Merge pull request #226 from Pdzly/feature/autoban-invite-spammer

Autoban Invite spammer

Author: bristermitten

src/Config.prod.ts

@@ -72,6 +72,12 @@ export const config: Config = {
 		archiveChannel: "1415283787440328836",
 		channel: "1415283659350741062",
 	},
+	inviteSpam: {
+		maxViolations: 4,
+		maxChannels: 3,
+		violationWindowMs: 30_000,
+		accountAgeDays: 0,
+	},
 	devbin: {
 		url: "https://devbin.developerden.org",
 		api_url: "https://devbin-api.developerden.org",

src/Config.ts

@@ -23,6 +23,12 @@ const devConfig: Config = {
 	commands: {
 		daily: "1029850807794937949",
 	},
+	inviteSpam: {
+		maxViolations: 4,
+		maxChannels: 3,
+		violationWindowMs: 30_000,
+		accountAgeDays: 0,
+	},
 	deletedMessageLog: {
 		cacheTtlMs: 1000 * 60 * 60 * 24,
 		excludedChannels: [],

src/config.type.ts

@@ -61,6 +61,17 @@ export interface ThreatDetectionConfig {
 	};
 }
 
+export interface InviteSpamConfig {
+	/** Max violations before auto-ban */
+	maxViolations: number;
+	/** Max unique channels before auto-ban */
+	maxChannels: number;
+	/** Time window in ms for tracking violations */
+	violationWindowMs: number;
+	/** Only auto-ban accounts that joined the server less than X days ago. 0 = disabled (everyone is considered) */
+	accountAgeDays: number;
+}
+
 export interface Config {
 	guildId: string;
 	clientId: string;
@@ -124,6 +135,7 @@ export interface Config {
 	branding: BrandingConfig;
 	informationMessage?: InformationMessage;
 	threatDetection?: ThreatDetectionConfig;
+	inviteSpam: InviteSpamConfig;
 	reputation?: {
 		enabled: boolean;
 		warningThresholds: {

src/modules/moderation/discordInvitesMonitor.listener.ts

@@ -1,5 +1,7 @@
 import * as Sentry from "@sentry/bun";
 import type { GuildMember, Message } from "discord.js";
+import ExpiryMap from "expiry-map";
+import { config } from "../../Config.js";
 import { logger } from "../../logging.js";
 import { getOrCreateUserById } from "../../store/models/DDUser.js";
 import { getMember } from "../../util/member.js";
@@ -17,11 +19,31 @@ const invitePatterns = [
 
 const whitelistDomains: string[] = []; // For any .gg domains that are not discord.gg
 
+interface InviteViolation {
+	count: number;
+	channels: Set<string>;
+}
+
+const inviteViolationCache = new ExpiryMap<string, InviteViolation>(
+	config.inviteSpam.violationWindowMs,
+);
+
 const isAllowedToSendDiscordInvites = async (member: GuildMember) => {
 	const ddUser = await getOrCreateUserById(BigInt(member.id));
 	return getTierByLevel(ddUser.level) >= 2;
 };
 
+const isSubjectToAutoban = (member: GuildMember): boolean => {
+	if (config.inviteSpam.accountAgeDays === 0) return true;
+
+	const joinedAt = member.joinedAt;
+	if (!joinedAt) return true;
+
+	const daysSinceJoin =
+		(Date.now() - joinedAt.getTime()) / (1000 * 60 * 60 * 24);
+	return daysSinceJoin < config.inviteSpam.accountAgeDays;
+};
+
 export function parseInvites(message: Message<true>) {
 	// Check if message contains any Discord invite
 	const matches = invitePatterns
@@ -56,6 +78,45 @@ async function sendAuditMessage(
 const noInvitesAllowedMessage = (member: GuildMember) =>
 	`${actualMention(member)}, only Users with Tier 2 or over are allowed to send Discord invites.\nPlease remove the invite before sending it again.\nThank you!`;
 
+async function banForInviteSpam(
+	message: Message<true>,
+	member: GuildMember,
+	violation: InviteViolation,
+) {
+	const triggerReason =
+		violation.channels.size >= config.inviteSpam.maxChannels
+			? "cross_channel"
+			: "same_channel";
+
+	try {
+		await member
+			.send(
+				"You have been banned for spamming Discord invites. " +
+					"If you believe this was a mistake, please contact a moderator.",
+			)
+			.catch(() => {});
+
+		await message.guild.bans.create(member.user, {
+			reason: `Auto-ban: Invite spam (${violation.count} violations across ${violation.channels.size} channel(s) in ${config.inviteSpam.violationWindowMs / 1000}s)`,
+			deleteMessageSeconds: 604800,
+		});
+
+		await logModerationAction(message.client, {
+			kind: "InviteSpamBan",
+			target: member.user,
+			violationCount: violation.count,
+			channelCount: violation.channels.size,
+			violationWindowMs: config.inviteSpam.violationWindowMs,
+			triggerReason,
+		});
+
+		inviteViolationCache.delete(member.id);
+	} catch (error) {
+		logger.error("Failed to ban invite spammer:", error);
+		Sentry.captureException(error);
+	}
+}
+
 async function handleInvite(
 	message: Message<true>,
 	member: GuildMember,
@@ -74,6 +135,23 @@ async function handleInvite(
 		}, 10000);
 
 		await sendAuditMessage(message, member, matches, wasEdit);
+
+		const existing = inviteViolationCache.get(member.id);
+		const violation: InviteViolation = existing ?? {
+			count: 0,
+			channels: new Set(),
+		};
+		violation.count++;
+		violation.channels.add(message.channelId);
+		inviteViolationCache.set(member.id, violation);
+
+		const shouldBan =
+			violation.count >= config.inviteSpam.maxViolations ||
+			violation.channels.size >= config.inviteSpam.maxChannels;
+
+		if (shouldBan && isSubjectToAutoban(member)) {
+			await banForInviteSpam(message, member, violation);
+		}
 	} catch (error) {
 		logger.error("Failed to delete message with Discord invite:", error);
 		Sentry.captureException(error);

src/modules/moderation/logs.ts

@@ -31,6 +31,7 @@ export type ModerationLog =
 	| SoftBanLog
 	| KickLog
 	| InviteDeletedLog
+	| InviteSpamBanLog
 	| WarningLog
 	| WarningPardonedLog
 	| ReputationGrantedLog;
@@ -115,6 +116,15 @@ interface ReputationGrantedLog {
 	reason: string;
 }
 
+interface InviteSpamBanLog {
+	kind: "InviteSpamBan";
+	target: User;
+	violationCount: number;
+	channelCount: number;
+	violationWindowMs: number;
+	triggerReason: "same_channel" | "cross_channel";
+}
+
 type ModerationKindMapping<T> = {
 	[f in ModerationLog["kind"]]: T;
 };
@@ -124,6 +134,7 @@ const embedTitles: ModerationKindMapping<string> = {
 	Unban: "Member Unbanned",
 	SoftBan: "Member Softbanned",
 	InviteDeleted: "Discord Invite Removed",
+	InviteSpamBan: "Member Auto-Banned (Invite Spam)",
 	TempBan: "Member Tempbanned",
 	Kick: "Member Kicked",
 	TempBanEnded: "Tempban Expired",
@@ -140,6 +151,7 @@ const embedColors: ModerationKindMapping<keyof typeof Colors> = {
 	Unban: "Green",
 	TempBanEnded: "DarkGreen",
 	InviteDeleted: "Blurple",
+	InviteSpamBan: "DarkRed",
 	Warning: "Gold",
 	WarningPardoned: "Aqua",
 	ReputationGranted: "Green",
@@ -181,6 +193,11 @@ const embedReasons: {
 		`**Type:** ${rep.eventType}\n` +
 		`**Score Change:** +${rep.scoreChange}\n` +
 		`**New Score:** ${rep.newScore >= 0 ? "+" : ""}${rep.newScore}`,
+
+	InviteSpamBan: (ban) =>
+		`**Violations:** ${ban.violationCount} in ${ban.violationWindowMs / 1000}s\n` +
+		`**Channels:** ${ban.channelCount}\n` +
+		`**Trigger:** ${ban.triggerReason === "same_channel" ? "4+ violations in same channel" : "Violations across 3+ channels"}`,
 };
 
 export async function logModerationAction(