feat: add captcha support for sign in/up (#4582)

apps/server/.env.example

@@ -3,4 +3,4 @@ NEXTAUTH_URL="http://localhost:8080"
 OAUTH_EMAIL_SENDER="noreply@toeverything.info"
 OAUTH_EMAIL_LOGIN=""
 OAUTH_EMAIL_PASSWORD=""
-ENABLE_LOCAL_EMAIL="true"
+ENABLE_LOCAL_EMAIL="true"

apps/server/src/config/def.ts

@@ -320,6 +320,27 @@ export interface AFFiNEConfig {
       sender: string;
       password: string;
     };
+    captcha: {
+      /**
+       * whether to enable captcha
+       */
+      enable: boolean;
+      turnstile: {
+        /**
+         * Cloudflare Turnstile CAPTCHA secret
+         * default value is demo api key, witch always return success
+         */
+        secret: string;
+      };
+      challenge: {
+        /**
+         * challenge bits length
+         * default value is 20, which can resolve in 0.5-3 second in M2 MacBook Air in single thread
+         * @default 20
+         */
+        bits: number;
+      };
+    };
   };
 
   doc: {

apps/server/src/config/default.ts

@@ -62,6 +62,8 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       R2_OBJECT_STORAGE_ACCESS_KEY_ID: 'objectStorage.r2.accessKeyId',
       R2_OBJECT_STORAGE_SECRET_ACCESS_KEY: 'objectStorage.r2.secretAccessKey',
       R2_OBJECT_STORAGE_BUCKET: 'objectStorage.r2.bucket',
+      ENABLE_CAPTCHA: ['auth.captcha.enable', 'boolean'],
+      CAPTCHA_TURNSTILE_SECRET: ['auth.captcha.turnstile.secret', 'string'],
       OAUTH_GOOGLE_ENABLED: ['auth.oauthProviders.google.enabled', 'boolean'],
       OAUTH_GOOGLE_CLIENT_ID: 'auth.oauthProviders.google.clientId',
       OAUTH_GOOGLE_CLIENT_SECRET: 'auth.oauthProviders.google.clientSecret',
@@ -147,6 +149,15 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       refreshTokenExpiresIn: parse('7d')! / 1000,
       leeway: 60,
+      captcha: {
+        enable: false,
+        turnstile: {
+          secret: '1x0000000000000000000000000000000AA',
+        },
+        challenge: {
+          bits: 20,
+        },
+      },
       privateKey: jwtKeyPair.privateKey,
       publicKey: jwtKeyPair.publicKey,
       enableSignup: true,

apps/server/src/modules/auth/next-auth.controller.ts

@@ -4,6 +4,7 @@ import {
   All,
   BadRequestException,
   Controller,
+  Get,
   Inject,
   Logger,
   Next,
@@ -17,12 +18,14 @@ import { hash, verify } from '@node-rs/argon2';
 import type { User } from '@prisma/client';
 import type { NextFunction, Request, Response } from 'express';
 import { pick } from 'lodash-es';
+import { nanoid } from 'nanoid';
 import type { AuthAction, CookieOption, NextAuthOptions } from 'next-auth';
 import { AuthHandler } from 'next-auth/core';
 
 import { Config } from '../../config';
 import { Metrics } from '../../metrics/metrics';
 import { PrismaService } from '../../prisma/service';
+import { SessionService } from '../../session';
 import { AuthThrottlerGuard, Throttle } from '../../throttler';
 import { NextAuthOptionsProvide } from './next-auth-options';
 import { AuthService } from './service';
@@ -43,12 +46,28 @@ export class NextAuthController {
     private readonly authService: AuthService,
     @Inject(NextAuthOptionsProvide)
     private readonly nextAuthOptions: NextAuthOptions,
-    private readonly metrics: Metrics
+    private readonly metrics: Metrics,
+    private readonly session: SessionService
   ) {
     // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
     this.callbackSession = nextAuthOptions.callbacks!.session;
   }
 
+  @UseGuards(AuthThrottlerGuard)
+  @Throttle({
+    default: {
+      limit: 60,
+      ttl: 60,
+    },
+  })
+  @Get('/challenge')
+  async getChallenge(@Res() res: Response) {
+    const challenge = nanoid();
+    const resource = nanoid();
+    await this.session.set(challenge, resource, 5 * 60 * 1000);
+    res.json({ challenge, resource });
+  }
+
   @UseGuards(AuthThrottlerGuard)
   @Throttle({
     default: {
@@ -128,6 +147,16 @@ export class NextAuthController {
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       options.callbacks!.session = this.callbackSession;
     }
+
+    if (
+      this.config.auth.captcha.enable &&
+      req.method === 'POST' &&
+      action === 'signin'
+    ) {
+      const isVerified = await this.verifyChallenge(req, res);
+      if (!isVerified) return;
+    }
+
     const { status, headers, body, redirect, cookies } = await AuthHandler({
       req: {
         body: req.body,
@@ -270,6 +299,44 @@ export class NextAuthController {
     }
   }
 
+  private async verifyChallenge(req: Request, res: Response): Promise<boolean> {
+    const challenge = req.query?.challenge;
+    if (typeof challenge === 'string' && challenge) {
+      const resource = await this.session.get(challenge);
+
+      if (!resource) {
+        this.rejectResponse(res, 'Invalid Challenge');
+        return false;
+      }
+
+      const isChallengeVerified =
+        await this.authService.verifyChallengeResponse(
+          req.query?.token,
+          resource
+        );
+
+      this.logger.debug(
+        `Challenge: ${challenge}, Resource: ${resource}, Response: ${req.query?.token}, isChallengeVerified: ${isChallengeVerified}`
+      );
+
+      if (!isChallengeVerified) {
+        this.rejectResponse(res, 'Invalid Challenge Response');
+        return false;
+      }
+    } else {
+      const isTokenVerified = await this.authService.verifyCaptchaToken(
+        req.query?.token,
+        req.headers['CF-Connecting-IP'] as string
+      );
+
+      if (!isTokenVerified) {
+        this.rejectResponse(res, 'Invalid Captcha Response');
+        return false;
+      }
+    }
+    return true;
+  }
+
   private async verifyUserFromRequest(req: Request): Promise<User> {
     const token = req.headers.authorization;
     if (!token) {
@@ -311,6 +378,18 @@ export class NextAuthController {
     }
     throw new BadRequestException(`User not found`);
   }
+
+  rejectResponse(res: Response, error: string, status = 400) {
+    res.status(status);
+    res.json({
+      url: `https://${this.config.baseUrl}/api/auth/error?${new URLSearchParams(
+        {
+          error,
+        }
+      ).toString()}`,
+      error,
+    });
+  }
 }
 
 const checkUrlOrigin = (url: string, origin: string) => {

apps/server/src/modules/auth/service.ts

@@ -9,9 +9,11 @@ import {
 import { hash, verify } from '@node-rs/argon2';
 import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
 import type { User } from '@prisma/client';
+import { nanoid } from 'nanoid';
 
 import { Config } from '../../config';
 import { PrismaService } from '../../prisma';
+import { verifyChallengeResponse } from '../../storage';
 import { MailService } from './mailer';
 
 export type UserClaim = Pick<
@@ -110,6 +112,38 @@ export class AuthService {
     }
   }
 
+  async verifyCaptchaToken(token: any, ip: string) {
+    if (typeof token !== 'string' || !token) return false;
+
+    const formData = new FormData();
+    formData.append('secret', this.config.auth.captcha.turnstile.secret);
+    formData.append('response', token);
+    formData.append('remoteip', ip);
+    // prevent replay attack
+    formData.append('idempotency_key', nanoid());
+
+    const url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+    const result = await fetch(url, {
+      body: formData,
+      method: 'POST',
+    });
+    const outcome = await result.json();
+
+    return (
+      !!outcome.success &&
+      // skip hostname check in dev mode
+      (this.config.affineEnv === 'dev' || outcome.hostname === this.config.host)
+    );
+  }
+
+  async verifyChallengeResponse(response: any, resource: string) {
+    return verifyChallengeResponse(
+      response,
+      this.config.auth.captcha.challenge.bits,
+      resource
+    );
+  }
+
   async signIn(email: string, password: string): Promise<User> {
     const user = await this.prisma.user.findFirst({
       where: {

apps/server/src/storage/index.ts

@@ -34,3 +34,17 @@ export class StorageModule {
 }
 
 export const mergeUpdatesInApplyWay = storageModule.mergeUpdatesInApplyWay;
+
+export const verifyChallengeResponse = async (
+  response: any,
+  bits: number,
+  resource: string
+) => {
+  if (typeof response !== 'string' || !response || !resource) return false;
+  return storageModule.verifyChallengeResponse(response, bits, resource);
+};
+
+export const mintChallengeResponse = async (resource: string, bits: number) => {
+  if (!resource) return null;
+  return storageModule.mintChallengeResponse(resource, bits);
+};

apps/server/tests/auth.spec.ts

@@ -10,6 +10,7 @@ import { AuthModule } from '../src/modules/auth';
 import { AuthResolver } from '../src/modules/auth/resolver';
 import { AuthService } from '../src/modules/auth/service';
 import { PrismaModule } from '../src/prisma';
+import { mintChallengeResponse, verifyChallengeResponse } from '../src/storage';
 import { RateLimiterModule } from '../src/throttler';
 
 let authService: AuthService;
@@ -176,3 +177,10 @@ test('should return valid sessionToken if request headers valid', async t => {
   );
   t.is(result.sessionToken, '123456');
 });
+
+test('verify challenge', async t => {
+  const resource = 'xp8D3rcXV9bMhWrb6abxl';
+  const response = await mintChallengeResponse(resource, 20);
+  const success = await verifyChallengeResponse(response, 20, resource);
+  t.true(success);
+});