test: message/event rate limiting

cameri · cameri · commit b36b62520eeb · 2022-11-15T21:17:20.000-05:00
diff --git a/settings.sample.json b/settings.sample.json
@@ -23,13 +23,53 @@
       "createdAt": {
         "maxPositiveDelta": 900,
         "maxNegativeDelta": 0
-      }
+      },
+      "rateLimits": [
+        {
+          "kinds": [[0, 5], 7, [40, 49], [10000, 19999], [30000, 39999]],
+          "period": 60000,
+          "rate": 60
+        },
+        {
+          "kinds": [[20000, 29999]],
+          "period": 60000,
+          "rate": 600
+        },
+        {
+          "period": 3600000,
+          "rate": 3600
+        },
+        {
+          "period": 86400000,
+          "rate": 86400
+        }
+      ]
     },
     "client": {
       "subscription": {
         "maxSubscriptions": 10,
         "maxFilters": 10
       }
+    },
+    "message": {
+      "rateLimits": [
+        {
+          "period": 60000,
+          "rate": 600
+        },
+        {
+          "period": 3600000,
+          "rate": 3600
+        },
+        {
+          "period": 86400000,
+          "rate": 86400
+        }
+      ],
+      "ipWhitelist": [
+        "::1",
+        "::ffff:10.10.10.1"
+      ]
     }
   }
 }
diff --git a/src/@types/cache.ts b/src/@types/cache.ts
@@ -5,4 +5,4 @@ import {
   RedisScripts,
 } from 'redis'
 
-export type Cache = RedisClientType<RedisModules, RedisFunctions, RedisScripts>
+export type CacheClient = RedisClientType<RedisModules, RedisFunctions, RedisScripts>
diff --git a/src/adapters/redis-adapter.ts b/src/adapters/redis-adapter.ts
@@ -1,4 +1,4 @@
-import { Cache } from '../@types/cache'
+import { CacheClient } from '../@types/cache'
 import { createLogger } from '../factories/logger-factory'
 import { ICacheAdapter } from '../@types/adapters'
 
@@ -7,7 +7,7 @@ const debug = createLogger('redis-adapter')
 export class RedisAdapter implements ICacheAdapter {
   private connection: Promise<void>
 
-  public constructor(private readonly client: Cache) {
+  public constructor(private readonly client: CacheClient) {
     this.connection = client.connect()
 
     this.connection.catch((error) => this.onClientError(error))
diff --git a/src/cache/client.ts b/src/cache/client.ts
@@ -1,15 +1,19 @@
 import { createClient, RedisClientOptions } from 'redis'
-import { Cache } from '../@types/cache'
+import { CacheClient } from '../@types/cache'
 
 export const getCacheConfig = (): RedisClientOptions => ({
   url: `redis://${process.env.REDIS_USER}:${process.env.REDIS_PASSWORD}@${process.env.REDIS_HOST}:${process.env.REDIS_PORT}`,
   password: process.env.REDIS_PASSWORD,
 })
 
-export const getCacheClient = (): Cache => {
-  const config = getCacheConfig()
+let instance: CacheClient = undefined
 
-  const client = createClient(config)
+export const getCacheClient = (): CacheClient => {
+  if (!instance) {
+    const config = getCacheConfig()
 
-  return client
+    instance = createClient(config)
+  }
+
+  return instance
 }
diff --git a/src/constants/base.ts b/src/constants/base.ts
@@ -6,10 +6,21 @@ export enum EventKinds {
   ENCRYPTED_DIRECT_MESSAGE = 4,
   DELETE = 5,
   REACTION = 7,
+  // Channels
+  CHANNEL_CREATION = 40,
+  CHANNEL_METADATA = 41,
+  CHANNEL_MESSAGE = 42,
+  CHANNEL_HIDE_MESSAGE = 43,
+  CHANNEL_MUTE_USER = 44,
+  CHANNEL_RESERVED_FIRST = 45,
+  CHANNEL_RESERVED_LAST = 49,
+  // Replaceable events
   REPLACEABLE_FIRST = 10000,
   REPLACEABLE_LAST = 19999,
+  // Ephemeral events
   EPHEMERAL_FIRST = 20000,
   EPHEMERAL_LAST = 29999,
+  // Parameterized replaceable events
   PARAMETERIZED_REPLACEABLE_FIRST = 30000,
   PARAMETERIZED_REPLACEABLE_LAST = 39999,
 }
diff --git a/src/handlers/event-message-handler.ts b/src/handlers/event-message-handler.ts
@@ -129,7 +129,7 @@ export class EventMessageHandler implements IMessageHandler {
   }
 
   protected async isRateLimited(event: Event): Promise<boolean> {
-    const rateLimits = this.settings().limits.event?.rateLimits
+    const rateLimits = this.settings().limits?.event?.rateLimits
     if (!rateLimits || !rateLimits.length) {
       return
     }
diff --git a/src/handlers/event-strategies/delete-event-strategy.ts b/src/handlers/event-strategies/delete-event-strategy.ts
@@ -21,7 +21,7 @@ export class DeleteEventStrategy implements IEventStrategy<Event, Promise<void>>
     this.webSocket.emit(WebSocketAdapterEvent.Message, createCommandResult(event.id, true, (count) ? '' : 'duplicate:'))
 
     const ids = event.tags.reduce(
-      (eventIds, tag) => (tag.length >= 2 && tag[0] === EventTags.Event && tag[1].length === 64)
+      (eventIds, tag) => (tag.length >= 2 && tag[0] === EventTags.Event)
         ? [...eventIds, tag[1]]
         : eventIds,
       [] as string[]
diff --git a/src/utils/messages.ts b/src/utils/messages.ts
@@ -27,6 +27,6 @@ export const createEndOfStoredEventsNoticeMessage = (
 }
 
 // NIP-20
-export const createCommandResult = (eventId: EventId, successful: boolean, message = '') => {
+export const createCommandResult = (eventId: EventId, successful: boolean, message: string) => {
   return [MessageType.OK, eventId, successful, message]
 }
diff --git a/src/utils/settings.ts b/src/utils/settings.ts
@@ -52,14 +52,20 @@ export class SettingsStatic {
           },
           rateLimits: [
             {
-              kinds: [EventKinds.TEXT_NOTE],
+              kinds: [
+                [EventKinds.SET_METADATA, EventKinds.DELETE],
+                EventKinds.REACTION,
+                [EventKinds.CHANNEL_CREATION, EventKinds.CHANNEL_RESERVED_LAST],
+                [EventKinds.REPLACEABLE_FIRST, EventKinds.REPLACEABLE_LAST],
+                [EventKinds.PARAMETERIZED_REPLACEABLE_FIRST, EventKinds.PARAMETERIZED_REPLACEABLE_LAST],
+              ],
               period: 60000,
               rate: 60,
             },
             {
               kinds: [[EventKinds.EPHEMERAL_FIRST, EventKinds.EPHEMERAL_LAST]],
               period: 60000,
-              rate: 240,
+              rate: 600,
             },
             {
               period: 3600000,
@@ -80,15 +86,15 @@ export class SettingsStatic {
         message: {
           rateLimits: [
             {
-              period: 60000, // minute
-              rate: 240,
+              period: 60000,
+              rate: 600,
             },
             {
-              period: 3600000, // hour
+              period: 3600000,
               rate: 3600,
             },
             {
-              period: 86400000, // day
+              period: 86400000,
               rate: 86400,
             },
           ],
diff --git a/test/integration/features/helpers.ts b/test/integration/features/helpers.ts
@@ -223,3 +223,28 @@ export async function waitForNotice(ws: WebSocket): Promise<void> {
     ws.on('message', onMessage)
   })
 }
+
+export async function waitForCommand(ws: WebSocket): Promise<any> {
+  return new Promise<void>((resolve, reject) => {
+    function cleanup() {
+      ws.removeListener('message', onMessage)
+      ws.removeListener('error', onError)
+    }
+
+    function onError(error: Error) {
+      reject(error)
+      cleanup()
+    }
+    ws.once('error', onError)
+
+    function onMessage(raw: RawData) {
+      const message = JSON.parse(raw.toString('utf8'))
+      if (message[0] === MessageType.OK) {
+        resolve(message)
+        cleanup()
+      }
+    }
+
+    ws.on('message', onMessage)
+  })
+}
diff --git a/test/integration/features/nip-01/nip-01.feature b/test/integration/features/nip-01/nip-01.feature
@@ -27,7 +27,7 @@ Feature: NIP-01
   Scenario: Alice can't post a text_note event with an invalid signature
     Given someone called Alice
     When Alice sends a text_note event with invalid signature
-    Then Alice receives a notice with invalid signature
+    Then Alice receives an unsuccessful result
 
   Scenario: Alice and Bob exchange text_note events
     Given someone called Alice
diff --git a/test/integration/features/nip-01/nip-01.feature.ts b/test/integration/features/nip-01/nip-01.feature.ts
@@ -11,6 +11,7 @@ import {
   createEvent,
   createSubscription,
   sendEvent,
+  waitForCommand,
   waitForEOSE,
   waitForEventCount,
   waitForNextEvent,
@@ -237,3 +238,10 @@ Then(/(\w+) receives a notice with (.*)/, async function(name: string, pattern:
 
   expect(actualNotice).to.contain(pattern)
 })
+
+Then(/(\w+) receives an? (\w+) result/, async function(name: string, successful: string) {
+  const ws = this.parameters.clients[name] as WebSocket
+  const command = await waitForCommand(ws)
+
+  expect(command[2]).to.equal(successful === 'successful')
+})
diff --git a/test/integration/features/shared.ts b/test/integration/features/shared.ts
@@ -12,17 +12,21 @@ import WebSocket from 'ws'
 
 import { connect, createIdentity, createSubscription } from './helpers'
 import { AppWorker } from '../../../src/app/worker'
+import { CacheClient } from '../../../src/@types/cache'
 import { DatabaseClient } from '../../../src/@types/base'
+import { getCacheClient } from '../../../src/cache/client'
 import { getDbClient } from '../../../src/database/client'
 import { SettingsStatic } from '../../../src/utils/settings'
 import { workerFactory } from '../../../src/factories/worker-factory'
 
 let worker: AppWorker
 
 let dbClient: DatabaseClient
+let cacheClient: CacheClient
 
 BeforeAll({ timeout: 6000 }, async function () {
   process.env.PORT = '18808'
+  cacheClient = getCacheClient()
   dbClient = getDbClient()
   await dbClient.raw('SELECT 1=1')
 
@@ -35,7 +39,10 @@ BeforeAll({ timeout: 6000 }, async function () {
 
 AfterAll(async function() {
   worker.close(async () => {
-    await dbClient.destroy()
+    await Promise.all([
+      cacheClient.disconnect(),
+      dbClient.destroy(),
+    ])
   })
 })
 
diff --git a/test/unit/factories/websocket-adapter-factory.spec.ts b/test/unit/factories/websocket-adapter-factory.spec.ts
@@ -30,6 +30,9 @@ describe('webSocketAdapterFactory', () => {
       headers: {
         'sec-websocket-key': Buffer.from('key', 'utf8').toString('base64'),
       },
+      socket: {
+        remoteAddress: '::1',
+      },
     } as any
     const webSocketServerAdapter: IWebSocketServerAdapter = {} as any
 
diff --git a/test/unit/handlers/delegated-event-message-handler.spec.ts b/test/unit/handlers/delegated-event-message-handler.spec.ts
@@ -50,6 +50,7 @@ describe('DelegatedEventMessageHandler', () => {
     let strategyFactoryStub: Sinon.SinonStub
     let onMessageSpy: Sinon.SinonSpy
     let strategyExecuteStub: Sinon.SinonStub
+    let isRateLimitedStub: Sinon.SinonStub
 
     beforeEach(() => {
       canAcceptEventStub = sandbox.stub(DelegatedEventMessageHandler.prototype, 'canAcceptEvent' as any)
@@ -62,10 +63,12 @@ describe('DelegatedEventMessageHandler', () => {
       webSocket = new EventEmitter()
       webSocket.on(WebSocketAdapterEvent.Message, onMessageSpy)
       message = [MessageType.EVENT, event]
+      isRateLimitedStub = sandbox.stub(EventMessageHandler.prototype, 'isRateLimited' as any)
       handler = new DelegatedEventMessageHandler(
         webSocket as any,
         strategyFactoryStub,
         () => ({}) as any,
+        () => ({ hit: async () => false }),
       )
     })
 
@@ -81,7 +84,14 @@ describe('DelegatedEventMessageHandler', () => {
       await handler.handleMessage(message)
 
       expect(canAcceptEventStub).to.have.been.calledOnceWithExactly(event)
-      expect(onMessageSpy).to.have.been.calledOnceWithExactly(['NOTICE', 'Event rejected: reason'])
+      expect(onMessageSpy).to.have.been.calledOnceWithExactly(
+        [
+          MessageType.OK,
+          'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
+          false,
+          'reason',
+        ],
+      )
       expect(strategyFactoryStub).not.to.have.been.called
     })
 
@@ -95,6 +105,18 @@ describe('DelegatedEventMessageHandler', () => {
       expect(strategyFactoryStub).not.to.have.been.called
     })
 
+    it('rejects event if rate-limited', async () => {
+      isRateLimitedStub.resolves(true)
+
+      await handler.handleMessage(message)
+
+      expect(isRateLimitedStub).to.have.been.calledOnceWithExactly(event)
+      expect(onMessageSpy).to.have.been.calledOnceWithExactly(
+        [MessageType.OK, event.id, false, 'rate-limited: slow down'],
+      )
+      expect(strategyFactoryStub).not.to.have.been.called
+    })
+
     it('does not call strategy if none given', async () => {
       isEventValidStub.returns(undefined)
       canAcceptEventStub.returns(undefined)
@@ -177,7 +199,7 @@ describe('DelegatedEventMessageHandler', () => {
       parentIsEventValidStub.resolves(undefined)
 
       event.tags[0][3] = 'wrong sig'
-      return expect((handler as any).isEventValid(event)).to.eventually.equal('Event with id a080fd288b60ac2225ff2e2d815291bd730911e583e177302cc949a15dc2b2dc from 62903b1ff41559daf9ee98ef1ae67cc52f301bb5ce26d14baba3052f649c3f49 is invalid delegated event')
+      return expect((handler as any).isEventValid(event)).to.eventually.equal('invalid: delegation verification failed')
     })
   })
 })
diff --git a/test/unit/handlers/event-message-handler.spec.ts b/test/unit/handlers/event-message-handler.spec.ts
diff --git a/test/unit/handlers/event-strategies/default-event-strategy.spec.ts b/test/unit/handlers/event-strategies/default-event-strategy.spec.ts
diff --git a/test/unit/handlers/event-strategies/delete-event-strategy.spec.ts b/test/unit/handlers/event-strategies/delete-event-strategy.spec.ts
diff --git a/test/unit/handlers/event-strategies/parameterized-replaceable-event-strategy.spec.ts b/test/unit/handlers/event-strategies/parameterized-replaceable-event-strategy.spec.ts
diff --git a/test/unit/handlers/event-strategies/replaceable-event-strategy.spec.ts b/test/unit/handlers/event-strategies/replaceable-event-strategy.spec.ts
diff --git a/test/unit/utils/settings.spec.ts b/test/unit/utils/settings.spec.ts
diff --git a/test/unit/utils/sliding-window-rate-limiter.spec.ts b/test/unit/utils/sliding-window-rate-limiter.spec.ts

Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ export class EventMessageHandler implements IMessageHandler {`
`129`	`129`	`}`
`130`	`130`
`131`	`131`	`protected async isRateLimited(event: Event): Promise<boolean> {`
`132`		`- const rateLimits = this.settings().limits.event?.rateLimits`
	`132`	`+ const rateLimits = this.settings().limits?.event?.rateLimits`
`133`	`133`	`if (!rateLimits \|\| !rateLimits.length) {`
`134`	`134`	`return`
`135`	`135`	`}`
Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,6 @@ export const createEndOfStoredEventsNoticeMessage = (`
`27`	`27`	`}`
`28`	`28`
`29`	`29`	`// NIP-20`
`30`		`-export const createCommandResult = (eventId: EventId, successful: boolean, message = '') => {`
	`30`	`+export const createCommandResult = (eventId: EventId, successful: boolean, message: string) => {`
`31`	`31`	`return [MessageType.OK, eventId, successful, message]`
`32`	`32`	`}`