Secure environment & rate limiting

Author: HushLuxe

.gitignore

@@ -22,6 +22,10 @@ yarn-error.log*
 # vercel
 .vercel
 
+# codex
+.codex/
+.codex
+
 # typescript
 *.tsbuildinfo
-next-env.d.ts
+next-env.d.ts

app/api/auth/logout/route.ts

@@ -4,9 +4,17 @@ import {
   readRefreshToken,
   revokeSession,
 } from '@/lib/auth/session'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
+    const limited = await enforceRateLimit(request, {
+      key: buildRateLimitKey(request, 'auth:logout'),
+      limit: 20,
+      windowMs: 60_000,
+    })
+    if (limited) return limited
+
     const refreshToken = readRefreshToken(request)
     if (refreshToken) {
       await revokeSession(refreshToken)

app/api/auth/me/route.ts

@@ -1,7 +1,15 @@
 import { NextResponse } from 'next/server'
 import { withAuth } from '@/lib/auth/middleware'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
 
 export const GET = withAuth(async (_request, auth) => {
+  const limited = await enforceRateLimit(_request, {
+    key: buildRateLimitKey(_request, 'auth:me', auth.walletAddress),
+    limit: 60,
+    windowMs: 60_000,
+  })
+  if (limited) return limited
+
   return NextResponse.json(
     {
       walletAddress: auth.walletAddress,

app/api/auth/nonce/route.ts

@@ -2,20 +2,32 @@ import { NextRequest, NextResponse } from 'next/server'
 import { NONCE_TTL_SECONDS } from '@/lib/auth/constants'
 import { randomNonce, sha256Hex } from '@/lib/auth/crypto'
 import { saveNonce } from '@/lib/auth/store'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
+import { parseJson } from '@/lib/security/validation'
 import {
   buildAuthMessage,
   isValidStellarAddress,
   normalizeWalletAddress,
 } from '@/lib/auth/stellar'
+import { z } from 'zod'
 
-interface NonceRequestBody {
-  walletAddress?: string
-}
+const nonceBodySchema = z.object({
+  walletAddress: z.string().trim().min(1).max(56),
+})
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
-    const body: NonceRequestBody = await request.json()
-    const walletAddress = body.walletAddress?.trim()
+    const parsed = await parseJson(request, nonceBodySchema)
+    if ('response' in parsed) return parsed.response
+
+    const walletAddress = parsed.data.walletAddress
+
+    const limited = await enforceRateLimit(request, {
+      key: buildRateLimitKey(request, 'auth:nonce', walletAddress),
+      limit: 5,
+      windowMs: 60_000,
+    })
+    if (limited) return limited
 
     if (!walletAddress || !isValidStellarAddress(walletAddress)) {
       return NextResponse.json(

app/api/auth/refresh/route.ts

@@ -4,9 +4,17 @@ import {
   rotateSession,
   setSessionCookies,
 } from '@/lib/auth/session'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
+    const limited = await enforceRateLimit(request, {
+      key: buildRateLimitKey(request, 'auth:refresh'),
+      limit: 30,
+      windowMs: 60_000,
+    })
+    if (limited) return limited
+
     const refreshToken = readRefreshToken(request)
     if (!refreshToken) {
       return NextResponse.json(

app/api/auth/verify/route.ts

@@ -2,27 +2,39 @@ import { NextRequest, NextResponse } from 'next/server'
 import { createSession, setSessionCookies } from '@/lib/auth/session'
 import { consumeNonce, hasActiveNonce } from '@/lib/auth/store'
 import { sha256Hex } from '@/lib/auth/crypto'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
+import { parseJson } from '@/lib/security/validation'
 import {
   buildAuthMessage,
   isValidStellarAddress,
   normalizeWalletAddress,
   verifyStellarSignature,
 } from '@/lib/auth/stellar'
+import { z } from 'zod'
 
-interface VerifyRequestBody {
-  walletAddress?: string
-  nonce?: string
-  signature?: string
-  message?: string
-}
+const verifyBodySchema = z.object({
+  walletAddress: z.string().trim().min(1).max(56),
+  nonce: z.string().trim().min(1).max(256),
+  signature: z.string().trim().min(1).max(4096),
+  message: z.string().trim().min(1).max(512).optional(),
+})
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
-    const body: VerifyRequestBody = await request.json()
+    const parsed = await parseJson(request, verifyBodySchema)
+    if ('response' in parsed) return parsed.response
+    const body = parsed.data
+
+    const walletAddress = body.walletAddress
+    const nonce = body.nonce
+    const signature = body.signature
 
-    const walletAddress = body.walletAddress?.trim()
-    const nonce = body.nonce?.trim()
-    const signature = body.signature?.trim()
+    const limited = await enforceRateLimit(request, {
+      key: buildRateLimitKey(request, 'auth:verify', walletAddress),
+      limit: 10,
+      windowMs: 60_000,
+    })
+    if (limited) return limited
 
     if (!walletAddress || !nonce || !signature) {
       return NextResponse.json(

app/api/freelancer/reputation/route.ts

@@ -1,11 +1,19 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { withAuth } from '@/lib/auth/middleware'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
 import {
   getFreelancerReputation,
   getUserIdByWallet,
 } from '@/lib/reputation'
 
 export const GET = withAuth(async (request: NextRequest, auth) => {
+  const limited = await enforceRateLimit(request, {
+    key: buildRateLimitKey(request, 'freelancer:reputation', auth.walletAddress),
+    limit: 60,
+    windowMs: 60_000,
+  })
+  if (limited) return limited
+
   const userId = await getUserIdByWallet(auth.walletAddress)
   if (userId === null) {
     return NextResponse.json(

app/api/freelancers/[userId]/reputation/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
 import {
   getFreelancerReputation,
   userExists,
@@ -7,6 +8,13 @@ import {
 type RouteContext = { params: Promise<{ userId: string }> }
 
 export async function GET(_request: NextRequest, context: RouteContext) {
+  const limited = await enforceRateLimit(_request, {
+    key: buildRateLimitKey(_request, 'freelancers:reputation'),
+    limit: 120,
+    windowMs: 60_000,
+  })
+  if (limited) return limited
+
   const { userId: rawId } = await context.params
   const id = Number.parseInt(rawId, 10)
 

lib/auth/session.ts

@@ -8,10 +8,9 @@ import {
 import { sha256Hex } from '@/lib/auth/crypto'
 import { signSessionToken, verifySessionToken } from '@/lib/auth/jwt'
 import {
-  findValidRefreshToken,
   revokeRefreshToken,
+  rotateRefreshToken,
   storeRefreshToken,
-  touchRefreshToken,
 } from '@/lib/auth/store'
 import { normalizeWalletAddress } from '@/lib/auth/stellar'
 
@@ -42,23 +41,20 @@ function getClientIp(request: NextRequest): string | null {
   return request.headers.get('x-real-ip')
 }
 
-export async function createSession(
-  request: NextRequest,
-  walletAddress: string
-): Promise<AuthSession> {
-  const normalizedWallet = normalizeWalletAddress(walletAddress)
-  const secret = getJwtSecret()
-
+function buildSessionTokens(
+  walletAddress: string,
+  secret: string
+): Omit<AuthSession, 'walletAddress'> {
   const access = signSessionToken({
-    subject: normalizedWallet,
-    walletAddress: normalizedWallet,
+    subject: walletAddress,
+    walletAddress,
     type: 'access',
     expiresInSeconds: ACCESS_TOKEN_TTL_SECONDS,
     secret,
   })
   const refresh = signSessionToken({
-    subject: normalizedWallet,
-    walletAddress: normalizedWallet,
+    subject: walletAddress,
+    walletAddress,
     type: 'refresh',
     expiresInSeconds: REFRESH_TOKEN_TTL_SECONDS,
     secret,
@@ -67,22 +63,36 @@ export async function createSession(
   const accessTokenExpiresAt = new Date(access.payload.exp * 1000)
   const refreshTokenExpiresAt = new Date(refresh.payload.exp * 1000)
 
+  return {
+    accessToken: access.token,
+    refreshToken: refresh.token,
+    accessTokenExpiresAt,
+    refreshTokenExpiresAt,
+    refreshJti: refresh.payload.jti,
+  }
+}
+
+export async function createSession(
+  request: NextRequest,
+  walletAddress: string
+): Promise<AuthSession> {
+  const normalizedWallet = normalizeWalletAddress(walletAddress)
+  const secret = getJwtSecret()
+
+  const tokens = buildSessionTokens(normalizedWallet, secret)
+
   await storeRefreshToken({
     walletAddress: normalizedWallet,
-    jti: refresh.payload.jti,
-    tokenHash: sha256Hex(refresh.token),
-    expiresAt: refreshTokenExpiresAt,
+    jti: tokens.refreshJti,
+    tokenHash: sha256Hex(tokens.refreshToken),
+    expiresAt: tokens.refreshTokenExpiresAt,
     userAgent: request.headers.get('user-agent'),
     ipAddress: getClientIp(request),
   })
 
   return {
     walletAddress: normalizedWallet,
-    accessToken: access.token,
-    refreshToken: refresh.token,
-    accessTokenExpiresAt,
-    refreshTokenExpiresAt,
-    refreshJti: refresh.payload.jti,
+    ...tokens,
   }
 }
 
@@ -96,24 +106,27 @@ export async function rotateSession(
     return null
   }
 
-  const tokenHash = sha256Hex(refreshToken)
-  const isValid = await findValidRefreshToken({
-    walletAddress: payload.wallet,
-    jti: payload.jti,
-    tokenHash,
+  const normalizedWallet = normalizeWalletAddress(payload.wallet)
+  const nextTokens = buildSessionTokens(normalizedWallet, secret)
+
+  const rotated = await rotateRefreshToken({
+    walletAddress: normalizedWallet,
+    currentJti: payload.jti,
+    currentTokenHash: sha256Hex(refreshToken),
+    newJti: nextTokens.refreshJti,
+    newTokenHash: sha256Hex(nextTokens.refreshToken),
+    newExpiresAt: nextTokens.refreshTokenExpiresAt,
+    userAgent: request.headers.get('user-agent'),
+    ipAddress: getClientIp(request),
   })
-  if (!isValid) {
+  if (!rotated) {
     return null
   }
 
-  await touchRefreshToken(payload.jti)
-  const session = await createSession(request, payload.wallet)
-  await revokeRefreshToken({
-    jti: payload.jti,
-    replacedByJti: session.refreshJti,
-  })
-
-  return session
+  return {
+    walletAddress: normalizedWallet,
+    ...nextTokens,
+  }
 }
 
 export async function revokeSession(refreshToken: string): Promise<void> {

lib/auth/store.ts

@@ -144,3 +144,66 @@ export async function findValidRefreshToken({
 
   return rows.length > 0
 }
+
+export async function rotateRefreshToken({
+  walletAddress,
+  currentJti,
+  currentTokenHash,
+  newJti,
+  newTokenHash,
+  newExpiresAt,
+  userAgent,
+  ipAddress,
+}: {
+  walletAddress: string
+  currentJti: string
+  currentTokenHash: string
+  newJti: string
+  newTokenHash: string
+  newExpiresAt: Date
+  userAgent: string | null
+  ipAddress: string | null
+}): Promise<boolean> {
+  const rows = await sql<{ rotated: string | number }[]>`
+    WITH old AS (
+      SELECT id
+      FROM auth_refresh_tokens
+      WHERE wallet_address = ${walletAddress}
+        AND jti = ${currentJti}
+        AND token_hash = ${currentTokenHash}
+        AND revoked_at IS NULL
+        AND expires_at > NOW()
+      FOR UPDATE
+    ),
+    ins AS (
+      INSERT INTO auth_refresh_tokens (
+        wallet_address,
+        jti,
+        token_hash,
+        expires_at,
+        user_agent,
+        ip_address
+      )
+      SELECT
+        ${walletAddress},
+        ${newJti},
+        ${newTokenHash},
+        ${newExpiresAt.toISOString()},
+        ${userAgent},
+        ${ipAddress}
+      WHERE EXISTS (SELECT 1 FROM old)
+      RETURNING jti
+    ),
+    upd AS (
+      UPDATE auth_refresh_tokens
+      SET revoked_at = NOW(),
+          replaced_by_jti = (SELECT jti FROM ins),
+          last_used_at = NOW()
+      WHERE id IN (SELECT id FROM old)
+      RETURNING id
+    )
+    SELECT (SELECT COUNT(*) FROM upd) AS rotated
+  `
+
+  return Number(rows[0]?.rotated ?? 0) === 1
+}