Merge pull request #291 from ahmetskilinc/better-rate-limiting

feat: better-rate-limiting

3 files changed, 101 insertions, 24 deletions

diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index f6f81103..f62e24e9 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -1,54 +1,77 @@
 import { NextRequest, NextResponse } from "next/server";

 import { db, eq } from "@opencut/db";

 import { waitlist } from "@opencut/db/schema";

+import { checkBotId } from "botid/server";

 import { nanoid } from "nanoid";

 import { waitlistRateLimit } from "@/lib/rate-limit";

 import { z } from "zod";

+import { env } from "@/env";

+import { cookies } from "next/headers";

+import crypto from "crypto";

 

 const waitlistSchema = z.object({

   email: z.string().email("Invalid email format").min(1, "Email is required"),

 });

 

+const CSRF_TOKEN_NAME = "waitlist-csrf";

+const TOKEN_EXPIRY = 60 * 60 * 1000;

+

+async function validateCSRFToken(request: NextRequest): Promise<boolean> {

+  const clientToken = request.headers.get("x-csrf-token");

+  if (!clientToken) return false;

+

+  const cookieStore = await cookies();

+  const cookieValue = cookieStore.get(CSRF_TOKEN_NAME)?.value;

+  if (!cookieValue) return false;

+

+  const [token, timestamp, signature] = cookieValue.split(":");

+  if (!token || !timestamp || !signature) return false;

+

+  if (clientToken !== token) return false;

+

+  const now = Date.now();

+  const tokenTime = parseInt(timestamp);

+  if (now - tokenTime > TOKEN_EXPIRY) return false;

+

+  const expectedSignature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");

+

+  return signature === expectedSignature;

+}

+

 export async function POST(request: NextRequest) {

-  // Rate limit check

+  const verification = await checkBotId();

+

+  if (verification.isBot) {

+    return NextResponse.json({ error: "Access denied" }, { status: 403 });

+  }

+

   const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";

   const { success } = await waitlistRateLimit.limit(identifier);

 

   if (!success) {

-    return NextResponse.json(

-      { error: "Too many requests. Please try again later." },

-      { status: 429 }

-    );

+    return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });

+  }

+  const isValidToken = await validateCSRFToken(request);

+  if (!isValidToken) {

+    return NextResponse.json({ error: "Invalid security token" }, { status: 403 });

   }

 

   try {

     const body = await request.json();

     const { email } = waitlistSchema.parse(body);

 

-    // Check if email already exists

-    const existingEmail = await db

-      .select()

-      .from(waitlist)

-      .where(eq(waitlist.email, email.toLowerCase()))

-      .limit(1);

+    const existingEmail = await db.select().from(waitlist).where(eq(waitlist.email, email.toLowerCase())).limit(1);

 

     if (existingEmail.length > 0) {

-      return NextResponse.json(

-        { error: "Email already registered" },

-        { status: 409 }

-      );

+      return NextResponse.json({ error: "Email already registered" }, { status: 409 });

     }

 

-    // Add to waitlist

     await db.insert(waitlist).values({

       id: nanoid(),

       email: email.toLowerCase(),

     });

 

-    return NextResponse.json(

-      { message: "Successfully joined waitlist!" },

-      { status: 201 }

-    );

+    return NextResponse.json({ message: "Successfully joined waitlist!" }, { status: 201 });

   } catch (error) {

     if (error instanceof z.ZodError) {

       const firstError = error.errors[0];

@@ -56,9 +79,6 @@ export async function POST(request: NextRequest) {
     }

 

     console.error("Waitlist signup error:", error);

-    return NextResponse.json(

-      { error: "Internal server error" },

-      { status: 500 }

-    );

+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });

   }

 }

diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
new file mode 100644
index 00000000..4c7695fa
--- /dev/null
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+import { env } from "@/env";
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+
+export async function GET(request: NextRequest) {
+  const referer = request.headers.get("referer");
+  const host = request.headers.get("host");
+
+  if (referer) {
+    const refererUrl = new URL(referer);
+
+    if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else if (host) {
+    if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  if (!env.BETTER_AUTH_SECRET) {
+    throw new Error("BETTER_AUTH_SECRET must be configured");
+  }
+
+  const token = crypto.randomBytes(32).toString("hex");
+  const timestamp = Date.now();
+  const signature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
+
+  const cookieStore = await cookies();
+  cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
+    httpOnly: true,
+    secure: env.NODE_ENV === "production",
+    sameSite: "strict",
+    maxAge: TOKEN_EXPIRY / 1000,
+    path: "/",
+  });
+
+  return NextResponse.json({ token });
+}
diff --git a/apps/web/src/app/layout.tsx b/apps/web/src/app/layout.tsx
index 9ac54262..1cbc3f2e 100644
--- a/apps/web/src/app/layout.tsx
+++ b/apps/web/src/app/layout.tsx
@@ -7,9 +7,17 @@ import { TooltipProvider } from "../components/ui/tooltip";
 import { StorageProvider } from "../components/storage-provider";
 import { baseMetaData } from "./metadata";
 import { defaultFont } from "../lib/font-config";
+import { BotIdClient } from "botid/client";
 
 export const metadata = baseMetaData;
 
+const protectedRoutes = [
+  {
+    path: "/api/waitlist",
+    method: "POST",
+  },
+];
+
 export default function RootLayout({
   children,
 }: Readonly<{
@@ -17,6 +25,9 @@ export default function RootLayout({
 }>) {
   return (
     <html lang="en" suppressHydrationWarning>
+      <head>
+        <BotIdClient protect={protectedRoutes} />
+      </head>
       <body className={`${defaultFont.className} font-sans antialiased`}>
         <ThemeProvider attribute="class" forcedTheme="dark">
           <TooltipProvider>