fix: prevent unauthenticated database storage abuse in track-user endpoint

Author: anshika1179

app/api/track-user/route.test.ts

@@ -9,6 +9,7 @@ vi.mock('@/lib/rate-limit', () => ({
     check: vi.fn().mockResolvedValue(true),
   },
 }));
+
 vi.mock('@/lib/mongodb', () => ({
   default: vi.fn(),
 }));
@@ -19,6 +20,20 @@ vi.mock('@/models/User', () => ({
   },
 }));
 
+vi.mock('@/lib/github', () => ({
+  fetchUserProfile: vi.fn().mockImplementation((username) => {
+    const lower = username.toLowerCase();
+    if (lower === 'octocat' || lower === 'torvalds' || lower === 'valid-user') {
+      return Promise.resolve({ login: username });
+    }
+    return Promise.reject(new Error('User not found'));
+  }),
+}));
+
+import { fetchUserProfile } from '@/lib/github';
+import { trackUserProtection } from '@/services/security/track-user-protection';
+import { gitHubUserValidator } from '@/services/github/validate-user';
+
 function makeRequest(body: Record<string, unknown>): Request {
   return new Request('http://localhost/api/track-user', {
     method: 'POST',
@@ -30,14 +45,74 @@ function makeRequest(body: Record<string, unknown>): Request {
 describe('POST /api/track-user', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    trackUserProtection.reset();
+    gitHubUserValidator.reset();
   });
 
   afterEach(() => {
     // Clean up environment variables
     delete process.env.MONGODB_URI;
   });
 
-  describe('Validation', () => {
+  describe('Abuse Protection & Validation (Issue #1980)', () => {
+    // Scenario 1: Valid GitHub username (Stored)
+    it('Scenario 1: allows and stores a valid GitHub username', async () => {
+      process.env.MONGODB_URI = 'mongodb://localhost:27017/test';
+      const response = await POST(makeRequest({ username: 'valid-user' }));
+
+      expect(response.status).toBe(200);
+      const data = await response.json();
+      expect(data.success).toBe(true);
+      expect(User.updateOne).toHaveBeenCalledWith({ username: 'valid-user' }, expect.any(Object), {
+        upsert: true,
+      });
+    });
+
+    // Scenario 2: Invalid username (Rejected)
+    it('Scenario 2: rejects invalid GitHub username that does not exist', async () => {
+      process.env.MONGODB_URI = 'mongodb://localhost:27017/test';
+      const response = await POST(makeRequest({ username: 'non-existent-user-12345' }));
+
+      expect(response.status).toBe(400);
+      const data = await response.json();
+      expect(data.success).toBe(false);
+      expect(data.error).toBe('Invalid GitHub username');
+      expect(User.updateOne).not.toHaveBeenCalled();
+    });
+
+    // Scenario 3: Random UUID (Rejected)
+    it('Scenario 3: rejects random UUID format immediately at regex format stage', async () => {
+      process.env.MONGODB_URI = 'mongodb://localhost:27017/test';
+      const response = await POST(makeRequest({ username: 'invalid--username!123' }));
+
+      expect(response.status).toBe(400);
+      const data = await response.json();
+      expect(data.success).toBe(false);
+      expect(data.error).toBe('Invalid GitHub username');
+      expect(fetchUserProfile).not.toHaveBeenCalled(); // Blocked before API lookup!
+      expect(User.updateOne).not.toHaveBeenCalled(); // Blocked before DB write!
+    });
+
+    // Scenario 4: Duplicate tracking request (cooldown deduplication)
+    it('Scenario 4: skips database write for duplicate tracking request within cooldown', async () => {
+      process.env.MONGODB_URI = 'mongodb://localhost:27017/test';
+
+      // First tracking allowed
+      const firstResponse = await POST(makeRequest({ username: 'valid-user' }));
+      expect(firstResponse.status).toBe(200);
+      expect(User.updateOne).toHaveBeenCalledTimes(1);
+
+      // Second tracking within cooldown
+      const secondResponse = await POST(makeRequest({ username: 'valid-user' }));
+      expect(secondResponse.status).toBe(200);
+      const data = await secondResponse.json();
+      expect(data.success).toBe(true);
+      expect(data.message).toBe('User already tracked recently');
+      expect(User.updateOne).toHaveBeenCalledTimes(1); // Not incremented!
+    });
+  });
+
+  describe('Validation Basic Checks', () => {
     it('returns 400 for malformed JSON request bodies', async () => {
       const malformedRequest = {
         json: vi.fn().mockRejectedValue(new SyntaxError('Unexpected token')),

app/api/track-user/route.ts

@@ -3,6 +3,7 @@ import dbConnect from '@/lib/mongodb';
 import { User } from '@/models/User';
 import { trackUserRateLimiter } from '@/lib/rate-limit';
 import { getClientIp } from '@/utils/getClientIp';
+import { trackUserProtection } from '@/services/security/track-user-protection';
 
 export async function POST(req: Request) {
   // Get IP for rate limiting securely
@@ -38,6 +39,23 @@ export async function POST(req: Request) {
 
     const trimmedUsername = username.trim().toLowerCase();
 
+    // Coordinate security validations and deduplication checks
+    const validation = await trackUserProtection.verifyAndDeduplicate(trimmedUsername);
+    if (!validation.allowed) {
+      if (validation.reason === 'COOLDOWN_ACTIVE') {
+        // Return 200 OK with duplicate track indicator to bypass write and keep response fast
+        return NextResponse.json(
+          { success: true, message: 'User already tracked recently' },
+          { status: 200 }
+        );
+      }
+
+      return NextResponse.json(
+        { success: false, error: 'Invalid GitHub username' },
+        { status: 400 }
+      );
+    }
+
     // If MONGODB_URI is not set, handle based on environment
     if (!process.env.MONGODB_URI) {
       // In production, this is a critical configuration failure
@@ -53,6 +71,7 @@ export async function POST(req: Request) {
 
       // For development/non-production environments, bypass gracefully
       console.warn('MONGODB_URI is not set. Bypassing user tracking for local development.');
+      trackUserProtection.recordWrite(trimmedUsername);
       return NextResponse.json({ success: true, bypassed: true });
     }
 
@@ -70,11 +89,11 @@ export async function POST(req: Request) {
         },
         { upsert: true }
       );
+
+      // Record successful database write
+      trackUserProtection.recordWrite(trimmedUsername);
     } catch (upsertError) {
       // Gracefully handle MongoDB E11000 duplicate key race conditions under high concurrency.
-      // Concurrent upserts for the same username can race on the unique index, causing
-      // MongoDB to throw a duplicate key error (code 11000) for one of the requests.
-      // We can safely treat this as a successful no-op because another request already created it.
       if (
         upsertError &&
         typeof upsertError === 'object' &&
@@ -88,6 +107,7 @@ export async function POST(req: Request) {
           (typeof err.message === 'string' && err.message.includes('username'));
 
         if (isUsernameConflict) {
+          trackUserProtection.recordWrite(trimmedUsername);
           return NextResponse.json({ success: true });
         }
       }

services/github/validate-user.ts

@@ -0,0 +1,65 @@
+import { fetchUserProfile } from '../../lib/github';
+import { TTLCache } from '../../lib/cache';
+
+// 24-hour validation cache
+const VALIDATION_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+
+export class GitHubUserValidator {
+  private static instance: GitHubUserValidator;
+
+  // Cache stores username -> boolean existence status
+  private cache = new TTLCache<boolean>(5000, 60 * 60 * 1000);
+
+  private constructor() {}
+
+  public static getInstance(): GitHubUserValidator {
+    if (!GitHubUserValidator.instance) {
+      GitHubUserValidator.instance = new GitHubUserValidator();
+    }
+    return GitHubUserValidator.instance;
+  }
+
+  /**
+   * Validates if the username represents a real, existing GitHub user.
+   * Results are cached for 24 hours to reduce API call overhead.
+   */
+  public async validateUser(username: string): Promise<boolean> {
+    const sanitized = username.trim().toLowerCase();
+
+    // Check cache first
+    const cachedStatus = this.cache.get(sanitized);
+    if (cachedStatus !== null) {
+      return cachedStatus;
+    }
+
+    try {
+      // Query the GitHub profile endpoint
+      await fetchUserProfile(username, { bypassCache: false });
+
+      // User exists! Cache the result
+      this.cache.set(sanitized, true, VALIDATION_CACHE_TTL_MS);
+      return true;
+    } catch (err: unknown) {
+      const errMessage = err instanceof Error ? err.message : '';
+
+      if (errMessage.includes('User not found') || errMessage.includes('not found')) {
+        // User does not exist. Cache the negative result as well to prevent brute force abuse
+        this.cache.set(sanitized, false, VALIDATION_CACHE_TTL_MS);
+        return false;
+      }
+
+      // For temporary API errors/rate limits, do not cache the failure permanently
+      throw err;
+    }
+  }
+
+  /**
+   * Clears the validation cache (useful for tests).
+   */
+  public reset(): void {
+    this.cache.clear();
+  }
+}
+
+export const gitHubUserValidator = GitHubUserValidator.getInstance();
+export default gitHubUserValidator;

services/security/track-user-protection.ts

@@ -0,0 +1,97 @@
+import { gitHubUserValidator } from '../github/validate-user';
+
+// GitHub username rules: alphanumeric or single hyphens, max 39 chars, cannot start/end with hyphen
+const GITHUB_USERNAME_REGEX = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}$/i;
+
+// 5 minutes write cooldown to deduplicate writes/updates
+const WRITE_COOLDOWN_MS = 5 * 60 * 1000;
+
+export class TrackUserProtection {
+  private static instance: TrackUserProtection;
+
+  // Map of username -> last database write timestamp
+  private lastWriteTimes = new Map<string, number>();
+
+  private constructor() {}
+
+  public static getInstance(): TrackUserProtection {
+    if (!TrackUserProtection.instance) {
+      TrackUserProtection.instance = new TrackUserProtection();
+    }
+    return TrackUserProtection.instance;
+  }
+
+  /**
+   * Validates if the username format complies with official GitHub conventions.
+   * Prevents random UUIDs/junk injections before any API/DB calls are triggered.
+   */
+  public validateFormat(username: string): boolean {
+    const trimmed = username.trim();
+    if (!trimmed || trimmed.length > 39) {
+      return false;
+    }
+    return GITHUB_USERNAME_REGEX.test(trimmed);
+  }
+
+  /**
+   * Checks if a database write is allowed for the username based on cooldown.
+   * Prevents spam updates/concurrency write spikes for the same user.
+   */
+  public isWriteAllowed(username: string): boolean {
+    const sanitized = username.trim().toLowerCase();
+    const lastWrite = this.lastWriteTimes.get(sanitized);
+    if (!lastWrite) {
+      return true;
+    }
+    return Date.now() - lastWrite >= WRITE_COOLDOWN_MS;
+  }
+
+  /**
+   * Records a successful database write event for the username.
+   */
+  public recordWrite(username: string): void {
+    const sanitized = username.trim().toLowerCase();
+    this.lastWriteTimes.set(sanitized, Date.now());
+  }
+
+  /**
+   * Coordinates both format, cooldown, and existence checks.
+   */
+  public async verifyAndDeduplicate(username: string): Promise<{
+    allowed: boolean;
+    reason?: 'INVALID_FORMAT' | 'COOLDOWN_ACTIVE' | 'USER_NOT_FOUND';
+    remainingMs?: number;
+  }> {
+    // 1. Verify format
+    if (!this.validateFormat(username)) {
+      return { allowed: false, reason: 'INVALID_FORMAT' };
+    }
+
+    const sanitized = username.trim().toLowerCase();
+
+    // 2. Check cooldown deduplication
+    if (!this.isWriteAllowed(sanitized)) {
+      const lastWrite = this.lastWriteTimes.get(sanitized) || 0;
+      const remainingMs = Math.max(0, WRITE_COOLDOWN_MS - (Date.now() - lastWrite));
+      return { allowed: false, reason: 'COOLDOWN_ACTIVE', remainingMs };
+    }
+
+    // 3. Verify user exists on GitHub
+    const exists = await gitHubUserValidator.validateUser(username);
+    if (!exists) {
+      return { allowed: false, reason: 'USER_NOT_FOUND' };
+    }
+
+    return { allowed: true };
+  }
+
+  /**
+   * Resets active writes map (useful for testing).
+   */
+  public reset(): void {
+    this.lastWriteTimes.clear();
+  }
+}
+
+export const trackUserProtection = TrackUserProtection.getInstance();
+export default trackUserProtection;