Merge pull request #66 from tito10047/rate-limiter

add support for Rate limiter

Author: tito10047

.env

@@ -16,5 +16,5 @@
 
 ###> symfony/framework-bundle ###
 APP_ENV=dev
-APP_SECRET=
+APP_SECRET=dsads45dsad4as5d4a63
 ###< symfony/framework-bundle ###

.github/workflows/ci.yml

@@ -9,6 +9,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+env:
+    APP_SECRET: s3cret
+
 jobs:
     php-cs-fixer:
         name: "Coding Standard"
@@ -129,8 +132,27 @@ jobs:
             -   name: "Execute tests"
                 run: "composer test"
 
+    dependency-free:
+        name: "Dependency Free (no Rate Limiter)"
+        runs-on: ubuntu-latest
+        steps:
+            -   name: Checkout
+                uses: actions/checkout@v4
+            -   name: "Install PHP"
+                uses: "shivammathur/setup-php@v2"
+                with:
+                    php-version: "8.2"
+            -   name: "Install dependencies"
+                run: composer update --no-interaction --no-progress
+            -   name: "Remove symfony/rate-limiter"
+                run: composer remove symfony/rate-limiter --dev --no-interaction
+            -   name: "Run unit tests (no rate-limiter)"
+                run: vendor/bin/phpunit tests/Unit/
+
     e2e-tests:
         name: "E2E Test"
+        # Recipe from version 2.0 does not work. Once we release version 3.0, we will create a recipe and restore this test.
+        if: false
         runs-on: ubuntu-latest
 
         steps:

.gitignore

@@ -14,4 +14,4 @@ tools/
 /tests/App/Twig/config/reference.php
 /tests/App/Webpack/config/reference.php
 var/cache
-/driver
+/driver/

MIGRATE.md

@@ -22,13 +22,27 @@ module.exports.resolve.alias["altcha/dist/i18n/all.js"] = 'altcha/i18n';
 
 ## Configuration
 
-The configuration remains mostly backward compatible, but it is recommended to update to the new keys.
-
 | Old Key | New Key | Status |
 |---------|---------|--------|
-| `hmacKey` | `hmacSignature` | Deprecated (fallback exists) |
+| `hmacKey` | `hmacSignature` | **BC break: removed, use `hmacSignature`** |
 | `max_number` | - | Deprecated (replaced by `cost` and `counter_max`) |
 
+### BC Break: `hmacKey` removed
+
+The `hmacKey` configuration option has been **removed**. There is no automatic migration.
+
+Update your config manually:
+
+```yaml
+# Before (2.x)
+altcha:
+    hmacKey: '%env(APP_SECRET)%'
+
+# After (3.0)
+altcha:
+    hmacSignature: '%env(APP_SECRET)%'
+```
+
 ### New Configuration Options
 - `hmacAlgorithm`: Specify the HMAC algorithm (default: `SHA-256`).
 - `hmacKeySignature`: Optional signature key.

README.md

@@ -176,6 +176,39 @@ altcha:
 Activating this configuration will have the effect to use the sentinel server to generate a new challenge and for it's verification. 
 If the sentinel instance is not reachable by the client or by the server, we will fallback on our local configuration.
 
+### Optional: Rate Limiting
+
+Rate limiting prevents the same challenge token from being validated multiple times (replay attack protection). Requires `symfony/rate-limiter`:
+
+```bash
+composer require symfony/rate-limiter
+```
+
+Configure a rate limiter policy:
+
+```yaml
+# config/packages/framework.yaml
+framework:
+    rate_limiter:
+        altcha_challenge:
+            policy: 'fixed_window'
+            limit: 1
+            interval: '15 minutes'
+```
+
+Reference the limiter service in the altcha config:
+
+```yaml
+# config/packages/altcha.yaml
+altcha:
+    hmacSignature: '%env(APP_SECRET)%'
+    rate_limiter: 'limiter.altcha_challenge'
+```
+
+The challenge signature is used as the rate limiter key. With the configuration above, each unique challenge token can only be validated **once** per 15 minutes. If the limit is exceeded, the form will display: *"Too many attempts. Please try again later."*
+
+If `symfony/rate-limiter` is not installed and `rate_limiter` is configured, the container build will throw a `LogicException` with a helpful message.
+
 ## License
 
 The MIT License (MIT). Please see [License File](LICENSE) for more information.

composer.json

@@ -49,13 +49,17 @@
 
     }
   },
+  "suggest": {
+    "symfony/rate-limiter": "Allows rate limiting of captcha validation attempts per challenge token"
+  },
   "require-dev": {
     "phpstan/phpstan": "^1.8",
     "phpstan/phpstan-symfony": "^1.2",
     "rector/rector": "^0.14.5",
     "phpunit/phpunit": "^10.5",
     "ext-ctype": "*",
     "ext-iconv": "*",
+    "symfony/property-info": "^6.4|7.4.*|^8.0",
     "symfony/dotenv": "^6.4|7.4.*|^8.0",
     "symfony/runtime": "^6.4|7.4.*|^8.0",
     "symfony/stimulus-bundle": "^2.30",
@@ -65,7 +69,9 @@
     "twig/twig": "^2.12|^3.21.1",
     "symfony/panther": "^v2.4.0",
     "dbrekelmans/bdi": "^1.4",
-    "symfony/asset-mapper": "^6.4|^7.4|^8.0"
+    "symfony/asset-mapper": "^6.4|^7.4|^8.0",
+    "symfony/rate-limiter": "^6.4|^7.4|^8.0",
+    "symfony/lock": "^6.4|^7.4|^8.0"
   },
   "scripts" : {
     "test": [

drivers/chromedriver

@@ -2,6 +2,11 @@
 <!-- http://phpunit.de/manual/4.1/en/appendixes.configuration.html -->
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.5/phpunit.xsd" backupGlobals="false"
          colors="true" bootstrap="vendor/autoload.php">
+    <php>
+        <env name="APP_ENV" value="test" force="true" />
+        <env name="APP_SECRET" value="s3cret" force="true" />
+    </php>
+
     <testsuites>
         <testsuite name="Ace Bundle Test Suite">
             <directory>tests</directory>

drivers/geckodriver

@@ -10,6 +10,8 @@
 use Symfony\Component\DependencyInjection\Extension\Extension;
 use Symfony\Component\DependencyInjection\Extension\PrependExtensionInterface;
 use Symfony\Component\DependencyInjection\Loader;
+use Symfony\Component\DependencyInjection\Reference;
+use Symfony\Component\RateLimiter\RateLimiterFactory;
 use Symfony\UX\StimulusBundle\StimulusBundle;
 use Symfony\Component\DependencyInjection\Exception\LogicException;
 
@@ -27,6 +29,15 @@ public function load(array $configs, ContainerBuilder $container): void
         if ($container->getParameter('altcha.use_sentinel')) {
             $loader->load('services_sentinel.yml');
         }
+        if ($config['rate_limiter'] !== null) {
+            if (!class_exists(RateLimiterFactory::class)) {
+                throw new LogicException(
+                    'symfony/rate-limiter is required to use the "rate_limiter" option. Run "composer require symfony/rate-limiter".'
+                );
+            }
+            $container->getDefinition('altcha.validator')
+                ->setArgument('$rateLimiter',new Reference($config['rate_limiter']));
+        }
     }
 
     /**