HostServ: throttle vhost requests

A member may request a vhost at most once a minute; a request sooner is
refused with the wait time. In-memory per-account (not event-logged), the
same shape as the identify brute-force throttle.

api/src/lib.rs

@@ -601,6 +601,7 @@ pub trait Store {
     fn vhost(&self, account: &str) -> Option<VhostView>;
     fn vhosts(&self) -> Vec<VhostView>;
     fn request_vhost(&mut self, account: &str, host: &str) -> Result<(), RegError>;
+    fn vhost_request_wait(&self, account: &str) -> u64;
     fn take_vhost_request(&mut self, account: &str) -> Result<Option<String>, RegError>;
     fn vhost_requests(&self) -> Vec<(String, String)>;
     fn vhost_offer_add(&mut self, host: &str) -> Result<bool, RegError>;

hostserv/src/request.rs

@@ -18,6 +18,11 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         ctx.notice(me, from.uid, format!("\x02{host}\x02 isn't allowed here. Please choose another."));
         return;
     }
+    let wait = db.vhost_request_wait(account);
+    if wait > 0 {
+        ctx.notice(me, from.uid, format!("Please wait \x02{wait}\x02s before requesting another vhost."));
+        return;
+    }
     match db.request_vhost(account, host) {
         Ok(()) => ctx.notice(me, from.uid, format!("Requested vhost \x02{host}\x02 — an operator will review it.")),
         Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),

src/engine/db.rs

@@ -784,6 +784,8 @@ pub struct Db {
     codes: HashMap<String, PendingCode>,
     // Node-local, non-persisted brute-force throttle for password authentication.
     auth_fails: HashMap<String, AuthThrottle>,
+    // Last vhost REQUEST time per account (in-memory, anti-spam), unix secs.
+    vhost_req_times: HashMap<String, u64>,
     // Registered service bots (BotServ), keyed by casefolded nick.
     bots: HashMap<String, Bot>,
     // HostServ node config: the self-serve offer menu, the forbidden-pattern
@@ -843,7 +845,7 @@ impl Db {
             apply(&mut accounts, &mut channels, &mut grouped, &mut bots, &mut host_cfg, event);
         }
         tracing::info!(accounts = accounts.len(), channels = channels.len(), "account store loaded");
-        Self { accounts, channels, grouped, log, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), bots, host_cfg }
+        Self { accounts, channels, grouped, log, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), bots, host_cfg }
     }
 
     /// Fold an entry authored by another node into the store — the services-side
@@ -1239,9 +1241,19 @@ impl Db {
         let ts = now();
         self.log.append(Event::VhostRequested { account: account.to_string(), host: host.to_string(), ts }).map_err(|_| RegError::Internal)?;
         self.accounts.get_mut(&k).unwrap().vhost_request = Some(PendingVhost { host: host.to_string(), ts });
+        self.vhost_req_times.insert(k, ts);
         Ok(())
     }
 
+    /// Seconds a member must wait before requesting another vhost (0 = allowed).
+    pub fn vhost_request_wait(&self, account: &str) -> u64 {
+        const COOLDOWN: u64 = 60;
+        match self.vhost_req_times.get(&key(account)) {
+            Some(&last) => COOLDOWN.saturating_sub(now().saturating_sub(last)),
+            None => 0,
+        }
+    }
+
     /// Clear a pending vhost request (on approval or rejection). Returns the
     /// requested host, if there was one.
     pub fn take_vhost_request(&mut self, account: &str) -> Result<Option<String>, RegError> {
@@ -2516,6 +2528,9 @@ impl Store for Db {
     fn request_vhost(&mut self, account: &str, host: &str) -> Result<(), RegError> {
         Db::request_vhost(self, account, host)
     }
+    fn vhost_request_wait(&self, account: &str) -> u64 {
+        Db::vhost_request_wait(self, account)
+    }
     fn take_vhost_request(&mut self, account: &str) -> Result<Option<String>, RegError> {
         Db::take_vhost_request(self, account)
     }

src/engine/mod.rs

@@ -2721,6 +2721,8 @@ mod tests {
         hs(&mut e, "000AAAAAB", "FORBID (?i)(admin|staff)");
         assert!(says(&hs(&mut e, "000AAAAAV", "REQUEST admin.example"), "isn't allowed"), "impersonating request blocked");
         assert!(says(&hs(&mut e, "000AAAAAV", "REQUEST cool.example"), "will review"), "clean request allowed");
+        // A second request right away is throttled.
+        assert!(says(&hs(&mut e, "000AAAAAV", "REQUEST another.example"), "Please wait"), "request throttled");
         assert!(says(&hs(&mut e, "000AAAAAV", "FORBID x"), "Access denied"), "FORBID oper-gated");
 
         // A template lets a user self-serve a $account vhost.
@@ -2810,6 +2812,7 @@ mod tests {
         db.scram_iterations = 4096;
         db.register("boss", "password1", None).unwrap();
         db.register("alice", "password1", None).unwrap();
+        db.register("bob", "password1", None).unwrap();
         let mut e = Engine::new(
             vec![
                 Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
@@ -2825,8 +2828,10 @@ mod tests {
         let hs = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAG".into(), text: t.into() });
         e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "boss".into(), host: "realhost".into() });
         e.handle(NetEvent::UserConnect { uid: "000AAAAAV".into(), nick: "alice".into(), host: "realhost".into() });
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAW".into(), nick: "bob".into(), host: "realhost".into() });
         ns(&mut e, "000AAAAAB", "IDENTIFY password1");
         ns(&mut e, "000AAAAAV", "IDENTIFY password1");
+        ns(&mut e, "000AAAAAW", "IDENTIFY password1");
         let says = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n)));
 
         // alice requests; the request shows up in WAITING.
@@ -2838,9 +2843,9 @@ mod tests {
         // The request is consumed; WAITING is empty again.
         assert!(says(&hs(&mut e, "000AAAAAB", "WAITING"), "No vhost requests"), "request consumed");
 
-        // A rejected request assigns nothing.
+        // A different user's request, rejected, assigns nothing.
-        hs(&mut e, "000AAAAAV", "REQUEST other.example");
+        hs(&mut e, "000AAAAAW", "REQUEST other.example");
-        assert!(says(&hs(&mut e, "000AAAAAB", "REJECT alice"), "Rejected"), "rejected");
+        assert!(says(&hs(&mut e, "000AAAAAB", "REJECT bob"), "Rejected"), "rejected");
         assert!(says(&hs(&mut e, "000AAAAAB", "WAITING"), "No vhost requests"), "no request left after reject");
         // A non-operator can't approve.
         assert!(says(&hs(&mut e, "000AAAAAV", "WAITING"), "Access denied"), "oper-gated");