Ilia Denisov
041106d623
CI / changes (pull_request) Successful in 3s
CI / unit (pull_request) Successful in 11s
CI / integration (pull_request) Successful in 17s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m11s
Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.
The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.
Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.
PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.
49 lines
1.4 KiB
Go
49 lines
1.4 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"scrabble/backend/internal/banview"
|
|
)
|
|
|
|
// banSyncRequest mirrors the gateway's active-ban report: every entry is one
|
|
// currently-enforced IP ban.
|
|
type banSyncRequest struct {
|
|
Active []banSyncEntry `json:"active"`
|
|
}
|
|
|
|
// banSyncEntry is one active ban in the sync request.
|
|
type banSyncEntry struct {
|
|
IP string `json:"ip"`
|
|
Reason string `json:"reason"`
|
|
Since time.Time `json:"since"`
|
|
Expires time.Time `json:"expires"`
|
|
}
|
|
|
|
// banSyncResponse returns the IPs an operator has marked for unban for the gateway
|
|
// to apply on its next sync.
|
|
type banSyncResponse struct {
|
|
Unban []string `json:"unban"`
|
|
}
|
|
|
|
// handleBanSync ingests the gateway's active-ban report into the ban view (the
|
|
// admin console's active-bans panel) and returns the operator's pending unbans.
|
|
// Internal, gateway-only: like the rate-limit report it trusts the network
|
|
// segment and carries no user identity.
|
|
func (s *Server) handleBanSync(c *gin.Context) {
|
|
var req banSyncRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
abortBadRequest(c, "invalid ban sync")
|
|
return
|
|
}
|
|
bans := make([]banview.Ban, 0, len(req.Active))
|
|
for _, e := range req.Active {
|
|
bans = append(bans, banview.Ban{IP: e.IP, Reason: e.Reason, Since: e.Since, Expires: e.Expires})
|
|
}
|
|
s.banview.Ingest(bans)
|
|
c.JSON(http.StatusOK, banSyncResponse{Unban: s.banview.DrainUnbans()})
|
|
}
|