Skip to content

Commit a4f0a55

Browse files
BretRenBretRen
authored
Merge pull request #1 from pdnode-team/feat/security-enhancements
Add Rate Limit
2 parents 7ab2173 + 48f23ec commit a4f0a55

6 files changed

Lines changed: 386 additions & 61 deletions

File tree

‎cmd/web/main.go‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,9 @@ import (
1515
"github.com/stripe/stripe-go/v84"
1616
)
1717

18-
// TODO: 防止 /checkout/success 被滥用
1918
// TODO: 创建订阅集合迁移文件
2019
// TODO: 创建用户集合迁移文件
2120
// TODO: 用.env初始化SMTP和设置
22-
// TODO: 添加限速
2321
// TODO: 发送各种邮件
2422

2523
const version string = "v1.0.0-alpha"
@@ -42,6 +40,8 @@ func main() {
4240
// 版本
4341
app.Logger().Info("Pdnode Website API " + version)
4442

43+
// 初始化
44+
4545
// loosely check if it was executed using "go run"
4646
isGoRun := strings.HasPrefix(os.Args[0], os.TempDir())
4747

@@ -53,6 +53,15 @@ func main() {
5353

5454
app.OnServe().BindFunc(func(se *core.ServeEvent) error {
5555

56+
settings := app.Settings()
57+
58+
config.InitRateLimitRule(settings)
59+
60+
err := app.Save(settings)
61+
if err != nil {
62+
return err
63+
}
64+
5665
se.Router.GET("/{path...}", apis.Static(os.DirFS("./web/build"), true))
5766

5867
// 调用订阅模块，把 app, se 和 cfg 传进去

‎config/rate_limits.go‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package config
2+
3+
import "github.com/pocketbase/pocketbase/core"
4+
5+
func InitRateLimitRule(settings *core.Settings) {
6+
settings.RateLimits.Enabled = true
7+
settings.RateLimits.Rules = []core.RateLimitRule{
8+
{
9+
Label: "*:auth",
10+
MaxRequests: 2,
11+
Duration: 3,
12+
Audience: "",
13+
},
14+
{
15+
Label: "/api/",
16+
MaxRequests: 300,
17+
Duration: 10,
18+
Audience: "",
19+
},
20+
{
21+
Label: "/api/webhook/stripe",
22+
MaxRequests: 500,
23+
Duration: 5,
24+
Audience: "",
25+
},
26+
{
27+
Label: "/api/checkout/subscription",
28+
MaxRequests: 5,
29+
Duration: 10,
30+
Audience: "@auth",
31+
},
32+
{
33+
Label: "/api/checkout/subscription",
34+
MaxRequests: 2,
35+
Duration: 10,
36+
Audience: "@guest",
37+
},
38+
}
39+
}

‎web/src/lib/components/Header.svelte‎

Lines changed: 68 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,77 @@
11
<script lang="ts">
2-
import { setLocale } from '$lib/paraglide/runtime.js';
3-
import * as m from '$lib/paraglide/messages';
4-
import { onMount } from 'svelte';
5-
import { themeChange } from 'theme-change';
6-
import pb from '$lib/pocketbase';
2+
import {setLocale} from '$lib/paraglide/runtime.js';
3+
import * as m from '$lib/paraglide/messages';
4+
import {onMount} from 'svelte';
5+
import {themeChange} from 'theme-change';
6+
import pb from '$lib/pocketbase';
77
8-
// NOTE: the element that is using one of the theme attributes must be in the DOM on mount
9-
onMount(() => {
10-
themeChange(false);
8+
// NOTE: the element that is using one of the theme attributes must be in the DOM on mount
9+
onMount(() => {
10+
themeChange(false);
1111
12-
// 👆 false parameter is required for svelte
13-
});
12+
// 👆 false parameter is required for svelte
13+
});
1414
</script>
1515

1616
<div class="navbar bg-base-100 shadow-sm">
17-
<div class="flex-1">
18-
<a class="btn btn-ghost text-xl" href="/">Pdnode</a>
19-
</div>
20-
<div class="flex-none">
21-
<ul class="menu menu-horizontal px-1">
22-
<li>
23-
<label class="swap swap-rotate">
24-
<input type="checkbox" data-toggle-theme="dark, light" class="theme-controller" />
17+
<div class="flex-1">
18+
<a class="btn btn-ghost text-xl" href="/">Pdnode</a>
19+
</div>
20+
<div class="flex-none">
21+
<ul class="menu menu-horizontal px-1">
22+
<li>
23+
<label class="swap swap-rotate">
24+
<input type="checkbox" data-toggle-theme="dark, light" class="theme-controller"/>
2525

26-
<svg
27-
class="swap-off h-5 w-5 fill-current"
28-
xmlns="http://www.w3.org/2000/svg"
29-
viewBox="0 0 24 24"
30-
>
31-
<path
32-
d="M5.64,17l-.71.71a1,1,0,0,0,0,1.41,1,1,0,0,0,1.41,0l.71-.71A1,1,0,0,0,5.64,17ZM5,12a1,1,0,0,0-1-1H3a1,1,0,0,0,0,2H4A1,1,0,0,0,5,12Zm7-7a1,1,0,0,0,1-1V3a1,1,0,0,0-2,0V4A1,1,0,0,0,12,5ZM5.64,7.05a1,1,0,0,0,.7.29,1,1,0,0,0,.71-.29,1,1,0,0,0,0-1.41l-.71-.71A1,1,0,0,0,4.93,6.34Zm12,.29a1,1,0,0,0,.7-.29l.71-.71a1,1,0,1,0-1.41-1.41L17,5.64a1,1,0,0,0,0,1.41A1,1,0,0,0,17.66,7.34ZM21,11H20a1,1,0,0,0,0,2h1a1,1,0,0,0,0-2Zm-9,8a1,1,0,0,0-1,1v1a1,1,0,0,0,2,0V20A1,1,0,0,0,12,19ZM18.36,17A1,1,0,0,0,17,18.36l.71.71a1,1,0,0,0,1.41,0,1,1,0,0,0,0-1.41ZM12,6.5A5.5,5.5,0,1,0,17.5,12,5.51,5.51,0,0,0,12,6.5Zm0,9A3.5,3.5,0,1,1,15.5,12,3.5,3.5,0,0,1,12,15.5Z"
33-
/>
34-
</svg>
26+
<svg
27+
class="swap-off h-5 w-5 fill-current"
28+
xmlns="http://www.w3.org/2000/svg"
29+
viewBox="0 0 24 24"
30+
>
31+
<path
32+
d="M5.64,17l-.71.71a1,1,0,0,0,0,1.41,1,1,0,0,0,1.41,0l.71-.71A1,1,0,0,0,5.64,17ZM5,12a1,1,0,0,0-1-1H3a1,1,0,0,0,0,2H4A1,1,0,0,0,5,12Zm7-7a1,1,0,0,0,1-1V3a1,1,0,0,0-2,0V4A1,1,0,0,0,12,5ZM5.64,7.05a1,1,0,0,0,.7.29,1,1,0,0,0,.71-.29,1,1,0,0,0,0-1.41l-.71-.71A1,1,0,0,0,4.93,6.34Zm12,.29a1,1,0,0,0,.7-.29l.71-.71a1,1,0,1,0-1.41-1.41L17,5.64a1,1,0,0,0,0,1.41A1,1,0,0,0,17.66,7.34ZM21,11H20a1,1,0,0,0,0,2h1a1,1,0,0,0,0-2Zm-9,8a1,1,0,0,0-1,1v1a1,1,0,0,0,2,0V20A1,1,0,0,0,12,19ZM18.36,17A1,1,0,0,0,17,18.36l.71.71a1,1,0,0,0,1.41,0,1,1,0,0,0,0-1.41ZM12,6.5A5.5,5.5,0,1,0,17.5,12,5.51,5.51,0,0,0,12,6.5Zm0,9A3.5,3.5,0,1,1,15.5,12,3.5,3.5,0,0,1,12,15.5Z"
33+
/>
34+
</svg>
3535

36-
<svg
37-
class="swap-on h-5 w-5 fill-current"
38-
xmlns="http://www.w3.org/2000/svg"
39-
viewBox="0 0 24 24"
40-
>
41-
<path
42-
d="M21.64,13a1,1,0,0,0-1.05-.14,8.05,8.05,0,0,1-3.37.73A8.15,8.15,0,0,1,9.08,5.49a8.59,8.59,0,0,1,.25-2A1,1,0,0,0,8,2.36,10.14,10.14,0,1,0,22,14.05,1,1,0,0,0,21.64,13Zm-9.5,6.69A8.14,8.14,0,0,1,7.08,5.22v.27A10.15,10.15,0,0,0,17.22,15.63a9.79,9.79,0,0,0,2.1-.22A8.11,8.11,0,0,1,12.14,19.73Z"
43-
/>
44-
</svg>
45-
</label>
46-
</li>
47-
{#if !pb.authStore.isValid}
48-
<li>
49-
<a href="/login" class="link">Login</a>
50-
</li>
51-
{/if}
52-
<li>
53-
<a href="/pricing" class="link">Pricing</a>
54-
</li>
55-
<li>
56-
<details>
57-
<summary>{m['switch-language']()}</summary>
58-
<ul class="bg-base-100 rounded-t-none p-2">
59-
<li class="m-2"><button onclick={() => setLocale('en')}>English</button></li>
60-
<li class="m-2"><button onclick={() => setLocale('zh')}>简体中文</button></li>
61-
</ul>
62-
</details>
63-
</li>
64-
</ul>
65-
</div>
36+
<svg
37+
class="swap-on h-5 w-5 fill-current"
38+
xmlns="http://www.w3.org/2000/svg"
39+
viewBox="0 0 24 24"
40+
>
41+
<path
42+
d="M21.64,13a1,1,0,0,0-1.05-.14,8.05,8.05,0,0,1-3.37.73A8.15,8.15,0,0,1,9.08,5.49a8.59,8.59,0,0,1,.25-2A1,1,0,0,0,8,2.36,10.14,10.14,0,1,0,22,14.05,1,1,0,0,0,21.64,13Zm-9.5,6.69A8.14,8.14,0,0,1,7.08,5.22v.27A10.15,10.15,0,0,0,17.22,15.63a9.79,9.79,0,0,0,2.1-.22A8.11,8.11,0,0,1,12.14,19.73Z"
43+
/>
44+
</svg>
45+
</label>
46+
</li>
47+
{#if !pb.authStore.isValid}
48+
<li>
49+
<a href="/login" class="link">Login</a>
50+
</li>
51+
<li>
52+
<a href="/register" class="link">Register</a>
53+
</li>
54+
{:else}
55+
<li>
56+
<a href="/profile" class="link">Profile</a>
57+
</li>
58+
{/if}
59+
<li>
60+
<a href="/pricing" class="link">Pricing</a>
61+
</li>
62+
<li>
63+
<details>
64+
<summary>{m['switch-language']()}</summary>
65+
<ul class="bg-base-100 rounded-t-none p-2">
66+
<li class="m-2">
67+
<button onclick={() => setLocale('en')}>English</button>
68+
</li>
69+
<li class="m-2">
70+
<button onclick={() => setLocale('zh')}>简体中文</button>
71+
</li>
72+
</ul>
73+
</details>
74+
</li>
75+
</ul>
76+
</div>
6677
</div>

‎web/src/routes/(functional)/login/+page.svelte‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
1313
onMount(() => {
1414
if (pb.authStore.isValid) {
15-
window.location.pathname = '/';
15+
window.location.pathname = '/profile';
1616
}
1717
// 1. 获取查询字符串部分
1818
const queryString = window.location.search;
@@ -21,6 +21,9 @@
2121
const urlParams = new URLSearchParams(queryString);
2222
2323
r = urlParams.get('r');
24+
if (r) {
25+
r = r.replace(/(^\w+:|^)\/\//, '');
26+
}
2427
});
2528
2629
const handleLogin = async () => {
@@ -60,7 +63,7 @@
6063
>
6164
<h1 class="text-3xl font-bold text-center mb-4">Login</h1>
6265

63-
{#if getLocale() == 'zh'}
66+
{#if getLocale() === 'zh'}
6467
<span class="alert alert-warning alert-soft flex justify-center items-center">
6568
<p class="text-center">此页面不提供中文版本</p>
6669
</span>

‎web/src/routes/(functional)/profile/+page.svelte‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<script lang="ts">
2+
import {onMount} from "svelte";
3+
import pb from "$lib/pocketbase";
4+
5+
let subscription: any = $state()
6+
7+
const getHash = (str: string) => {
8+
let hash = 0;
9+
for (let i = 0; i < str.length; i++) {
10+
hash = str.charCodeAt(i) + ((hash << 5) - hash);
11+
}
12+
return hash;
13+
};
14+
15+
// 生成 HSL 颜色字符串
16+
// 360 是色相环的全周
17+
const generateColor = (str: string) => {
18+
if (!str) return `background-color: #3d4451`;
19+
const hash = getHash(str);
20+
const hue = Math.abs(hash % 360);
21+
return `background-color: hsl(${hue}, 70%, 45%)`;
22+
};
23+
24+
onMount(async () => {
25+
if (!pb.authStore.isValid) {
26+
window.location.pathname = '/login';
27+
}
28+
29+
const subscribe = await fetch("/api/subscription", {
30+
headers: { 'content-type': 'application/json', Authorization: pb.authStore.token }
31+
})
32+
33+
const json = await subscribe.json()
34+
35+
if (subscribe.status == 400){
36+
subscription = null
37+
}else if (subscribe.ok){
38+
subscription = json
39+
}
40+
41+
console.log(json)
42+
43+
})
44+
</script>
45+
46+
<svelte:head>
47+
<title>Profile | Pdnode</title>
48+
</svelte:head>
49+
50+
<div class="flex w-full h-full justify-center items-center flex-col gap-8 min-h-[80vh] p-4">
51+
<div class="card w-full max-w-sm shadow-2xl bg-base-100 border border-base-200">
52+
<div class="card-body items-center text-center">
53+
<h1 class="card-title text-3xl font-bold mb-6">Profile</h1>
54+
55+
<div class="avatar placeholder mb-4 mt-4">
56+
<div class="bg-neutral text-neutral-content rounded-full w-24 flex items-center justify-center" style={generateColor(pb.authStore.record?.name)}>
57+
<span class="text-3xl">{pb.authStore.record?.name[0]}</span>
58+
</div>
59+
</div>
60+
61+
<div class="w-full space-y-4">
62+
<div class="form-control">
63+
<span class="label-text font-semibold">Name</span>
64+
<div class="bg-base-200 p-3 rounded-lg text-left flex items-center justify-start gap-4">
65+
{pb.authStore.record?.name}
66+
{#if subscription}
67+
<div class="badge badge-primary">{subscription.plan}</div>
68+
{/if}
69+
70+
71+
</div>
72+
</div>
73+
74+
<div class="form-control">
75+
<span class="label-text font-semibold">Email</span>
76+
<div class="bg-base-200 p-3 rounded-lg text-left">
77+
{pb.authStore.record?.email}
78+
</div>
79+
</div>
80+
</div>
81+
82+
<div class="card-actions justify-end mt-6 w-full">
83+
<button class="btn btn-primary btn-block" onclick={() => {pb.authStore.clear(); window.location.reload()}}>Log Out</button>
84+
85+
</div>
86+
</div>
87+
</div>
88+
</div>

0 commit comments

Comments
 (0)