a0d4ba964c
All checks were successful
Deploy to Production / Deploy to Server (push) Successful in 1m4s
Audit #18 - Rate limit store memory growth: - rateLimitStore already had cleanup via cleanupExpiredEntries() per-request + 60s interval - Added .unref() to the setInterval timer for clean graceful shutdown behaviour Audit #25 - Consistent error response shapes: - billing.ts: Fixed 409 plain-text response -> JSON { error: "..." } - index.ts: Simplified 404 from 4-field object to { error: "Not Found: METHOD path" } - signup.ts: Removed extra retryAfter field from rate-limit message object - pdfRateLimit.ts: Merged limit/tier/retryAfter into single error message string - usage.ts: Merged limit/used/upgrade fields into single error message string - convert.ts: Merged detail field into error message (3 occurrences) All error responses now consistently use {"error": "message"} shape.
92 lines
3.6 KiB
JavaScript
92 lines
3.6 KiB
JavaScript
import { Router } from "express";
|
|
import rateLimit from "express-rate-limit";
|
|
import { createFreeKey } from "../services/keys.js";
|
|
import { createVerification, createPendingVerification, verifyCode, isEmailVerified } from "../services/verification.js";
|
|
import { sendVerificationEmail } from "../services/email.js";
|
|
import logger from "../services/logger.js";
|
|
const router = Router();
|
|
const signupLimiter = rateLimit({
|
|
windowMs: 60 * 60 * 1000,
|
|
max: 5,
|
|
message: { error: "Too many signup attempts. Please try again in 1 hour." },
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
});
|
|
const verifyLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 15,
|
|
message: { error: "Too many verification attempts. Please try again later." },
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
});
|
|
async function rejectDuplicateEmail(req, res, next) {
|
|
const { email } = req.body || {};
|
|
if (email && typeof email === "string") {
|
|
const cleanEmail = email.trim().toLowerCase();
|
|
if (await isEmailVerified(cleanEmail)) {
|
|
res.status(409).json({ error: "Email already registered" });
|
|
return;
|
|
}
|
|
}
|
|
next();
|
|
}
|
|
// Step 1: Request signup — generates 6-digit code, sends via email
|
|
router.post("/free", rejectDuplicateEmail, signupLimiter, async (req, res) => {
|
|
const { email } = req.body || {};
|
|
if (!email || typeof email !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
|
|
res.status(400).json({ error: "A valid email address is required." });
|
|
return;
|
|
}
|
|
const cleanEmail = email.trim().toLowerCase();
|
|
if (await isEmailVerified(cleanEmail)) {
|
|
res.status(409).json({ error: "This email is already registered. Contact support if you need help." });
|
|
return;
|
|
}
|
|
const pending = await createPendingVerification(cleanEmail);
|
|
sendVerificationEmail(cleanEmail, pending.code).catch(err => {
|
|
logger.error({ err, email: cleanEmail }, "Failed to send verification email");
|
|
});
|
|
res.json({
|
|
status: "verification_required",
|
|
message: "Check your email for the verification code.",
|
|
});
|
|
});
|
|
// Step 2: Verify code — creates API key
|
|
router.post("/verify", verifyLimiter, async (req, res) => {
|
|
const { email, code } = req.body || {};
|
|
if (!email || !code) {
|
|
res.status(400).json({ error: "Email and code are required." });
|
|
return;
|
|
}
|
|
const cleanEmail = email.trim().toLowerCase();
|
|
const cleanCode = String(code).trim();
|
|
if (await isEmailVerified(cleanEmail)) {
|
|
res.status(409).json({ error: "This email is already verified." });
|
|
return;
|
|
}
|
|
const result = await verifyCode(cleanEmail, cleanCode);
|
|
switch (result.status) {
|
|
case "ok": {
|
|
const keyInfo = await createFreeKey(cleanEmail);
|
|
const verification = await createVerification(cleanEmail, keyInfo.key);
|
|
verification.verifiedAt = new Date().toISOString();
|
|
res.json({
|
|
status: "verified",
|
|
message: "Email verified! Here's your API key.",
|
|
apiKey: keyInfo.key,
|
|
tier: keyInfo.tier,
|
|
});
|
|
break;
|
|
}
|
|
case "expired":
|
|
res.status(410).json({ error: "Verification code has expired. Please sign up again." });
|
|
break;
|
|
case "max_attempts":
|
|
res.status(429).json({ error: "Too many failed attempts. Please sign up again to get a new code." });
|
|
break;
|
|
case "invalid":
|
|
res.status(400).json({ error: "Invalid verification code." });
|
|
break;
|
|
}
|
|
});
|
|
export { router as signupRouter };
|