134 lines
4.6 KiB
TypeScript
134 lines
4.6 KiB
TypeScript
import { createClient } from "@/lib/supabase/server"
|
|
import { createAdminClient } from "@/lib/supabase/admin"
|
|
import { headers } from "next/headers"
|
|
|
|
export type SecurityEventType = 'login_success' | 'login_failed' | 'otp_sent' | 'otp_verified' | 'otp_failed' | 'logout' | 'master_otp_used'
|
|
|
|
export async function logActivity(
|
|
userId: string | null,
|
|
eventType: SecurityEventType,
|
|
details: Record<string, any> = {}
|
|
) {
|
|
try {
|
|
// Use Admin Client to bypass RLS for inserting logs
|
|
// This is crucial because logging often happens when user is not yet authenticated (e.g. login failed)
|
|
const supabase = await createAdminClient() || await createClient()
|
|
|
|
const headersList = await headers()
|
|
let ip = headersList.get("x-forwarded-for") || headersList.get("x-real-ip") || 'unknown'
|
|
if (ip.includes(',')) ip = ip.split(',')[0].trim()
|
|
if (ip === '::1') ip = '127.0.0.1'
|
|
const userAgent = headersList.get("user-agent") || 'unknown'
|
|
|
|
await supabase.from('auth_logs').insert({
|
|
user_id: userId,
|
|
event_type: eventType,
|
|
ip_address: ip,
|
|
user_agent: userAgent,
|
|
details
|
|
})
|
|
} catch (error) {
|
|
console.error('Failed to log activity:', error)
|
|
// Fail silently to not block user flow
|
|
}
|
|
}
|
|
|
|
export async function checkRateLimit(action: string): Promise<{ blocked: boolean, remaining?: number, resetTime?: Date }> {
|
|
const MAX_ATTEMPTS = 5
|
|
const WINDOW_MINUTES = 10
|
|
|
|
try {
|
|
const supabase = await createAdminClient() || await createClient()
|
|
const headersList = await headers()
|
|
let ip = headersList.get("x-forwarded-for") || headersList.get("x-real-ip") || 'unknown'
|
|
if (ip.includes(',')) ip = ip.split(',')[0].trim()
|
|
if (ip === '::1') ip = '127.0.0.1'
|
|
|
|
// Clean up old limits
|
|
// Clean up old limits (logic simplified, variable unused)
|
|
|
|
// Check current limit
|
|
const { data: limit } = await supabase
|
|
.from('rate_limits')
|
|
.select('*')
|
|
.eq('ip_address', ip)
|
|
.eq('action', action)
|
|
.single()
|
|
|
|
if (!limit) {
|
|
return { blocked: false, remaining: MAX_ATTEMPTS }
|
|
}
|
|
|
|
// If blocked
|
|
if (limit.blocked_until && new Date(limit.blocked_until) > new Date()) {
|
|
return { blocked: true, resetTime: new Date(limit.blocked_until) }
|
|
}
|
|
|
|
// If window expired, reset code handling happens in increment logic usually.
|
|
// But here we just check.
|
|
// Actually, simpler logic:
|
|
// We will increment on failure. This function just checks if currently blocked.
|
|
|
|
return { blocked: false, remaining: MAX_ATTEMPTS - (limit.count || 0) }
|
|
|
|
} catch (error) {
|
|
console.error('Rate limit check failed:', error)
|
|
return { blocked: false } // Fail open
|
|
}
|
|
}
|
|
|
|
export async function incrementRateLimit(action: string) {
|
|
const BLOCK_DURATION_MINUTES = 15
|
|
|
|
try {
|
|
const supabase = await createAdminClient() || await createClient()
|
|
const headersList = await headers()
|
|
let ip = headersList.get("x-forwarded-for") || headersList.get("x-real-ip") || 'unknown'
|
|
if (ip.includes(',')) ip = ip.split(',')[0].trim()
|
|
if (ip === '::1') ip = '127.0.0.1'
|
|
|
|
const { data: limit } = await supabase
|
|
.from('rate_limits')
|
|
.select('*')
|
|
.eq('ip_address', ip)
|
|
.eq('action', action)
|
|
.single()
|
|
|
|
if (limit) {
|
|
// Check if we should reset (if last attempt was long ago)
|
|
const lastAttempt = new Date(limit.last_attempt)
|
|
const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000)
|
|
|
|
let newCount = limit.count + 1
|
|
let blockedUntil = null
|
|
|
|
if (lastAttempt < tenMinutesAgo) {
|
|
newCount = 1 // Reset if window passed
|
|
}
|
|
|
|
if (newCount >= 5) {
|
|
blockedUntil = new Date(Date.now() + BLOCK_DURATION_MINUTES * 60 * 1000).toISOString()
|
|
}
|
|
|
|
await supabase
|
|
.from('rate_limits')
|
|
.update({
|
|
count: newCount,
|
|
last_attempt: new Date().toISOString(),
|
|
blocked_until: blockedUntil
|
|
})
|
|
.eq('id', limit.id)
|
|
} else {
|
|
await supabase.from('rate_limits').insert({
|
|
ip_address: ip,
|
|
action,
|
|
count: 1,
|
|
last_attempt: new Date().toISOString()
|
|
})
|
|
}
|
|
|
|
} catch (error) {
|
|
console.error('Rate limit increment failed:', error)
|
|
}
|
|
}
|