new policy protect email or sms api

.env.example

@@ -33,3 +33,7 @@ HIGH_FREQUENCY_TIME_RANGE=2
 HIGH_FREQUENCY_COUNT=10
 CREATOR_INFO=steem|steemcurator01|steemcurator02|booming01|booming02|booming03|booming04
 GOOGLE_ANALYTICS_ID=
+SMS_SEND_TIME_WINDOW=600
+SMS_SEND_THRESHOLD_IN_TIME_WINDOW=1
+EMAIL_SEND_TIME_WINDOW=600
+EMAIL_SEND_THRESHOLD_IN_TIME_WINDOW=1

.github/workflows/build-and-deploy.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [10.x, 12.x]
+        node-version: [20.x]
     steps:
       - uses: actions/checkout@v2
       - name: Use Node.js ${{ matrix.node-version }}

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:10-alpine as build-stage
+FROM node:20-alpine as build-stage
 
 WORKDIR /app
 
@@ -26,7 +26,7 @@ RUN yarn build
 RUN yarn install --non-interactive --frozen-lockfile --production
 
 # build and test admin interface
-FROM node:10-alpine as admin-stage
+FROM node:20-alpine as admin-stage
 COPY admin /app/admin
 WORKDIR /app/admin
 ENV REACT_APP_SERVER_ADDRESS /admin
@@ -35,7 +35,7 @@ RUN JOBS=max yarn install --non-interactive --frozen-lockfile && \
     yarn build
 
 # copy built application to runtime image
-FROM node:10-alpine
+FROM node:20-alpine
 WORKDIR /app
 COPY --from=build-stage /app/app.js app.js
 COPY --from=build-stage /app/constants.js constants.js

db/migrations/20240209-add-index-of-created_at-in-actions-table.js

@@ -0,0 +1,8 @@
+module.exports = {
+  up: async (queryInterface, Sequelize) => {
+    await queryInterface.addIndex('actions', ['created_at'], {
+        name: 'idx_created_at',
+    })
+  },
+  down: queryInterface => queryInterface.removeIndex('actions', 'idx_created_at'),
+};

helpers/database.js

@@ -139,6 +139,33 @@ async function actionLimitNew(ip, action = 'default', ipLimit = 32) {
     }
 }
 
+/**
+ * protect email or sms api
+ * in {timeWindow}, only {limitCount} are allowed.
+ * -- action = 'request_email_code' | 'send_sms'
+ * -- timeWindow
+ * -- limitCount
+ */
+async function emailOrSmsActionLimit(action, timeWindow = 300, limitCount = 1) {
+    const created_at = {
+        [Op.gte]: moment()
+            .subtract(timeWindow, 's')
+            .toDate(),
+    };
+    const promises = [
+        db.actions.count({
+            where: { created_at, action: { [Op.eq]: action } },
+        }),
+    ];
+    const [actions] = await Promise.all(promises);
+    if (actions > limitCount) {
+        throw new ApiError({
+            type: 'error_api_auth_code_request_frequently',
+            field: { action },
+        });
+    }
+}
+
 /**
  * find last send sms action by country number
  */
@@ -209,4 +236,5 @@ module.exports = {
     deleteEmailRecord,
     findLastSendSmsByCountryNumber,
     countTryNumber,
+    emailOrSmsActionLimit,
 };

routes/apiHandlers.js

@@ -917,6 +917,18 @@ async function handleRequestEmailCode(ip, email, log, locale) {
 
     await database.actionLimitNew(ip, 'request_email_code');
 
+    const timeWindow = process.env.EMAIL_SEND_TIME_WINDOW
+        ? parseInt(process.env.EMAIL_SEND_TIME_WINDOW, 10)
+        : 300;
+    const limitCount = process.env.EMAIL_SEND_THRESHOLD_IN_TIME_WINDOW
+        ? parseInt(process.env.EMAIL_SEND_THRESHOLD_IN_TIME_WINDOW, 10)
+        : 1;
+    await database.emailOrSmsActionLimit(
+        'request_email_code',
+        timeWindow,
+        limitCount
+    );
+
     await database.logAction({
         action: 'request_email_code',
         ip,
@@ -1361,6 +1373,14 @@ async function handleRequestSmsNew(req) {
         }
     }
 
+    const timeWindow = process.env.SMS_SEND_TIME_WINDOW
+        ? parseInt(process.env.SMS_SEND_TIME_WINDOW, 10)
+        : 300;
+    const limitCount = process.env.SMS_SEND_THRESHOLD_IN_TIME_WINDOW
+        ? parseInt(process.env.SMS_SEND_THRESHOLD_IN_TIME_WINDOW, 10)
+        : 1;
+    await database.emailOrSmsActionLimit('send_sms', timeWindow, limitCount);
+
     await database.logAction({
         action: 'send_sms',
         ip: req.ip,
@@ -1369,6 +1389,7 @@ async function handleRequestSmsNew(req) {
             countryNumber,
         },
     });
+
     services.recordSmsTracker({
         sendType: 'before_send_sms',
         countryCode: req.body.prefix,