ticket #105 attempt 1

devplacepy/main.py

@@ -128,6 +128,9 @@ RATE_LIMIT = int(os.environ.get("DEVPLACE_RATE_LIMIT", "60"))
 RATE_WINDOW = 60
 WEB_WORKERS = max(1, int(os.environ.get("DEVPLACE_WEB_WORKERS", "1")))
 RATE_LIMIT_DISABLED = os.environ.get("DEVPLACE_DISABLE_RATE_LIMIT") == "1"
+LOGIN_EMAIL_RATE_LIMIT = int(os.environ.get("DEVPLACE_LOGIN_EMAIL_RATE_LIMIT", "10"))
+
+_email_rate_limit_store: dict[str, list[float]] = defaultdict(list)
 
 HOT_SETTINGS_TTL = 2.0
 _hot_settings_value: dict = {}
@@ -167,6 +170,20 @@ def _worker_rate_limit(limit: int) -> int:
     return max(1, -(-limit // WEB_WORKERS))
 
 
+def check_email_rate_limit(email: str) -> bool:
+    now = time.time()
+    window_start = now - RATE_WINDOW
+    limit = LOGIN_EMAIL_RATE_LIMIT
+    timestamps = [
+        t for t in _email_rate_limit_store.get(email, []) if t > window_start
+    ]
+    if len(timestamps) >= limit:
+        return False
+    timestamps.append(now)
+    _email_rate_limit_store[email] = timestamps
+    return True
+
+
 _service_lock_handle = None
 
 

devplacepy/routers/auth/login.py

@@ -20,6 +20,7 @@ from devplacepy.responses import respond, action_result, wants_json, json_error
 from devplacepy.schemas import AuthPageOut
 from devplacepy.services.audit import record as audit
 from devplacepy.dependencies import json_or_form
+from devplacepy.main import check_email_rate_limit
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -72,6 +73,22 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
             metadata={"email": email},
             summary=f"failed login attempt for {email}",
         )
+        if not check_email_rate_limit(email):
+            audit.record(
+                request,
+                "security.rate_limit.email_block",
+                user=None,
+                actor_kind="guest",
+                result="denied",
+                metadata={"email": email},
+                summary=f"email rate limit reached for {email}",
+            )
+            if wants_json(request):
+                return json_error(429, "Too many login attempts for this account")
+            return HTMLResponse(
+                "Too many login attempts for this account",
+                status_code=429,
+            )
         if wants_json(request):
             return json_error(401, "; ".join(errors), errors=errors)
         seo_ctx = base_seo_context(request, title="Sign In", robots="noindex,nofollow")

devplacepy/static/css/base.css

@@ -513,24 +513,6 @@ img {
     display: inline-block;
 }
 
-.post-action-btn.is-loading,
-.comment-vote-btn.is-loading,
-.comment-action-btn.is-loading,
-.comment-form-submit.is-loading,
-.vote-star.is-loading,
-.poll-option.is-loading {
-    pointer-events: none;
-}
-
-.post-action-btn.is-loading .btn-spinner,
-.comment-vote-btn.is-loading .btn-spinner,
-.comment-action-btn.is-loading .btn-spinner,
-.comment-form-submit.is-loading .btn-spinner,
-.vote-star.is-loading .btn-spinner,
-.poll-option.is-loading .btn-spinner {
-    display: inline-block;
-}
-
 .badge {
     display: inline-flex;
     align-items: center;

devplacepy/static/js/BookmarkManager.js

@@ -22,6 +22,6 @@ export class BookmarkManager extends OptimisticAction {
             if (label) {
                 label.textContent = result.saved ? "Saved" : "Save";
             }
-        }, button);
+        });
     }
 }

devplacepy/static/js/CommentManager.js

@@ -23,10 +23,7 @@ export class CommentManager {
         const wrapper = form.closest(".comment");
         if (!wrapper) return;
         const button = form.querySelector("button[type='submit']");
-        if (button) {
-            button.disabled = true;
-            button.classList.add("is-loading");
-        }
+        if (button) button.disabled = true;
 
         const anchor = wrapper.previousElementSibling
             && wrapper.previousElementSibling.classList.contains("comment")
@@ -41,10 +38,7 @@ export class CommentManager {
             wrapper.remove();
             window.scrollTo({ top: Math.max(anchorTop, 0) });
         } catch (err) {
-            if (button) {
-                button.disabled = false;
-                button.classList.remove("is-loading");
-            }
+            if (button) button.disabled = false;
         }
     }
 
@@ -124,10 +118,7 @@ export class CommentManager {
 
     async submitEdit(form, text) {
         const save = form.querySelector("button[type='submit']");
-        if (save) {
-            save.disabled = true;
-            save.classList.add("is-loading");
-        }
+        if (save) save.disabled = true;
         const content = form.querySelector("textarea").value;
         try {
             const result = await Http.send(form.action, { content });
@@ -141,10 +132,7 @@ export class CommentManager {
             form.remove();
             text.style.display = "";
         } catch (err) {
-            if (save) {
-                save.disabled = false;
-                save.classList.remove("is-loading");
-            }
+            if (save) save.disabled = false;
         }
     }
 
@@ -217,10 +205,7 @@ export class CommentManager {
         }
         form.addEventListener("submit", () => {
             const btn = form.querySelector("button[type='submit']");
-            if (btn) {
-                btn.disabled = true;
-                btn.classList.add("is-loading");
-            }
+            if (btn) btn.disabled = true;
         });
     }
 }

devplacepy/static/js/OptimisticAction.js

@@ -4,11 +4,7 @@ import { Http } from "./Http.js";
 import { Toast } from "./Toast.js";
 
 export class OptimisticAction {
-    async submit(url, params, errorTarget, render, button = null) {
-        if (button) {
-            button.disabled = true;
-            button.classList.add("is-loading");
-        }
+    async submit(url, params, errorTarget, render) {
         try {
             const result = await Http.sendForm(url, params, { silent: true });
             if (render) render(result);
@@ -17,19 +13,10 @@ export class OptimisticAction {
             console.error("optimistic action failed", error);
             if (errorTarget) Toast.flash(errorTarget, "Error", 1500);
             return null;
-        } finally {
-            if (button) {
-                button.disabled = false;
-                button.classList.remove("is-loading");
-            }
         }
     }
 
-    async submitOptimistic(url, params, errorTarget, apply, revert, reconcile, button = null) {
-        if (button) {
-            button.disabled = true;
-            button.classList.add("is-loading");
-        }
+    async submitOptimistic(url, params, errorTarget, apply, revert, reconcile) {
         apply();
         try {
             const result = await Http.sendForm(url, params, { silent: true });
@@ -40,11 +27,6 @@ export class OptimisticAction {
             revert();
             if (errorTarget) Toast.flash(errorTarget, "Error", 1500);
             return null;
-        } finally {
-            if (button) {
-                button.disabled = false;
-                button.classList.remove("is-loading");
-            }
         }
     }
 }

devplacepy/static/js/PollManager.js

@@ -42,7 +42,7 @@ export class PollManager extends OptimisticAction {
         }
         const pollUid = poll.dataset.pollUid;
         const optionUid = option.dataset.optionUid;
-        await this.submit(`/polls/${pollUid}/vote`, { option_uid: optionUid }, null, (result) => this.render(poll, result), option);
+        await this.submit(`/polls/${pollUid}/vote`, { option_uid: optionUid }, null, (result) => this.render(poll, result));
     }
 
     render(poll, result) {

devplacepy/static/js/ReactionBar.js

@@ -75,7 +75,7 @@ export class ReactionBar extends OptimisticAction {
         const type = bar.dataset.reactionType;
         const uid = bar.dataset.reactionUid;
         const emoji = trigger.dataset.reactionEmoji;
-        await this.submit(`/reactions/${type}/${uid}`, { emoji }, null, (result) => this.render(bar, result), trigger);
+        await this.submit(`/reactions/${type}/${uid}`, { emoji }, null, (result) => this.render(bar, result));
         this.closeAllPalettes();
     }
 

devplacepy/static/js/VoteManager.js

@@ -34,7 +34,6 @@ export class VoteManager extends OptimisticAction {
             () => this.render(action, { net: predictedNet, value: newValue }),
             () => this.render(action, { net: prevNet, value: prevValue }),
             (result) => this.render(action, result),
-            button,
         );
     }
 

devplacepy/templates/_bookmark_button.html

@@ -1,3 +1,3 @@
 <button type="button" class="post-action-btn bookmark-btn{% if _bookmarked %} bookmarked{% endif %}" data-bookmark-type="{{ _type }}" data-bookmark-uid="{{ _uid }}" title="Save" aria-label="Save" aria-pressed="{% if _bookmarked %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>
-    <span class="btn-spinner" aria-hidden="true"></span><span class="bookmark-icon">&#x1F516;</span> <span class="bookmark-label">{% if _bookmarked %}Saved{% else %}Save{% endif %}</span>
+    <span class="bookmark-icon">&#x1F516;</span> <span class="bookmark-label">{% if _bookmarked %}Saved{% else %}Save{% endif %}</span>
 </button>

devplacepy/templates/_comment.html

@@ -3,12 +3,12 @@
     <div class="comment-votes" role="group" aria-label="Comment votes">
         <form method="POST" action="/votes/comment/{{ item.comment['uid'] }}">
             <input type="hidden" name="value" value="1">
-            <button type="submit" class="comment-vote-btn vote-up{% if item.my_vote == 1 %} voted{% endif %}" aria-label="Upvote" title="Upvote" aria-pressed="{% if item.my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span>+</button>
+            <button type="submit" class="comment-vote-btn vote-up{% if item.my_vote == 1 %} voted{% endif %}" aria-label="Upvote" title="Upvote" aria-pressed="{% if item.my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>+</button>
         </form>
         <span class="comment-vote-count" data-vote-count="{{ item.comment['uid'] }}">{{ item.votes.up - item.votes.down }}</span>
         <form method="POST" action="/votes/comment/{{ item.comment['uid'] }}">
             <input type="hidden" name="value" value="-1">
-            <button type="submit" class="comment-vote-btn vote-down{% if item.my_vote == -1 %} voted{% endif %}" aria-label="Downvote" title="Downvote" aria-pressed="{% if item.my_vote == -1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span>-</button>
+            <button type="submit" class="comment-vote-btn vote-down{% if item.my_vote == -1 %} voted{% endif %}" aria-label="Downvote" title="Downvote" aria-pressed="{% if item.my_vote == -1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>-</button>
         </form>
     </div>
 
@@ -25,11 +25,11 @@
         {% include "_attachment_display.html" %}
         {% endif %}
         <div class="comment-actions">
-            <button type="button" class="comment-action-btn" data-action="reply"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span><span class="icon">💬</span><span class="label"> Reply</span></button>
+            <button type="button" class="comment-action-btn" data-action="reply"{{ guest_disabled(user) }}><span class="icon">💬</span><span class="label"> Reply</span></button>
             {% if owns(item.comment, user) %}
-            <button type="button" class="comment-action-btn" data-action="edit" data-edit-url="/comments/edit/{{ item.comment['uid'] }}"><span class="btn-spinner" aria-hidden="true"></span><span class="icon">✏️</span><span class="label"> Edit</span></button>
+            <button type="button" class="comment-action-btn" data-action="edit" data-edit-url="/comments/edit/{{ item.comment['uid'] }}"><span class="icon">✏️</span><span class="label"> Edit</span></button>
             <form method="POST" action="/comments/delete/{{ item.comment['uid'] }}" class="inline-form comment-delete-form" data-comment-uid="{{ item.comment['uid'] }}">
-                <button type="submit" class="comment-action-btn" data-confirm="Delete this comment?"><span class="btn-spinner" aria-hidden="true"></span><span class="icon">🗑️</span><span class="label"> Delete</span></button>
+                <button type="submit" class="comment-action-btn" data-confirm="Delete this comment?"><span class="icon">🗑️</span><span class="label"> Delete</span></button>
             </form>
             {% endif %}
             {% set _type = "comment" %}{% set _uid = item.comment['uid'] %}{% set _reactions = item.reactions %}{% include "_reaction_bar.html" %}

devplacepy/templates/_comment_form.html

@@ -9,7 +9,7 @@
             max-size="{{ max_upload_size_mb() }}"
             max-files="{{ max_attachments_per_resource() }}"
             allowed-types="{{ allowed_file_types() }}"></dp-upload>
-        <button type="submit" class="comment-form-submit"><span class="btn-spinner" aria-hidden="true"></span><span class="icon">&#x1F4E4;</span><span class="label"> Post</span></button>
+        <button type="submit" class="comment-form-submit"><span class="icon">&#x1F4E4;</span><span class="label"> Post</span></button>
     </div>
 </form>
 {% else %}

devplacepy/templates/_poll.html

@@ -4,7 +4,6 @@
     <div class="poll-options" role="group" aria-label="Poll options">
         {% for opt in _poll.options %}
         <button type="button" class="poll-option{% if _poll.my_choice == opt.uid %} chosen{% endif %}" data-option-uid="{{ opt.uid }}" aria-pressed="{% if _poll.my_choice == opt.uid %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>
-            <span class="btn-spinner" aria-hidden="true"></span>
             <span class="poll-option-bar" style="--poll-pct: {{ opt.pct }}%;"></span>
             <span class="poll-option-label">{{ render_title(opt.label) }}</span>
             <span class="poll-option-meta">

devplacepy/templates/_post_votes.html

@@ -1,11 +1,11 @@
 <div class="post-votes" role="group" aria-label="Post votes">
     <form method="POST" action="/votes/post/{{ _uid }}" class="inline-form">
         <input type="hidden" name="value" value="-1">
-        <button type="submit" class="post-action-btn vote-down{% if _my_vote == -1 %} voted{% endif %}" aria-label="Downvote" title="Downvote" aria-pressed="{% if _my_vote == -1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span>−</button>
+        <button type="submit" class="post-action-btn vote-down{% if _my_vote == -1 %} voted{% endif %}" aria-label="Downvote" title="Downvote" aria-pressed="{% if _my_vote == -1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>−</button>
     </form>
     <span class="post-vote-count" data-vote-count="{{ _uid }}">{{ _count }}</span>
     <form method="POST" action="/votes/post/{{ _uid }}" class="inline-form">
         <input type="hidden" name="value" value="1">
-        <button type="submit" class="post-action-btn vote-up{% if _my_vote == 1 %} voted{% endif %}" aria-label="Upvote" title="Upvote" aria-pressed="{% if _my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span>+</button>
+        <button type="submit" class="post-action-btn vote-up{% if _my_vote == 1 %} voted{% endif %}" aria-label="Upvote" title="Upvote" aria-pressed="{% if _my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}>+</button>
     </form>
 </div>

devplacepy/templates/_star_vote.html

@@ -1,4 +1,4 @@
 <form method="POST" action="/votes/{{ _type }}/{{ _uid }}" class="inline-form"{% if _stop %} data-stop-propagation{% endif %}>
     <input type="hidden" name="value" value="1">
-    <button type="submit" class="{{ _btn_class }} vote-star{% if _my_vote == 1 %} voted{% endif %}" aria-label="Star" aria-pressed="{% if _my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="btn-spinner" aria-hidden="true"></span><span class="vote-count-value" data-vote-count="{{ _uid }}">{{ _count }}</span></button>
+    <button type="submit" class="{{ _btn_class }} vote-star{% if _my_vote == 1 %} voted{% endif %}" aria-label="Star" aria-pressed="{% if _my_vote == 1 %}true{% else %}false{% endif %}"{{ guest_disabled(user) }}><span class="vote-count-value" data-vote-count="{{ _uid }}">{{ _count }}</span></button>
 </form>

tests/api/auth/login.py

@@ -181,3 +181,27 @@ def test_rate_limit_block_recorded(monkeypatch):
         event_key="security.rate_limit.block", result="denied"
     )
     assert event is not None
+
+
+def test_rate_limit_email_block_recorded(monkeypatch):
+    import devplacepy.main as m
+    from starlette.testclient import TestClient
+
+    monkeypatch.setattr(m, "LOGIN_EMAIL_RATE_LIMIT", 2)
+    m._email_rate_limit_store.clear()
+    client = TestClient(m.app)
+    email = "rate-limited@test.dev"
+    codes = [
+        client.post(
+            "/auth/login",
+            data={"email": email, "password": "wrong"},
+        ).status_code
+        for _ in range(3)
+    ]
+    first_two = codes[:2]
+    assert all(c == 401 for c in first_two), first_two
+    assert codes[2] == 429, codes
+    event = get_table("audit_log").find_one(
+        event_key="security.rate_limit.email_block", result="denied"
+    )
+    assert event is not None

tests/conftest.py

@@ -23,6 +23,7 @@ os.environ["DEVPLACE_DATA_DIR"] = str(_TEST_DATA_DIR)
 os.environ["SECRET_KEY"] = "test-secret-key"
 os.environ["DEVPLACE_DISABLE_SERVICES"] = "1"
 os.environ["DEVPLACE_RATE_LIMIT"] = "1000000"
+os.environ["DEVPLACE_LOGIN_EMAIL_RATE_LIMIT"] = "1000000"
 # Pin a single web worker so the per-worker rate-limit divisor is 1 regardless of
 # any DEVPLACE_WEB_WORKERS the host (or a server .env) exports.
 os.environ["DEVPLACE_WEB_WORKERS"] = "1"