+    assert codes[2] == 429, codes
+    event = get_table("audit_log").find_one(
+        event_key="security.rate_limit.email_block", result="denied"
+    )
+    assert event is not None

tests/conftest.py

@@ -23,6 +23,7 @@ os.environ["DEVPLACE_DATA_DIR"] = str(_TEST_DATA_DIR)
 os.environ["SECRET_KEY"] = "test-secret-key"
 os.environ["DEVPLACE_DISABLE_SERVICES"] = "1"
 os.environ["DEVPLACE_RATE_LIMIT"] = "1000000"
+os.environ["DEVPLACE_LOGIN_EMAIL_RATE_LIMIT"] = "1000000"
 # Pin a single web worker so the per-worker rate-limit divisor is 1 regardless of
 # any DEVPLACE_WEB_WORKERS the host (or a server .env) exports.
 os.environ["DEVPLACE_WEB_WORKERS"] = "1"