|
| 1 | +defmodule Manavault.Auth.AttemptLimiter do |
| 2 | + @moduledoc false |
| 3 | + |
| 4 | + use GenServer |
| 5 | + |
| 6 | + import Ecto.Query |
| 7 | + |
| 8 | + alias Manavault.Auth.ClientFailure |
| 9 | + alias Manavault.Repo |
| 10 | + |
| 11 | + @default_window_ms :timer.minutes(15) |
| 12 | + @default_max_attempts_per_ip 5 |
| 13 | + @default_max_attempts_global 30 |
| 14 | + @default_permanent_ban_after_failures 30 |
| 15 | + @global_key :global |
| 16 | + |
| 17 | + def start_link(opts \\ []) do |
| 18 | + name = Keyword.get(opts, :name, __MODULE__) |
| 19 | + GenServer.start_link(__MODULE__, %{}, name: name) |
| 20 | + end |
| 21 | + |
| 22 | + def check(client_id) do |
| 23 | + GenServer.call(__MODULE__, {:check, client_id}) |
| 24 | + end |
| 25 | + |
| 26 | + def record_failure(client_id) do |
| 27 | + GenServer.call(__MODULE__, {:record_failure, client_id}) |
| 28 | + end |
| 29 | + |
| 30 | + def reset(client_id) do |
| 31 | + GenServer.call(__MODULE__, {:reset, client_id}) |
| 32 | + end |
| 33 | + |
| 34 | + def reset_all do |
| 35 | + GenServer.call(__MODULE__, :reset_all) |
| 36 | + end |
| 37 | + |
| 38 | + @impl true |
| 39 | + def init(state), do: {:ok, state} |
| 40 | + |
| 41 | + @impl true |
| 42 | + def handle_call({:check, client_id}, _from, attempts) do |
| 43 | + now = now_ms() |
| 44 | + attempts = prune_expired(attempts, now) |
| 45 | + |
| 46 | + cond do |
| 47 | + permanently_banned?(client_id) -> |
| 48 | + {:reply, :permanently_banned, attempts} |
| 49 | + |
| 50 | + retry_after = retry_after(attempts, client_id, now) -> |
| 51 | + {:reply, {:rate_limited, retry_after}, attempts} |
| 52 | + |
| 53 | + true -> |
| 54 | + {:reply, :ok, attempts} |
| 55 | + end |
| 56 | + end |
| 57 | + |
| 58 | + def handle_call({:record_failure, client_id}, _from, attempts) do |
| 59 | + now = now_ms() |
| 60 | + |
| 61 | + attempts = |
| 62 | + attempts |
| 63 | + |> prune_expired(now) |
| 64 | + |> increment({:client, client_id}, now) |
| 65 | + |> increment(@global_key, now) |
| 66 | + |
| 67 | + {:reply, record_persistent_failure(client_id), attempts} |
| 68 | + end |
| 69 | + |
| 70 | + def handle_call({:reset, client_id}, _from, attempts) do |
| 71 | + delete_persistent_failure(client_id) |
| 72 | + |
| 73 | + {:reply, :ok, Map.delete(attempts, {:client, client_id})} |
| 74 | + end |
| 75 | + |
| 76 | + def handle_call(:reset_all, _from, _attempts) do |
| 77 | + Repo.delete_all(ClientFailure) |
| 78 | + |
| 79 | + {:reply, :ok, %{}} |
| 80 | + end |
| 81 | + |
| 82 | + defp retry_after(attempts, client_id, now) do |
| 83 | + attempts |
| 84 | + |> Enum.reduce(nil, fn |
| 85 | + {{:client, ^client_id}, attempt}, retry_after -> |
| 86 | + retry_after_if_limited(attempt, :per_ip, now, retry_after) |
| 87 | + |
| 88 | + {@global_key, attempt}, retry_after -> |
| 89 | + retry_after_if_limited(attempt, :global, now, retry_after) |
| 90 | + |
| 91 | + _entry, retry_after -> |
| 92 | + retry_after |
| 93 | + end) |
| 94 | + end |
| 95 | + |
| 96 | + defp retry_after_if_limited(%{count: count, expires_at: expires_at}, scope, now, retry_after) do |
| 97 | + if count >= limit(scope) do |
| 98 | + seconds = max(1, ceil((expires_at - now) / 1000)) |
| 99 | + max(retry_after || 0, seconds) |
| 100 | + else |
| 101 | + retry_after |
| 102 | + end |
| 103 | + end |
| 104 | + |
| 105 | + defp increment(attempts, key, now) do |
| 106 | + Map.update(attempts, key, fresh_attempt(now), fn attempt -> |
| 107 | + %{attempt | count: attempt.count + 1} |
| 108 | + end) |
| 109 | + end |
| 110 | + |
| 111 | + defp fresh_attempt(now) do |
| 112 | + %{count: 1, expires_at: now + window_ms()} |
| 113 | + end |
| 114 | + |
| 115 | + defp prune_expired(attempts, now) do |
| 116 | + Map.reject(attempts, fn {_key, %{expires_at: expires_at}} -> expires_at <= now end) |
| 117 | + end |
| 118 | + |
| 119 | + defp permanently_banned?(client_id) do |
| 120 | + match?( |
| 121 | + %ClientFailure{banned_at: %DateTime{}}, |
| 122 | + Repo.get_by(ClientFailure, client_id: client_id) |
| 123 | + ) |
| 124 | + end |
| 125 | + |
| 126 | + defp record_persistent_failure(client_id) do |
| 127 | + client_failure = |
| 128 | + Repo.get_by(ClientFailure, client_id: client_id) || %ClientFailure{client_id: client_id} |
| 129 | + |
| 130 | + failed_attempts = client_failure.failed_attempts + 1 |
| 131 | + |
| 132 | + client_failure |
| 133 | + |> ClientFailure.changeset(%{ |
| 134 | + failed_attempts: failed_attempts, |
| 135 | + banned_at: banned_at(failed_attempts) |
| 136 | + }) |
| 137 | + |> Repo.insert_or_update!() |
| 138 | + |
| 139 | + if failed_attempts >= permanent_ban_after_failures(), do: :banned, else: :ok |
| 140 | + end |
| 141 | + |
| 142 | + defp banned_at(failed_attempts) do |
| 143 | + if failed_attempts >= permanent_ban_after_failures() do |
| 144 | + DateTime.utc_now() |> DateTime.truncate(:second) |
| 145 | + end |
| 146 | + end |
| 147 | + |
| 148 | + defp delete_persistent_failure(client_id) do |
| 149 | + from(failure in ClientFailure, where: failure.client_id == ^client_id) |
| 150 | + |> Repo.delete_all() |
| 151 | + end |
| 152 | + |
| 153 | + defp now_ms, do: System.monotonic_time(:millisecond) |
| 154 | + |
| 155 | + defp limit(:per_ip), do: auth_rate_limit(:max_attempts_per_ip, @default_max_attempts_per_ip) |
| 156 | + defp limit(:global), do: auth_rate_limit(:max_attempts_global, @default_max_attempts_global) |
| 157 | + defp window_ms, do: auth_rate_limit(:window_ms, @default_window_ms) |
| 158 | + |
| 159 | + defp permanent_ban_after_failures do |
| 160 | + auth_rate_limit(:permanent_ban_after_failures, @default_permanent_ban_after_failures) |
| 161 | + end |
| 162 | + |
| 163 | + defp auth_rate_limit(key, default) do |
| 164 | + :manavault |
| 165 | + |> Application.get_env(:auth_rate_limit, []) |
| 166 | + |> Keyword.get(key, default) |
| 167 | + end |
| 168 | +end |
0 commit comments