* chore: Add system wide rate limiting * Handle and convert HttpError to 429 * Make algo 32-bit to prevent <ES2020 error + fix sms manager unit test * Change core to common to go from 10 requests per minute to 200 * Remove redundant function * Fix integration tests * Make sure we allow all legal POST routes * Allow tRPC post calls * Add matcher tests on middleware * Add matcher tests on middleware * Fix matcher to not use regex * Fix missing POST allow rule for /api/auth/callback/credentials * Missed the api/book/event endpoints * Add missing pages/api routes * Remove POST middleware for now, very risky * Remove tests for POST protection --------- Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
64 lines
1.6 KiB
TypeScript
64 lines
1.6 KiB
TypeScript
import { prisma } from "@calcom/prisma";
|
|
import { SMSLockState } from "@calcom/prisma/enums";
|
|
import type { RateLimitHelper } from "./rateLimit";
|
|
import { rateLimiter } from "./rateLimit";
|
|
|
|
export async function checkSMSRateLimit({
|
|
rateLimitingType = "sms",
|
|
identifier,
|
|
onRateLimiterResponse,
|
|
opts,
|
|
}: RateLimitHelper) {
|
|
const response = await rateLimiter()({ rateLimitingType, identifier, opts });
|
|
const { success } = response;
|
|
|
|
if (onRateLimiterResponse) onRateLimiterResponse(response);
|
|
|
|
if (!success) {
|
|
await changeSMSLockState(
|
|
identifier,
|
|
rateLimitingType === "sms" ? SMSLockState.LOCKED : SMSLockState.REVIEW_NEEDED
|
|
);
|
|
}
|
|
}
|
|
|
|
async function changeSMSLockState(identifier: string, status: SMSLockState) {
|
|
let userId, teamId;
|
|
|
|
if (identifier.startsWith("sms:user:")) {
|
|
userId = Number(identifier.slice(9));
|
|
} else if (identifier.startsWith("sms:team:")) {
|
|
teamId = Number(identifier.slice(9));
|
|
}
|
|
|
|
if (userId) {
|
|
const user = await prisma.user.findUnique({ where: { id: userId, profiles: { none: {} } } });
|
|
if (user?.smsLockReviewedByAdmin) return;
|
|
|
|
await prisma.user.update({
|
|
where: {
|
|
id: userId,
|
|
profiles: { none: {} },
|
|
},
|
|
data: {
|
|
smsLockState: status,
|
|
},
|
|
});
|
|
} else {
|
|
const team = await prisma.team.findUnique({
|
|
where: { id: teamId, parentId: null, isOrganization: false },
|
|
});
|
|
if (team?.smsLockReviewedByAdmin) return;
|
|
|
|
await prisma.team.update({
|
|
where: {
|
|
id: teamId,
|
|
parentId: null,
|
|
isOrganization: false,
|
|
},
|
|
data: {
|
|
smsLockState: status,
|
|
},
|
|
});
|
|
}
|
|
} |