+26 -1

internal/atproto/nsid.go

··· 1 1 package atproto 2 2 3 3 - import "fmt" 3 3 + import ( 4 4 + "fmt" 5 5 + "regexp" 6 6 + ) 4 7 5 8 // NSID (Namespaced Identifier) constants for Arabica lexicons. 6 9 // The domain is reversed following ATProto conventions: arabica.social -> social.arabica ··· 15 18 NSIDBrewer = NSIDBase + ".brewer" 16 19 NSIDGrinder = NSIDBase + ".grinder" 17 20 NSIDRoaster = NSIDBase + ".roaster" 21 21 + 22 22 + // MaxRKeyLength is the maximum allowed length for a record key 23 23 + MaxRKeyLength = 512 18 24 ) 25 25 + 26 26 + // rkeyRegex validates AT Protocol record keys (rkeys). 27 27 + // Valid rkeys contain only alphanumeric characters, hyphens, underscores, colons, and periods. 28 28 + // They must start with an alphanumeric character and be 1-512 characters long. 29 29 + // TIDs are the most common format: 13 lowercase base32 characters (e.g., "3kfk4slgu6s2h"). 30 30 + var rkeyRegex = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,511}$`) 31 31 + 32 32 + // ValidateRKey checks if an rkey is valid according to AT Protocol spec. 33 33 + // Returns true if valid, false otherwise. 34 34 + func ValidateRKey(rkey string) bool { 35 35 + if rkey == "" || len(rkey) > MaxRKeyLength { 36 36 + return false 37 37 + } 38 38 + // Reserved rkeys that should not be used 39 39 + if rkey == "." || rkey == ".." { 40 40 + return false 41 41 + } 42 42 + return rkeyRegex.MatchString(rkey) 43 43 + } 19 44 20 45 // BuildATURI constructs an AT-URI from a DID, collection NSID, and record key 21 46 func BuildATURI(did, collection, rkey string) string {

+46

internal/atproto/nsid_test.go

··· 1 1 package atproto 2 2 3 3 import ( 4 4 + "strings" 4 5 "testing" 5 6 ) 6 7 ··· 27 28 t.Run(tt.name, func(t *testing.T) { 28 29 if tt.got != tt.expected { 29 30 t.Errorf("%s = %q, want %q", tt.name, tt.got, tt.expected) 31 31 + } 32 32 + }) 33 33 + } 34 34 + } 35 35 + 36 36 + func TestValidateRKey(t *testing.T) { 37 37 + tests := []struct { 38 38 + name string 39 39 + rkey string 40 40 + valid bool 41 41 + }{ 42 42 + // Valid rkeys 43 43 + {"TID format", "3kfk4slgu6s2h", true}, 44 44 + {"short alphanumeric", "abc123", true}, 45 45 + {"single char", "a", true}, 46 46 + {"with hyphen", "my-record", true}, 47 47 + {"with underscore", "my_record", true}, 48 48 + {"with period", "my.record", true}, 49 49 + {"with colon", "my:record", true}, 50 50 + {"mixed valid chars", "a1-b2_c3.d4:e5", true}, 51 51 + {"uppercase", "ABC123", true}, 52 52 + {"mixed case", "AbC123xYz", true}, 53 53 + 54 54 + // Invalid rkeys 55 55 + {"empty string", "", false}, 56 56 + {"starts with hyphen", "-abc", false}, 57 57 + {"starts with underscore", "_abc", false}, 58 58 + {"starts with period", ".abc", false}, 59 59 + {"starts with colon", ":abc", false}, 60 60 + {"reserved dot", ".", false}, 61 61 + {"reserved dotdot", "..", false}, 62 62 + {"contains slash", "abc/def", false}, 63 63 + {"contains space", "abc def", false}, 64 64 + {"contains at", "abc@def", false}, 65 65 + {"contains hash", "abc#def", false}, 66 66 + {"contains question", "abc?def", false}, 67 67 + {"too long", strings.Repeat("a", 513), false}, 68 68 + {"max length valid", strings.Repeat("a", 512), true}, 69 69 + } 70 70 + 71 71 + for _, tt := range tests { 72 72 + t.Run(tt.name, func(t *testing.T) { 73 73 + got := ValidateRKey(tt.rkey) 74 74 + if got != tt.valid { 75 75 + t.Errorf("ValidateRKey(%q) = %v, want %v", tt.rkey, got, tt.valid) 30 76 } 31 77 }) 32 78 }

+87

internal/atproto/public_client.go

··· 3 3 import ( 4 4 "context" 5 5 "encoding/json" 6 6 + "errors" 6 7 "fmt" 8 8 + "net" 7 9 "net/http" 8 10 "net/url" 9 11 "strings" ··· 18 20 PLCDirectoryURL = "https://plc.directory" 19 21 ) 20 22 23 23 + // ErrSSRFBlocked is returned when a potential SSRF attack is blocked 24 24 + var ErrSSRFBlocked = errors.New("request blocked: potential SSRF detected") 25 25 + 26 26 + // isPrivateIP checks if an IP address is in a private/internal range 27 27 + func isPrivateIP(ip net.IP) bool { 28 28 + if ip == nil { 29 29 + return false 30 30 + } 31 31 + 32 32 + // Check for loopback 33 33 + if ip.IsLoopback() { 34 34 + return true 35 35 + } 36 36 + 37 37 + // Check for link-local 38 38 + if ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() { 39 39 + return true 40 40 + } 41 41 + 42 42 + // Check for private ranges 43 43 + if ip.IsPrivate() { 44 44 + return true 45 45 + } 46 46 + 47 47 + // Check for unspecified (0.0.0.0) 48 48 + if ip.IsUnspecified() { 49 49 + return true 50 50 + } 51 51 + 52 52 + // Check for cloud metadata endpoint (169.254.169.254) 53 53 + if ip.Equal(net.ParseIP("169.254.169.254")) { 54 54 + return true 55 55 + } 56 56 + 57 57 + return false 58 58 + } 59 59 + 60 60 + // validateDomain checks if a domain is safe to connect to (not internal/private) 61 61 + func validateDomain(domain string) error { 62 62 + // Block obviously dangerous patterns 63 63 + if domain == "localhost" || strings.HasSuffix(domain, ".local") { 64 64 + return ErrSSRFBlocked 65 65 + } 66 66 + 67 67 + // Check for IP addresses embedded in the domain 68 68 + if ip := net.ParseIP(domain); ip != nil { 69 69 + if isPrivateIP(ip) { 70 70 + return ErrSSRFBlocked 71 71 + } 72 72 + } 73 73 + 74 74 + // Resolve the domain and check all IPs 75 75 + ips, err := net.LookupIP(domain) 76 76 + if err != nil { 77 77 + // If we can't resolve it, let the HTTP request fail later 78 78 + return nil 79 79 + } 80 80 + 81 81 + for _, ip := range ips { 82 82 + if isPrivateIP(ip) { 83 83 + return ErrSSRFBlocked 84 84 + } 85 85 + } 86 86 + 87 87 + return nil 88 88 + } 89 89 + 21 90 // PublicClient provides unauthenticated access to public ATProto APIs 22 91 type PublicClient struct { 23 92 baseURL string ··· 89 158 } 90 159 } else if strings.HasPrefix(did, "did:web:") { 91 160 // Web DID - the domain is the PDS 161 161 + // Validate domain to prevent SSRF attacks 92 162 domain := strings.TrimPrefix(did, "did:web:") 163 163 + // Handle percent-encoded colons for ports (e.g., did:web:example.com%3A8080) 164 164 + domain = strings.ReplaceAll(domain, "%3A", ":") 165 165 + 166 166 + // Extract just the host part (without path) 167 167 + if idx := strings.Index(domain, "/"); idx != -1 { 168 168 + domain = domain[:idx] 169 169 + } 170 170 + 171 171 + // Validate the domain is safe 172 172 + host := domain 173 173 + if hostPart, _, err := net.SplitHostPort(domain); err == nil { 174 174 + host = hostPart 175 175 + } 176 176 + if err := validateDomain(host); err != nil { 177 177 + return "", err 178 178 + } 179 179 + 93 180 pdsEndpoint = "https://" + domain 94 181 } 95 182

+2 -1

internal/handlers/auth.go

··· 160 160 161 161 w.Header().Set("Content-Type", "application/json") 162 162 if err := json.NewEncoder(w).Encode(metadata); err != nil { 163 163 - http.Error(w, err.Error(), http.StatusInternalServerError) 163 163 + log.Error().Err(err).Msg("Failed to encode client metadata") 164 164 + http.Error(w, "Failed to encode response", http.StatusInternalServerError) 164 165 return 165 166 } 166 167 }

+142 -39

internal/handlers/handlers.go

··· 55 55 } 56 56 } 57 57 58 58 + // validateRKey validates and returns an rkey from a path parameter. 59 59 + // Returns the rkey if valid, or writes an error response and returns empty string if invalid. 60 60 + func validateRKey(w http.ResponseWriter, rkey string) string { 61 61 + if rkey == "" { 62 62 + http.Error(w, "Record key is required", http.StatusBadRequest) 63 63 + return "" 64 64 + } 65 65 + if !atproto.ValidateRKey(rkey) { 66 66 + http.Error(w, "Invalid record key format", http.StatusBadRequest) 67 67 + return "" 68 68 + } 69 69 + return rkey 70 70 + } 71 71 + 72 72 + // validateOptionalRKey validates an optional rkey from form data. 73 73 + // Returns an error message if invalid, empty string if valid or empty. 74 74 + func validateOptionalRKey(rkey, fieldName string) string { 75 75 + if rkey == "" { 76 76 + return "" 77 77 + } 78 78 + if !atproto.ValidateRKey(rkey) { 79 79 + return fieldName + " has invalid format" 80 80 + } 81 81 + return "" 82 82 + } 83 83 + 58 84 // getAtprotoStore creates a user-scoped atproto store from the request context. 59 85 // Returns the store and true if authenticated, or nil and false if not authenticated. 60 86 func (h *Handler) getAtprotoStore(r *http.Request) (database.Store, bool) { ··· 224 250 225 251 // Show edit brew form 226 252 func (h *Handler) HandleBrewEdit(w http.ResponseWriter, r *http.Request) { 227 227 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 253 253 + rkey := validateRKey(w, r.PathValue("id")) 254 254 + if rkey == "" { 255 255 + return 256 256 + } 228 257 229 258 // Require authentication 230 259 store, authenticated := h.getAtprotoStore(r) ··· 377 406 beanRKey := r.FormValue("bean_rkey") 378 407 if beanRKey == "" { 379 408 http.Error(w, "Bean selection is required", http.StatusBadRequest) 409 409 + return 410 410 + } 411 411 + if !atproto.ValidateRKey(beanRKey) { 412 412 + http.Error(w, "Invalid bean selection", http.StatusBadRequest) 413 413 + return 414 414 + } 415 415 + 416 416 + // Validate optional rkeys 417 417 + grinderRKey := r.FormValue("grinder_rkey") 418 418 + if errMsg := validateOptionalRKey(grinderRKey, "Grinder selection"); errMsg != "" { 419 419 + http.Error(w, errMsg, http.StatusBadRequest) 420 420 + return 421 421 + } 422 422 + brewerRKey := r.FormValue("brewer_rkey") 423 423 + if errMsg := validateOptionalRKey(brewerRKey, "Brewer selection"); errMsg != "" { 424 424 + http.Error(w, errMsg, http.StatusBadRequest) 380 425 return 381 426 } 382 427 ··· 388 433 CoffeeAmount: coffeeAmount, 389 434 TimeSeconds: timeSeconds, 390 435 GrindSize: r.FormValue("grind_size"), 391 391 - GrinderRKey: r.FormValue("grinder_rkey"), 392 392 - BrewerRKey: r.FormValue("brewer_rkey"), 436 436 + GrinderRKey: grinderRKey, 437 437 + BrewerRKey: brewerRKey, 393 438 TastingNotes: r.FormValue("tasting_notes"), 394 439 Rating: rating, 395 440 Pours: pours, ··· 409 454 410 455 // Update existing brew 411 456 func (h *Handler) HandleBrewUpdate(w http.ResponseWriter, r *http.Request) { 412 412 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 457 457 + rkey := validateRKey(w, r.PathValue("id")) 458 458 + if rkey == "" { 459 459 + return 460 460 + } 413 461 414 462 // Require authentication 415 463 store, authenticated := h.getAtprotoStore(r) ··· 436 484 http.Error(w, "Bean selection is required", http.StatusBadRequest) 437 485 return 438 486 } 487 487 + if !atproto.ValidateRKey(beanRKey) { 488 488 + http.Error(w, "Invalid bean selection", http.StatusBadRequest) 489 489 + return 490 490 + } 491 491 + 492 492 + // Validate optional rkeys 493 493 + grinderRKey := r.FormValue("grinder_rkey") 494 494 + if errMsg := validateOptionalRKey(grinderRKey, "Grinder selection"); errMsg != "" { 495 495 + http.Error(w, errMsg, http.StatusBadRequest) 496 496 + return 497 497 + } 498 498 + brewerRKey := r.FormValue("brewer_rkey") 499 499 + if errMsg := validateOptionalRKey(brewerRKey, "Brewer selection"); errMsg != "" { 500 500 + http.Error(w, errMsg, http.StatusBadRequest) 501 501 + return 502 502 + } 439 503 440 504 req := &models.CreateBrewRequest{ 441 505 BeanRKey: beanRKey, ··· 445 509 CoffeeAmount: coffeeAmount, 446 510 TimeSeconds: timeSeconds, 447 511 GrindSize: r.FormValue("grind_size"), 448 448 - GrinderRKey: r.FormValue("grinder_rkey"), 449 449 - BrewerRKey: r.FormValue("brewer_rkey"), 512 512 + GrinderRKey: grinderRKey, 513 513 + BrewerRKey: brewerRKey, 450 514 TastingNotes: r.FormValue("tasting_notes"), 451 515 Rating: rating, 452 516 Pours: pours, ··· 466 530 467 531 // Delete brew 468 532 func (h *Handler) HandleBrewDelete(w http.ResponseWriter, r *http.Request) { 469 469 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 533 533 + rkey := validateRKey(w, r.PathValue("id")) 534 534 + if rkey == "" { 535 535 + return 536 536 + } 470 537 471 538 // Require authentication 472 539 store, authenticated := h.getAtprotoStore(r) ··· 594 661 return 595 662 } 596 663 597 597 - // Validate required fields 598 598 - if req.Name == "" { 599 599 - http.Error(w, "Bean name is required", http.StatusBadRequest) 664 664 + // Validate request 665 665 + if err := req.Validate(); err != nil { 666 666 + http.Error(w, err.Error(), http.StatusBadRequest) 667 667 + return 668 668 + } 669 669 + 670 670 + // Validate optional roaster rkey 671 671 + if errMsg := validateOptionalRKey(req.RoasterRKey, "Roaster selection"); errMsg != "" { 672 672 + http.Error(w, errMsg, http.StatusBadRequest) 600 673 return 601 674 } 602 675 ··· 628 701 return 629 702 } 630 703 631 631 - // Validate required fields 632 632 - if req.Name == "" { 633 633 - http.Error(w, "Roaster name is required", http.StatusBadRequest) 704 704 + // Validate request 705 705 + if err := req.Validate(); err != nil { 706 706 + http.Error(w, err.Error(), http.StatusBadRequest) 634 707 return 635 708 } 636 709 ··· 667 740 668 741 // Bean update/delete handlers 669 742 func (h *Handler) HandleBeanUpdate(w http.ResponseWriter, r *http.Request) { 670 670 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 743 743 + rkey := validateRKey(w, r.PathValue("id")) 744 744 + if rkey == "" { 745 745 + return 746 746 + } 671 747 672 748 // Require authentication 673 749 store, authenticated := h.getAtprotoStore(r) ··· 682 758 return 683 759 } 684 760 685 685 - // Validate required fields 686 686 - if req.Name == "" { 687 687 - http.Error(w, "Bean name is required", http.StatusBadRequest) 761 761 + // Validate request 762 762 + if err := req.Validate(); err != nil { 763 763 + http.Error(w, err.Error(), http.StatusBadRequest) 764 764 + return 765 765 + } 766 766 + 767 767 + // Validate optional roaster rkey 768 768 + if errMsg := validateOptionalRKey(req.RoasterRKey, "Roaster selection"); errMsg != "" { 769 769 + http.Error(w, errMsg, http.StatusBadRequest) 688 770 return 689 771 } 690 772 ··· 708 790 } 709 791 710 792 func (h *Handler) HandleBeanDelete(w http.ResponseWriter, r *http.Request) { 711 711 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 793 793 + rkey := validateRKey(w, r.PathValue("id")) 794 794 + if rkey == "" { 795 795 + return 796 796 + } 712 797 713 798 // Require authentication 714 799 store, authenticated := h.getAtprotoStore(r) ··· 728 813 729 814 // Roaster update/delete handlers 730 815 func (h *Handler) HandleRoasterUpdate(w http.ResponseWriter, r *http.Request) { 731 731 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 816 816 + rkey := validateRKey(w, r.PathValue("id")) 817 817 + if rkey == "" { 818 818 + return 819 819 + } 732 820 733 821 // Require authentication 734 822 store, authenticated := h.getAtprotoStore(r) ··· 743 831 return 744 832 } 745 833 746 746 - // Validate required fields 747 747 - if req.Name == "" { 748 748 - http.Error(w, "Roaster name is required", http.StatusBadRequest) 834 834 + // Validate request 835 835 + if err := req.Validate(); err != nil { 836 836 + http.Error(w, err.Error(), http.StatusBadRequest) 749 837 return 750 838 } 751 839 ··· 769 857 } 770 858 771 859 func (h *Handler) HandleRoasterDelete(w http.ResponseWriter, r *http.Request) { 772 772 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 860 860 + rkey := validateRKey(w, r.PathValue("id")) 861 861 + if rkey == "" { 862 862 + return 863 863 + } 773 864 774 865 // Require authentication 775 866 store, authenticated := h.getAtprotoStore(r) ··· 802 893 return 803 894 } 804 895 805 805 - // Validate required fields 806 806 - if req.Name == "" { 807 807 - http.Error(w, "Grinder name is required", http.StatusBadRequest) 896 896 + // Validate request 897 897 + if err := req.Validate(); err != nil { 898 898 + http.Error(w, err.Error(), http.StatusBadRequest) 808 899 return 809 900 } 810 901 ··· 822 913 } 823 914 824 915 func (h *Handler) HandleGrinderUpdate(w http.ResponseWriter, r *http.Request) { 825 825 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 916 916 + rkey := validateRKey(w, r.PathValue("id")) 917 917 + if rkey == "" { 918 918 + return 919 919 + } 826 920 827 921 // Require authentication 828 922 store, authenticated := h.getAtprotoStore(r) ··· 837 931 return 838 932 } 839 933 840 840 - // Validate required fields 841 841 - if req.Name == "" { 842 842 - http.Error(w, "Grinder name is required", http.StatusBadRequest) 934 934 + // Validate request 935 935 + if err := req.Validate(); err != nil { 936 936 + http.Error(w, err.Error(), http.StatusBadRequest) 843 937 return 844 938 } 845 939 ··· 863 957 } 864 958 865 959 func (h *Handler) HandleGrinderDelete(w http.ResponseWriter, r *http.Request) { 866 866 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 960 960 + rkey := validateRKey(w, r.PathValue("id")) 961 961 + if rkey == "" { 962 962 + return 963 963 + } 867 964 868 965 // Require authentication 869 966 store, authenticated := h.getAtprotoStore(r) ··· 896 993 return 897 994 } 898 995 899 899 - // Validate required fields 900 900 - if req.Name == "" { 901 901 - http.Error(w, "Brewer name is required", http.StatusBadRequest) 996 996 + // Validate request 997 997 + if err := req.Validate(); err != nil { 998 998 + http.Error(w, err.Error(), http.StatusBadRequest) 902 999 return 903 1000 } 904 1001 ··· 916 1013 } 917 1014 918 1015 func (h *Handler) HandleBrewerUpdate(w http.ResponseWriter, r *http.Request) { 919 919 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 1016 1016 + rkey := validateRKey(w, r.PathValue("id")) 1017 1017 + if rkey == "" { 1018 1018 + return 1019 1019 + } 920 1020 921 1021 // Require authentication 922 1022 store, authenticated := h.getAtprotoStore(r) ··· 931 1031 return 932 1032 } 933 1033 934 934 - // Validate required fields 935 935 - if req.Name == "" { 936 936 - http.Error(w, "Brewer name is required", http.StatusBadRequest) 1034 1034 + // Validate request 1035 1035 + if err := req.Validate(); err != nil { 1036 1036 + http.Error(w, err.Error(), http.StatusBadRequest) 937 1037 return 938 1038 } 939 1039 ··· 957 1057 } 958 1058 959 1059 func (h *Handler) HandleBrewerDelete(w http.ResponseWriter, r *http.Request) { 960 960 - rkey := r.PathValue("id") // URL still uses "id" path param but value is now rkey 1060 1060 + rkey := validateRKey(w, r.PathValue("id")) 1061 1061 + if rkey == "" { 1062 1062 + return 1063 1063 + } 961 1064 962 1065 // Require authentication 963 1066 store, authenticated := h.getAtprotoStore(r)

+205

internal/middleware/security.go

··· 1 1 + package middleware 2 2 + 3 3 + import ( 4 4 + "net/http" 5 5 + "strings" 6 6 + "sync" 7 7 + "time" 8 8 + ) 9 9 + 10 10 + // SecurityHeadersMiddleware adds security headers to all responses 11 11 + func SecurityHeadersMiddleware(next http.Handler) http.Handler { 12 12 + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 13 13 + // Prevent clickjacking 14 14 + w.Header().Set("X-Frame-Options", "DENY") 15 15 + 16 16 + // Prevent MIME type sniffing 17 17 + w.Header().Set("X-Content-Type-Options", "nosniff") 18 18 + 19 19 + // XSS protection (legacy but still useful for older browsers) 20 20 + w.Header().Set("X-XSS-Protection", "1; mode=block") 21 21 + 22 22 + // Control referrer information 23 23 + w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin") 24 24 + 25 25 + // Permissions policy - disable unnecessary features 26 26 + w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()") 27 27 + 28 28 + // Content Security Policy 29 29 + // Allows: self for scripts/styles, inline styles (for Tailwind), unpkg for HTMX/Alpine 30 30 + csp := strings.Join([]string{ 31 31 + "default-src 'self'", 32 32 + "script-src 'self' https://unpkg.com", 33 33 + "style-src 'self' 'unsafe-inline'", // unsafe-inline needed for Tailwind 34 34 + "img-src 'self' https: data:", // Allow external images (avatars) and data URIs 35 35 + "font-src 'self'", 36 36 + "connect-src 'self'", 37 37 + "frame-ancestors 'none'", 38 38 + "base-uri 'self'", 39 39 + "form-action 'self'", 40 40 + }, "; ") 41 41 + w.Header().Set("Content-Security-Policy", csp) 42 42 + 43 43 + next.ServeHTTP(w, r) 44 44 + }) 45 45 + } 46 46 + 47 47 + // RateLimiter implements a simple per-IP rate limiter using token bucket algorithm 48 48 + type RateLimiter struct { 49 49 + mu sync.Mutex 50 50 + visitors map[string]*visitor 51 51 + rate int // requests per window 52 52 + window time.Duration // time window 53 53 + cleanup time.Duration // cleanup interval for old entries 54 54 + } 55 55 + 56 56 + type visitor struct { 57 57 + tokens int 58 58 + lastReset time.Time 59 59 + } 60 60 + 61 61 + // NewRateLimiter creates a new rate limiter 62 62 + // rate: number of requests allowed per window 63 63 + // window: time window for rate limiting 64 64 + func NewRateLimiter(rate int, window time.Duration) *RateLimiter { 65 65 + rl := &RateLimiter{ 66 66 + visitors: make(map[string]*visitor), 67 67 + rate: rate, 68 68 + window: window, 69 69 + cleanup: window * 2, 70 70 + } 71 71 + 72 72 + // Start cleanup goroutine 73 73 + go rl.cleanupLoop() 74 74 + 75 75 + return rl 76 76 + } 77 77 + 78 78 + func (rl *RateLimiter) cleanupLoop() { 79 79 + ticker := time.NewTicker(rl.cleanup) 80 80 + defer ticker.Stop() 81 81 + 82 82 + for range ticker.C { 83 83 + rl.mu.Lock() 84 84 + now := time.Now() 85 85 + for ip, v := range rl.visitors { 86 86 + if now.Sub(v.lastReset) > rl.cleanup { 87 87 + delete(rl.visitors, ip) 88 88 + } 89 89 + } 90 90 + rl.mu.Unlock() 91 91 + } 92 92 + } 93 93 + 94 94 + // Allow checks if a request from the given IP is allowed 95 95 + func (rl *RateLimiter) Allow(ip string) bool { 96 96 + rl.mu.Lock() 97 97 + defer rl.mu.Unlock() 98 98 + 99 99 + now := time.Now() 100 100 + v, exists := rl.visitors[ip] 101 101 + 102 102 + if !exists { 103 103 + rl.visitors[ip] = &visitor{ 104 104 + tokens: rl.rate - 1, // Use one token 105 105 + lastReset: now, 106 106 + } 107 107 + return true 108 108 + } 109 109 + 110 110 + // Reset tokens if window has passed 111 111 + if now.Sub(v.lastReset) >= rl.window { 112 112 + v.tokens = rl.rate - 1 113 113 + v.lastReset = now 114 114 + return true 115 115 + } 116 116 + 117 117 + // Check if tokens available 118 118 + if v.tokens > 0 { 119 119 + v.tokens-- 120 120 + return true 121 121 + } 122 122 + 123 123 + return false 124 124 + } 125 125 + 126 126 + // RateLimitConfig holds configuration for rate limiting different endpoint types 127 127 + type RateLimitConfig struct { 128 128 + // AuthLimiter for login/auth endpoints (stricter) 129 129 + AuthLimiter *RateLimiter 130 130 + // APILimiter for general API endpoints 131 131 + APILimiter *RateLimiter 132 132 + // GlobalLimiter for all other requests 133 133 + GlobalLimiter *RateLimiter 134 134 + } 135 135 + 136 136 + // NewDefaultRateLimitConfig creates rate limiters with sensible defaults 137 137 + func NewDefaultRateLimitConfig() *RateLimitConfig { 138 138 + return &RateLimitConfig{ 139 139 + AuthLimiter: NewRateLimiter(5, time.Minute), // 5 auth attempts per minute 140 140 + APILimiter: NewRateLimiter(60, time.Minute), // 60 API calls per minute 141 141 + GlobalLimiter: NewRateLimiter(120, time.Minute), // 120 requests per minute 142 142 + } 143 143 + } 144 144 + 145 145 + // RateLimitMiddleware creates a rate limiting middleware 146 146 + func RateLimitMiddleware(config *RateLimitConfig) func(http.Handler) http.Handler { 147 147 + return func(next http.Handler) http.Handler { 148 148 + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 149 149 + ip := getClientIP(r) 150 150 + path := r.URL.Path 151 151 + 152 152 + var limiter *RateLimiter 153 153 + 154 154 + // Select appropriate limiter based on path 155 155 + switch { 156 156 + case strings.HasPrefix(path, "/auth/") || path == "/login" || path == "/oauth/callback": 157 157 + limiter = config.AuthLimiter 158 158 + case strings.HasPrefix(path, "/api/"): 159 159 + limiter = config.APILimiter 160 160 + default: 161 161 + limiter = config.GlobalLimiter 162 162 + } 163 163 + 164 164 + if !limiter.Allow(ip) { 165 165 + w.Header().Set("Retry-After", "60") 166 166 + http.Error(w, "Too many requests", http.StatusTooManyRequests) 167 167 + return 168 168 + } 169 169 + 170 170 + next.ServeHTTP(w, r) 171 171 + }) 172 172 + } 173 173 + } 174 174 + 175 175 + // getClientIP is defined in logging.go 176 176 + 177 177 + // MaxBodySize limits the size of request bodies 178 178 + const ( 179 179 + MaxJSONBodySize = 1 << 20 // 1 MB for JSON requests 180 180 + MaxFormBodySize = 1 << 20 // 1 MB for form submissions 181 181 + ) 182 182 + 183 183 + // LimitBodyMiddleware limits request body size to prevent DoS 184 184 + func LimitBodyMiddleware(next http.Handler) http.Handler { 185 185 + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 186 186 + if r.Body != nil { 187 187 + contentType := r.Header.Get("Content-Type") 188 188 + var maxSize int64 189 189 + 190 190 + switch { 191 191 + case strings.HasPrefix(contentType, "application/json"): 192 192 + maxSize = MaxJSONBodySize 193 193 + case strings.HasPrefix(contentType, "application/x-www-form-urlencoded"), 194 194 + strings.HasPrefix(contentType, "multipart/form-data"): 195 195 + maxSize = MaxFormBodySize 196 196 + default: 197 197 + maxSize = MaxJSONBodySize // Default limit 198 198 + } 199 199 + 200 200 + r.Body = http.MaxBytesReader(w, r.Body, maxSize) 201 201 + } 202 202 + 203 203 + next.ServeHTTP(w, r) 204 204 + }) 205 205 + }

+180 -1

internal/models/models.go

··· 1 1 package models 2 2 3 3 - import "time" 3 3 + import ( 4 4 + "errors" 5 5 + "time" 6 6 + ) 7 7 + 8 8 + // Field length limits for validation 9 9 + const ( 10 10 + MaxNameLength = 200 11 11 + MaxLocationLength = 200 12 12 + MaxWebsiteLength = 500 13 13 + MaxDescriptionLength = 2000 14 14 + MaxNotesLength = 2000 15 15 + MaxOriginLength = 200 16 16 + MaxRoastLevelLength = 100 17 17 + MaxProcessLength = 100 18 18 + MaxMethodLength = 100 19 19 + MaxGrindSizeLength = 100 20 20 + MaxGrinderTypeLength = 50 21 21 + MaxBurrTypeLength = 50 22 22 + ) 23 23 + 24 24 + // Validation errors 25 25 + var ( 26 26 + ErrNameRequired = errors.New("name is required") 27 27 + ErrNameTooLong = errors.New("name is too long") 28 28 + ErrLocationTooLong = errors.New("location is too long") 29 29 + ErrWebsiteTooLong = errors.New("website is too long") 30 30 + ErrDescTooLong = errors.New("description is too long") 31 31 + ErrNotesTooLong = errors.New("notes is too long") 32 32 + ErrOriginTooLong = errors.New("origin is too long") 33 33 + ErrFieldTooLong = errors.New("field value is too long") 34 34 + ) 4 35 5 36 type Bean struct { 6 37 RKey string `json:"rkey"` // Record key (AT Protocol or stringified ID for SQLite) ··· 142 173 Name string `json:"name"` 143 174 Description string `json:"description"` 144 175 } 176 176 + 177 177 + // Validate checks that all fields are within acceptable limits 178 178 + func (r *CreateBeanRequest) Validate() error { 179 179 + if r.Name == "" { 180 180 + return ErrNameRequired 181 181 + } 182 182 + if len(r.Name) > MaxNameLength { 183 183 + return ErrNameTooLong 184 184 + } 185 185 + if len(r.Origin) > MaxOriginLength { 186 186 + return ErrOriginTooLong 187 187 + } 188 188 + if len(r.RoastLevel) > MaxRoastLevelLength { 189 189 + return ErrFieldTooLong 190 190 + } 191 191 + if len(r.Process) > MaxProcessLength { 192 192 + return ErrFieldTooLong 193 193 + } 194 194 + if len(r.Description) > MaxDescriptionLength { 195 195 + return ErrDescTooLong 196 196 + } 197 197 + return nil 198 198 + } 199 199 + 200 200 + // Validate checks that all fields are within acceptable limits 201 201 + func (r *UpdateBeanRequest) Validate() error { 202 202 + if r.Name == "" { 203 203 + return ErrNameRequired 204 204 + } 205 205 + if len(r.Name) > MaxNameLength { 206 206 + return ErrNameTooLong 207 207 + } 208 208 + if len(r.Origin) > MaxOriginLength { 209 209 + return ErrOriginTooLong 210 210 + } 211 211 + if len(r.RoastLevel) > MaxRoastLevelLength { 212 212 + return ErrFieldTooLong 213 213 + } 214 214 + if len(r.Process) > MaxProcessLength { 215 215 + return ErrFieldTooLong 216 216 + } 217 217 + if len(r.Description) > MaxDescriptionLength { 218 218 + return ErrDescTooLong 219 219 + } 220 220 + return nil 221 221 + } 222 222 + 223 223 + // Validate checks that all fields are within acceptable limits 224 224 + func (r *CreateRoasterRequest) Validate() error { 225 225 + if r.Name == "" { 226 226 + return ErrNameRequired 227 227 + } 228 228 + if len(r.Name) > MaxNameLength { 229 229 + return ErrNameTooLong 230 230 + } 231 231 + if len(r.Location) > MaxLocationLength { 232 232 + return ErrLocationTooLong 233 233 + } 234 234 + if len(r.Website) > MaxWebsiteLength { 235 235 + return ErrWebsiteTooLong 236 236 + } 237 237 + return nil 238 238 + } 239 239 + 240 240 + // Validate checks that all fields are within acceptable limits 241 241 + func (r *UpdateRoasterRequest) Validate() error { 242 242 + if r.Name == "" { 243 243 + return ErrNameRequired 244 244 + } 245 245 + if len(r.Name) > MaxNameLength { 246 246 + return ErrNameTooLong 247 247 + } 248 248 + if len(r.Location) > MaxLocationLength { 249 249 + return ErrLocationTooLong 250 250 + } 251 251 + if len(r.Website) > MaxWebsiteLength { 252 252 + return ErrWebsiteTooLong 253 253 + } 254 254 + return nil 255 255 + } 256 256 + 257 257 + // Validate checks that all fields are within acceptable limits 258 258 + func (r *CreateGrinderRequest) Validate() error { 259 259 + if r.Name == "" { 260 260 + return ErrNameRequired 261 261 + } 262 262 + if len(r.Name) > MaxNameLength { 263 263 + return ErrNameTooLong 264 264 + } 265 265 + if len(r.GrinderType) > MaxGrinderTypeLength { 266 266 + return ErrFieldTooLong 267 267 + } 268 268 + if len(r.BurrType) > MaxBurrTypeLength { 269 269 + return ErrFieldTooLong 270 270 + } 271 271 + if len(r.Notes) > MaxNotesLength { 272 272 + return ErrNotesTooLong 273 273 + } 274 274 + return nil 275 275 + } 276 276 + 277 277 + // Validate checks that all fields are within acceptable limits 278 278 + func (r *UpdateGrinderRequest) Validate() error { 279 279 + if r.Name == "" { 280 280 + return ErrNameRequired 281 281 + } 282 282 + if len(r.Name) > MaxNameLength { 283 283 + return ErrNameTooLong 284 284 + } 285 285 + if len(r.GrinderType) > MaxGrinderTypeLength { 286 286 + return ErrFieldTooLong 287 287 + } 288 288 + if len(r.BurrType) > MaxBurrTypeLength { 289 289 + return ErrFieldTooLong 290 290 + } 291 291 + if len(r.Notes) > MaxNotesLength { 292 292 + return ErrNotesTooLong 293 293 + } 294 294 + return nil 295 295 + } 296 296 + 297 297 + // Validate checks that all fields are within acceptable limits 298 298 + func (r *CreateBrewerRequest) Validate() error { 299 299 + if r.Name == "" { 300 300 + return ErrNameRequired 301 301 + } 302 302 + if len(r.Name) > MaxNameLength { 303 303 + return ErrNameTooLong 304 304 + } 305 305 + if len(r.Description) > MaxDescriptionLength { 306 306 + return ErrDescTooLong 307 307 + } 308 308 + return nil 309 309 + } 310 310 + 311 311 + // Validate checks that all fields are within acceptable limits 312 312 + func (r *UpdateBrewerRequest) Validate() error { 313 313 + if r.Name == "" { 314 314 + return ErrNameRequired 315 315 + } 316 316 + if len(r.Name) > MaxNameLength { 317 317 + return ErrNameTooLong 318 318 + } 319 319 + if len(r.Description) > MaxDescriptionLength { 320 320 + return ErrDescTooLong 321 321 + } 322 322 + return nil 323 323 + }

+16 -4

internal/routing/routing.go

··· 86 86 // Catch-all 404 handler - must be last, catches any unmatched routes 87 87 mux.HandleFunc("/", h.HandleNotFound) 88 88 89 89 - // Apply middleware in order (last added is executed first) 90 90 - // 1. Apply OAuth middleware to add auth context to all requests 91 91 - handler := cfg.OAuthManager.AuthMiddleware(mux) 89 89 + // Apply middleware in order (outermost first, innermost last) 90 90 + var handler http.Handler = mux 92 91 93 93 - // 2. Apply logging middleware (wraps everything) 92 92 + // 1. Limit request body size (innermost - runs first on request) 93 93 + handler = middleware.LimitBodyMiddleware(handler) 94 94 + 95 95 + // 2. Apply OAuth middleware to add auth context 96 96 + handler = cfg.OAuthManager.AuthMiddleware(handler) 97 97 + 98 98 + // 3. Apply rate limiting 99 99 + rateLimitConfig := middleware.NewDefaultRateLimitConfig() 100 100 + handler = middleware.RateLimitMiddleware(rateLimitConfig)(handler) 101 101 + 102 102 + // 4. Apply security headers 103 103 + handler = middleware.SecurityHeadersMiddleware(handler) 104 104 + 105 105 + // 5. Apply logging middleware (outermost - wraps everything) 94 106 handler = middleware.LoggingMiddleware(cfg.Logger)(handler) 95 107 96 108 return handler