Updated frontend

nodejs/middleware/auth.js

@@ -15,4 +15,14 @@ async function auth(req, res, next){
 	}
 }
 
-module.exports = {auth};
+async function authIO(socket, next){
+	try{
+		let token = await Auth.checkToken(socket.handshake.auth.token || 0);
+		socket.user = await token.getUser();
+		next();
+	}catch(error){
+		next(error);
+	}
+}
+
+module.exports = {auth, authIO};

nodejs/middleware/rate_limit.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const { rateLimit } = require('express-rate-limit');
+
+const onLimitReached = (req, res, options) => {
+	console.warn(`Rate limit hit: ${req.ip} ${req.method} ${req.path}`);
+};
+
+const handler = (message) => (req, res, next, options) => {
+	onLimitReached(req, res, options);
+	res.status(429).json(message);
+};
+
+exports.login = rateLimit({
+	windowMs: 15 * 60 * 1000,
+	limit: 10,
+	handler: handler({ name: 'RateLimitError', message: 'Too many login attempts, try again later.' }),
+});
+
+exports.passwordReset = rateLimit({
+	windowMs: 60 * 60 * 1000,
+	limit: 5,
+	handler: handler({ name: 'RateLimitError', message: 'Too many password reset requests, try again later.' }),
+});
+
+exports.otpRequest = rateLimit({
+	windowMs: 15 * 60 * 1000,
+	limit: 5,
+	handler: handler({ name: 'RateLimitError', message: 'Too many OTP requests, try again later.' }),
+});
+
+exports.otpVerify = rateLimit({
+	windowMs: 15 * 60 * 1000,
+	limit: 10,
+	handler: handler({ name: 'RateLimitError', message: 'Too many verification attempts, try again later.' }),
+});
+
+exports.invite = rateLimit({
+	windowMs: 60 * 60 * 1000,
+	limit: 20,
+	handler: handler({ name: 'RateLimitError', message: 'Too many requests, try again later.' }),
+});