From 088199bd3cd3e7dc8ade88d7cb83718400751c53 Mon Sep 17 00:00:00 2001
From: Cristian Scheid <cristianscheid@gmail.com>
Date: Thu, 30 Apr 2026 15:03:23 -0300
Subject: [PATCH] fix(slave-controller): add brute force protection and avoid
 saving token on debug log

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>
---
 lib/Controller/SlaveController.php | 55 ++++++++++++++----------------
 1 file changed, 26 insertions(+), 29 deletions(-)

diff --git a/lib/Controller/SlaveController.php b/lib/Controller/SlaveController.php
index 0a6d032..24c60be 100644
--- a/lib/Controller/SlaveController.php
+++ b/lib/Controller/SlaveController.php
@@ -25,9 +25,11 @@
 use OCA\GlobalSiteSelector\Vendor\Firebase\JWT\JWT;
 use OCA\GlobalSiteSelector\Vendor\Firebase\JWT\Key;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\Attribute\PublicPage;
+use OCP\AppFramework\Http\Attribute\UseSession;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\Http\RedirectResponse;
 use OCP\AppFramework\OCSController;
@@ -122,15 +124,10 @@ public function sharedFile(string $jwt): DataResponse {
 	}
 
 
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 * @UseSession
-	 *
-	 * @param string $jwt
-	 *
-	 * @return RedirectResponse
-	 */
+	#[PublicPage]
+	#[NoCSRFRequired]
+	#[UseSession]
+	#[BruteForceProtection(action: 'autoLogin')]
 	public function autoLogin(string $jwt): RedirectResponse {
 		$this->logger->debug('autologin incoming request with ' . $jwt);
 
@@ -141,11 +138,10 @@ public function autoLogin(string $jwt): RedirectResponse {
 			return new RedirectResponse('');
 		}
 
-		if ($this->gss->isMaster()) {
-			return new RedirectResponse($masterUrl);
-		}
-		if ($jwt === '') {
-			return new RedirectResponse($masterUrl);
+		if ($this->gss->isMaster() || $jwt === '') {
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -192,12 +188,14 @@ public function autoLogin(string $jwt): RedirectResponse {
 			}
 		} catch (ExpiredException $e) {
 			$this->logger->info('token expired');
-
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		} catch (\Exception $e) {
 			$this->logger->warning('issue during login process', ['exception' => $e]);
-
-			return new RedirectResponse($masterUrl);
+			$response = new RedirectResponse($masterUrl);
+			$response->throttle();
+			return $response;
 		}
 
 		$this->logger->debug('all good. creating session');
@@ -227,17 +225,14 @@ public function autoLogin(string $jwt): RedirectResponse {
 		return new RedirectResponse($home);
 	}
 
-	/**
-	 * Create app token
-	 *
-	 * @PublicPage
-	 * @NoAdminRequired
-	 *
-	 * @return DataResponse
-	 */
-	public function createAppToken($jwt) {
+	#[PublicPage]
+	#[NoAdminRequired]
+	#[BruteForceProtection(action: 'createAppToken')]
+	public function createAppToken($jwt): DataResponse {
 		if ($this->gss->getMode() === 'master' || empty($jwt)) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+			$response->throttle();
+			return $response;
 		}
 
 		try {
@@ -262,7 +257,9 @@ public function createAppToken($jwt) {
 			$this->logger->info('issue while token creation', ['exception' => $e]);
 		}
 
-		return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response = new DataResponse([], Http::STATUS_BAD_REQUEST);
+		$response->throttle();
+		return $response;
 	}
 
 	/**