feat(api): protect group dm changes (#1244)

fluxer_api/src/api/middleware/CaptchaMiddleware.ts

@@ -48,7 +48,7 @@ function resolveCaptchaProvider(
 	return createCaptchaProvider({mode: requestedProvider, secretKey});
 }
 
-async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
+export async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
 	const captchaConfig = await ctx.get('instanceConfigRepository').getEffectiveCaptchaConfig();
 	if (!captchaConfig.enabled && !(Config.dev.testModeEnabled && Config.captcha.enabled)) return;
 	const user = ctx.get('user') as User | undefined;

fluxer_api/src/api/middleware/GroupDmProtectionMiddleware.ts

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {CreatePrivateChannelRequest} from '@fluxer/schema/src/domains/user/UserRequestSchemas';
+import type {Context, MiddlewareHandler, Next} from 'hono';
+import {createMiddleware} from 'hono/factory';
+import {RateLimitConfigs} from '../RateLimitConfig';
+import type {HonoEnv} from '../types/HonoEnv';
+import {verifyCaptchaToken} from './CaptchaMiddleware';
+import {RateLimitMiddleware} from './RateLimitMiddleware';
+
+const groupDmCreateRateLimit = RateLimitMiddleware(RateLimitConfigs.USER_GROUP_DM_CREATE);
+const groupDmRecipientAddRateLimit = RateLimitMiddleware(RateLimitConfigs.USER_GROUP_DM_RECIPIENT_ADD);
+
+function getCreatePrivateChannelRequest(ctx: Context<HonoEnv>): CreatePrivateChannelRequest {
+	const req = ctx.req as unknown as {
+		valid(target: 'json'): CreatePrivateChannelRequest;
+	};
+	return req.valid('json');
+}
+
+async function enforceRateLimitAndCaptcha(ctx: Context<HonoEnv>, next: Next, rateLimit: MiddlewareHandler<HonoEnv>) {
+	return await rateLimit(ctx, async () => {
+		await verifyCaptchaToken(ctx);
+		await next();
+	});
+}
+
+export const GroupDmCreateProtectionMiddleware = createMiddleware<HonoEnv>(async (ctx, next) => {
+	const data = getCreatePrivateChannelRequest(ctx);
+	if (data.recipients === undefined) {
+		await next();
+		return;
+	}
+	return await enforceRateLimitAndCaptcha(ctx, next, groupDmCreateRateLimit);
+});
+
+export const GroupDmRecipientAddProtectionMiddleware = createMiddleware<HonoEnv>(async (ctx, next) => {
+	return await enforceRateLimitAndCaptcha(ctx, next, groupDmRecipientAddRateLimit);
+});