Per-IP Guest Rate Limiter

server/cryptoUtils.js

@@ -46,6 +46,7 @@ export function decryptJson(encryptedData) {
 
 export async function saveEncryptedJson(filePath, data) {
   const encrypted = encryptJson(data);
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
   await fs.writeFile(filePath, JSON.stringify(encrypted));
 }
 

server/guestRequestLimiter.js

@@ -0,0 +1,69 @@
+import { loadEncryptedJson, saveEncryptedJson } from './cryptoUtils.js';
+
+const REQUESTS_FILE = '/data/guest_request_counts.json';
+const WINDOW_MS = 24 * 60 * 60 * 1000;
+const MAX_LOGGED_OUT_REQUESTS = 50;
+
+const ipCounters = new Map();
+let loaded = false;
+
+async function loadGuestCounters() {
+  if (loaded) return;
+  loaded = true;
+  const data = await loadEncryptedJson(REQUESTS_FILE);
+  if (!data) return;
+  for (const [ip, entry] of Object.entries(data)) {
+    ipCounters.set(ip, {
+      count: typeof entry.count === 'number' ? entry.count : 0,
+      resetAt: typeof entry.resetAt === 'number' ? entry.resetAt : Date.now() + WINDOW_MS,
+    });
+  }
+}
+
+async function saveGuestCounters() {
+  const data = {};
+  for (const [ip, entry] of ipCounters) {
+    data[ip] = { count: entry.count, resetAt: entry.resetAt };
+  }
+  await saveEncryptedJson(REQUESTS_FILE, data);
+}
+
+function cleanupExpired() {
+  const now = Date.now();
+  for (const [ip, entry] of ipCounters) {
+    if (entry.resetAt <= now) {
+      ipCounters.delete(ip);
+    }
+  }
+}
+
+export async function initGuestRequestLimiter() {
+  await loadGuestCounters().catch(err => console.error('Failed to load guest request counters:', err));
+  cleanupExpired();
+  setInterval(() => {
+    cleanupExpired();
+  }, 60 * 60 * 1000);
+}
+
+export async function consumeGuestRequest(ip) {
+  await loadGuestCounters();
+  const now = Date.now();
+  let entry = ipCounters.get(ip);
+  if (!entry || entry.resetAt <= now) {
+    entry = { count: 0, resetAt: now + WINDOW_MS };
+    ipCounters.set(ip, entry);
+  }
+  if (entry.count >= MAX_LOGGED_OUT_REQUESTS) {
+    return false;
+  }
+  entry.count += 1;
+  await saveGuestCounters().catch(err => console.error('Failed to save guest request counters:', err));
+  return true;
+}
+
+export function getGuestRequestsRemaining(ip) {
+  const now = Date.now();
+  const entry = ipCounters.get(ip);
+  if (!entry || entry.resetAt <= now) return MAX_LOGGED_OUT_REQUESTS;
+  return Math.max(0, MAX_LOGGED_OUT_REQUESTS - entry.count);
+}

server/wsHandler.js

@@ -3,6 +3,7 @@ import { safeSend, broadcastToUser } from './helpers.js';
 import { LIGHTNING_BASE, PUBLIC_URL } from './config.js';
 import { sessionStore, deviceSessionStore } from './sessionStore.js';
 import { rateLimiter } from './rateLimiter.js';
+import { initGuestRequestLimiter, consumeGuestRequest } from './guestRequestLimiter.js';
 import {
   verifySupabaseToken, getUserSettings, saveUserSettings,
   getUserProfile, setUsername, getSubscriptionInfo,
@@ -13,12 +14,20 @@ import crypto from 'crypto';
 
 const activeStreams = new Map();
 
+initGuestRequestLimiter().catch(err => console.error('Failed to initialize guest request limiter:', err));
+
 export async function handleWsMessage(ws, msg, wsClients) {
   const client = wsClients.get(ws); if (!client) return;
   // Require turnstile verification for most message types
   if (!client.verified && msg.type !== 'ping' && msg.type !== 'turnstile:verify') {
     return safeSend(ws, { type: 'error', message: 'turnstile:required' });
   }
+
+  if (!client.userId && msg.type !== 'ping' && msg.type !== 'turnstile:verify') {
+    const allowed = await consumeGuestRequest(client.ip || 'unknown');
+    if (!allowed) return safeSend(ws, { type: 'error', message: 'Guest request limit exceeded' });
+  }
+
   const h = handlers[msg.type];
   if (h) return h(ws, msg, client, wsClients);
   safeSend(ws, { type: 'error', message: `Unknown: ${msg.type}` });