From ea676ddd0351bdf5949c19aeead2fdaeb668dcbf Mon Sep 17 00:00:00 2001 From: Flam3rboy <34555296+Flam3rboy@users.noreply.github.com> Date: Sun, 27 Jun 2021 23:14:13 +0200 Subject: [PATCH] :lock: register proxy ip check --- package-lock.json | Bin 302741 -> 653583 bytes package.json | 3 +- src/Server.ts | 3 +- src/middlewares/GlobalRateLimit.ts | 49 ---------------- src/middlewares/RateLimit.ts | 47 ++------------- src/routes/auth/register.ts | 19 ++++-- src/routes/guilds/#guild_id/bans.ts | 2 +- src/util/ipAddress.ts | 87 ++++++++++++++++++++++++++++ 8 files changed, 111 insertions(+), 99 deletions(-) delete mode 100644 src/middlewares/GlobalRateLimit.ts create mode 100644 src/util/ipAddress.ts diff --git a/package-lock.json b/package-lock.json index fda1d88e2565278ec00cf2f38f3e850ede0b30ab..266397b8ae04dabfd88c95499e4e326ea47ae1f5 100644 GIT binary patch delta 75534 zcmc#+2Y6If_W$mCj}l4>>5zmZ^fHWM*V%tG{;ItU70Twb5eWPZi)p1>R>2OY8WDgEDe6eB182Ab4)Goa=Kcg@s8?L%j=n-$q8e}!rdlp-mF(@OCuLwH!5t2Klm*(J$ z<;b6;^%atP$ge7Yg8OT-;Nj_pR?_~njdX?g|Ti7JyIJ> zufCzZ#P*IJDT}6^-)~1>*xs>IX>LYVK}I1Th<>}SXPEDZ=<4De`snTLaTl`iMDu`L zBgD5a&B7nx3|p@eVq$fbMpt{?bvzVAy$&E*c0 zhfr`{@223+@Qq1lqb|1CDr(J0_mDY7jDcsW#3-6vFqH0Y_ZU>!NgTBdXipdP??`VQ zm(W@91DY8VOP^@}Cu~d+r7+((^wF^2JrX++~M9rlq~Mr)PH>btk>!g^k3_%KFY znetgRy{wUChBBjBkGI;W51bx~#!1m|%Xkt85#yvVxUGl`paVPS!k=rzI9lI%5nV7T zimw9>rb%6BWO)0$t6MgOektDdJeuZ?+uC2sqV?g)uy`7YrH_V}`UhXvSBhAPM;}OU zWhN`02j@*;>3k4&JZ4jwzT9leSn3RXR%>rU-Iut)jnO*|l}24zZDl2ttjFC+87k(` z-4Xr3)?bXJrz1+?_I6@yufU^kZjbd~cunj|hcE94w@X4__NHwB7Z^X*%m4DdZqs|;XpIUZUP5a}H+Gq!B(lvNdp5R>PVhW(^`tOb81uKd zrpMacF)ds{Bf-}{;u6`gmU zeQLDwv6YFs#)8Bg)ngmGsvcXG6i1W0wQJnhH9GjCsg3=U;(d>W)3|Qojke^eM7ht6 zFQ!cOJ>*-R@)^1(Ke=&nYG=Z4e0%SWr-#y#8*fO9^8GxVZb(d_AEs|rzTDv+NsTx3 z@INNca>2`u?A537T+cqf(R_2_5 zr^OlJkZ&Y?;G=FNn%5T9jZt)NR!@4ad(@oEbGq)liSh5E*6c>x$v=*d2L}P5n||_ zBPY<4d3)rG+r*>28^a2E`9?~k+r~99X?S7B#w~*q10I_`QpKOy+N>W$z-^;Q6rXg% z;7;`F!Oc$`M>B>dHQqO5NU%|l4(rx9dsu<*u?yd}@vGtazOU10lWQyeFt+jLk?Fq2 zE*yof7!}u;GD@fYNQcHJM)%ixWarq3#!+K?_#WX~suC)Xj{8YIkUisd%C8zfAK%{d z)2k;9q_=bor-?mc==2_)nBPdY_lMJ1idmb?`gr1*# zkGu-YfIRy3lmV)hL{ANu#fe|fZA_acdRCV|J*!40VFlqYH+W2g7HNH%$gm1M>SWV; z4qC4|l1-P*$fWO1?}LA>{&(v9obrj|X3m&DV_t1Tf!;d1WI@f``dZi0dD)X@jw;sI z&8wI*di<#T8IHOs^QT&hYfa|D{2KEt)z$B{YbS5eKTd>eIsa3}0dq!_rk;*qKf6?Rq&7v`-+orePB>F0|tqhi>PNiCpYCmv1aW zf4cKf0`0IQzLoZ=|B`m{J~fUuR0-^K6X4NvVhlZ7ZqgET%0rM}-DY>0Y*vGrI}@TA z|It}(E>oq+<9HYZC+3mpeoDr~3DIG++Z^bha4Hl*y3W|0W>$5i->m5i`+pHTz{p?4 zWaxaC6i3?|7cosHMS}>D1mR3SF}hQrE!TLRv4e*&?x~!&P~+#yH*A{K$k)het96tc zbrysDvM-;Kni!g2{j1{Qbcf+~A%*_1u``s;5jxYIrp#8Nj*m@o@@6rX&<-*{NTxSh z#?U|JXHMceW2?}74x_HB!R}Ry6`yHYD|iXZZ1w!Sb)GR4hmYpu+d>l9 zt&#+bBLqF{cpEj}sdW)>iy*~PXI&{&+DZIMzpn;8yy%IQC0S5%*A}`#7iTfl72e_d@X&Z@sq3key(;jW3`^XbEG{Df4?&wcTKr+w#J9AN%BY`%K+xV z=|sO>*+uotA1l396niFP^)Ti4bmcXP@PZpns4c6{$ZzExYu6g}SbNuy3l#L1{^ngT zyYF9Jo1+>(aqZWBb};Sw1eKK_hl5asw8FBvB%aQ??u6oT3w8Ix{M;mU+S3b=2(pXrllVa#cH~m{Nqw>5Mn`S_ zR)SSwM9;_3ZG15BC!JyMTp^5#o1#=^nY@X#=%a2lf73z!6BxHbh@w3J+JcI!Rrh{WnG9upJeKXk)Z74xBcw|cG= z9uBHuxMd$gU*+N&&qK0*E$kt*FmI1nJyddAN)rz?NmeXe1!+JM=fgy1ws&iC z1L4dmlq6@jA6Cuy+8v$zGx`bZ_d8X@uRTyRCE?LftZxk;n^E-ZOlmvPhB zvGXI7bg`Px!sfm8mSdi}vvyeM7DIaOfdc^C) zuwPKZJ}{Y~=wJ?Xk<(&&9{2GApIdefhuNljMV8uc8sd)p+~ z?uB0j3DPR`Km?uS6o)+FxJ75 z`^b2j{`l4|im46dJDx#sfC;yONY)E5?lAh?z zjX$%+6=?|Jpz~uC-Rc4ofkFS{Q$z{6UnA=2XHRWs+Ga}sbWac1)0G7VDl_rwlOq01f;s_ZQ*A)$TjxhvT13Qt~@AP)s@uL>ufzSgn)d z;hTk0mK^d}_v|D5N04-r*r__J$P|HeCM_2Rd0R$-(R}8p{Bk5 z6I_1+-5poFu@q8=i85NkzvE787K$9D%}2X`kqCd*ik)cJhx$V1RFXm;e<>F9TSzH9 z-&c%Pc!*#_doc;-uSI<+=OC3&?W2Q36P2vM=`>X#(5b;vW`h%P=rr3uK**w|w`>>p zRwv%t6{VcOWh+ByMFM^3?KjwvO6h9AZ@s25`#W?Yn~FFcZ7GZ6`H@v#;p(8bymNR$ z&-6knrw)H!NH;msS1zrx^w!I7P+>&ZK)JzXtYDis+F^1rC|Ro0SYC^N zH>B1XYRy)o!%${2vwv2a>WvktCTnUPXTez+spD*pR0~3G@Ix88hJMe1_hCMcOwW9~<&yCZXnrwcxw-#U}i7eD@8ISbwNR02Kp$@}u#KKY0`KsB?>;8cRW^z^RJ;^Fp65-zi$bDw3w#-36%9ey;Oh0U1>oCrtPAQ)lC(YC#U zgAtl^ozoYO$~H$^ncLC>Ym%7)kwe=YlldeJO(cEjkz>g{gAxRK*LgHRxi^i!9P3CJ zyVG*RXwj0s3|5<^SXf*nd}wSPnWN8c~M(ZcYhW@czF*;diuiTEqU7IeQ7mDr?j zNk{0HO!~sHH&B!K{kAwb`T<$Q-IOp^5F?=@kPdwm(xa@oAuX`%WfH%2t(XP-4`M*& zMM3NghuaF#@VOwS#&gP0;vUOv7$IaNYkyyY-PfX7Q~32l)edd>`cL`V-2aVAH7au$ zAZs&;-~8t495x5+`KK5U_Az+K^S@ilPbb!=0+cyy%Mnq5TUuVj z_4VOvPz68!Lm2J;y&OoRKYc%pe)xS7to#|Bzhi#L=iG9X!hj7N#Vcw9&DkbRRC?@( z_{Q6Q@Ib&K)k}inRTw}yes4CerahHTc_5^(oKo4`U>HrhQ}OgMzGsb*XPg3G?o&?- ziH&#s^trH7-omC9Y^vmlXlB+0E;s0&2c=SZS8;fq!AR5IiieFws3K+l){%bk^F#9S z-}OtQk}?`g&LN(8?}O`eF}bB=7?Ol4EuFysvJaO_Vs?~g|c9pU-y2;*GxF(S`8B}h8R zxRb;}aRNFI7+9A15n*98BHXIZro#6(i(R&u@oKI*A+*zCSE-tI`O_PS2b=@D2uW7H zy!#D8Bw2Lf{Ukd(D~_G6j)_~@0_;R-e(F_MrIr@({~yHvzmWfbR;K))Ecrj#>_5YY zW#u4TTSJj6W2hyNwh1w?QzS=ZPWv~B^yuJcMKpPBH`w0}ZOn;7FxGNLA~%i?N{Q&n zKs8WvY9D%c)|%!UYXLaYfA2eKYOdY|5b+`#rE9=`2B z3X`-v8uUnhbPxZgA=tc(jnkl{Rg)7^OHm#SeHaP#)Etb%tm{b9;Micsyf={4K20(2 zCdL6j%|~`3ooJ`4y(GU&NQI@HP>Fc)EQyBooeGIOR6QKoB_z?xv(b>z znRFV^Oi;9`#l!AYDV^%KwSkQrNqeaNyVwtsEMg|yu?VNy_o$HEwVCVN;NmExfQVgn zI9XQ|l!}7!Gx#H%$bKkyhe*<%1Xo#_R*H6>iKl1(6APy&kxW<~MP!$S-(SpfRGg*@ zUgCx>;h02^Zv?|D-+sh01e6hnrp2!3P?`H9V{ z<&)8z6^6zVPnZJXOoKvET@?{-zUp$+Uv)Lc29=c#xVmK6JzB_NZ-QRXI1&N-!^9}~ zF^=?vU*8j34)<^u#1oG{-hWGZ8W2~6pfZ8TURI{M&I#`O(%c;P_C$hFZDz$(IGlAn zc#YXJnC%pjZ#6%oKjXZE=)!z+M*<%$d<^sIE1 za(wAScgVwIx=>e-|6GG03Yzfhu_U2WDps&^FlyiIRXY2OC-jw%?zG{=gZ}Ub>k-<7F#;(03^{_|=(=tMS)z>F z^XK5upCk#|jU?}<`*-IGMw>E~ph4}kNEX5B6GAea97$Fvoslvg-v~=aqhW{cl~d}& zUO9?{!j7An#Gn%}mdeogihIl}=EWtMdO2?9@!TzOrvTvEy=^<=w00G=GhQuo4 z+(8m)=Qopv3O9@+-;WG>VR5&#lx-h~_jUf_0m{A2R%2o*4Pc)@_J>3oTJz|ka3Xm{ z8JjD&*&E=%2u${k{20~08I#B|#x`2cwcnmZ-0=#-zuaNOu$0bNUI8a!#8?oR_#bmwmA@|@C=JR5gKiYr!9ax(}=d>G^Gn5Kc z&LDDr63m%N=4eSE?HGT#Z&;P*Z+W!|j+BZCaQtZ@3o@^l!Xb4Q+MC7CAi8i+y6AKH zCBR4NVwWayt?cAo zEw+DNLAp)T;7Hmc+v#+=8qBIV7#y8Xx}nc*&s-@J`Yj-lVot^&dgiuNSho;$E0)=> z)SJQlOe4f2glgehetPkGs3bs6qA zyK8C;>iE!9NI=Qc}AR>uSFr*4}#+Z@x_|iWyl1KSielMu|x=Mm@ zFO^bat3?u;9FJ~wu1OrPB8_a9Q30I-bpe00Wzf0pUu0bg|uz zcI$@Sr~xB!^xyzP=&%gIDgApQt*}{p`WPktuDKz>yY1mHEgmC$xb3O%`!eKeyW_EJ z$*O^EAfk@=Du1NG&N|$mU711$<*vXH2jPfdPEZMO#))@_yzCrzA3tlTF z@U<=+tkquVr8@E}-^YOKhJ|HxwGIZ}iIb_jT|If2on{=oTu(|yH^Woe+sYb~wnGOC z*BD`wnRLaw+y+K85E%goZ}ygA!14iRQ-!S{F&;>bB9O;^DWgh!amV0gQ5dUNs-+di zGFvS@ab+SryBdk1b_IDvMZhe+Ec*{jEZn?drI!?yfi$=?X2odwCi`ARo()wiiVk#Z zR2a*#6p|T=Za^Gu`>V;n)T{pXYVrXad5Fg9&>GWRp8L&feCqMPR+5x4K~Gy#8dVsL zcAbgAni8S!Dsr28$p==+e)kruh%&GvS{gymeU=V+YY6qZ({dsFkQkEE*+sd%l~`;D z@ec7ED+1Mj^F+1+u7=TUXfRg5;Xg??Z`eN@`d>>H1`pi_h3CR8*OJFo{ASo%@=0(_ zJ=mE->UCsm@L_@&7JArs9Wo2f2M%6OYCMiz&OG_mTHBXH18Dru+Do9KSZKW zD{MU(I#0f)s>5KfY^vj2nJMA&3*!eZcwH8PRc-OK^<;-k1{^*VwSnk^MsbzUnF=he z=TM5rU_sp8O$2e97^c-?xc!@n;Wjnr#fESzOjv7c*?9D#T$hA(Vy@jpZexToRFi#U zu{=%j(t9)c?~I^KJCq!5wmg$jhjow476Tfeu`(!rB1Or=uqDjYj(}OWlESU4NSHEv zUGZC$f)~u%R+~Y2k;H6do1Gh7n3a+Pm3I-4MR}JUBs#dIt*y>L#t!nyB@Ys{ zle`eX@enW>r;<*!cC)b__Wv8DQ;)mJXY#{$T!DoV-{>H8qBUqy0)67YVNi1q z>7`<+8}IRg2h8`96xElj_MjrZ^IqBVh?AX`ol8)Xtn5X?l{TZ%sH-$NoYc@imZ6Js zAmM(pQ0W&vd_ReG-*7+iK=J%|47}!8^U+k!k7CaQXmIjNe*c5yHQ2aG3{wJeyiY5+ zc+0N#x`)YWc4dcaTp;b^HCk*-JqbJaK0?0W+NIx5ZM2r7f(I+j2v0jc0t1d8>>{&+ z!>oMn=w?KK(ORLiRdOW|W^E$9r`6~}S7X++I5_n@xvCYcs}Vn8oNVI@S0VD;V$ux@+zUf}pN)??NWY#J+$hx0FyyJhk9%i|)ZP3$AT1!tK- zxHOK=0vK@Q2IR!2+mbAZK0s>ZSvDRZJ(XF5#(EPMU>u`y_yD-<8pUt<0TT2V2!YWOk^TPn8V&Pl;`OWpMpbDkN^XX3ml;a$(D1a-S?C zbX8&xupS|I2Y0gub!^b3*Y||Ne|XT%?uhqDj@VsOxOlXujsfou%RWXke89)#SCz_N zkNLAsCoJ16rNG2byrKGa*C9I`_bKVqBe+d1*8)`f%WzxRunP51uPJa;NpLFLt*PNO z4=gpS3HMu*tGZb1i&wHd#ZR2ZycI>y{ulwz8Zbez?t~B$@=vMX*1LGINM3bh+a!zz zfAyIcpK<3=ayFFvl@@U1dTe0922>ux<;pJ&J~McC%o9p(RaqRu^sT|al%BrbC&*t) zUq$#A=sxOxAL4acu@H#(g1oCXbdP>P-cx<%-u-XV^@7Oz!7tHDMvq23eD)RTrVOE1 zn#^V$mPEwZ|EhS1|Bu&!)8=cE65Kl1^t8diugQ;G=cLoV42Q7y$soAq8)DH!?gYt; z#We7o(!52 zlnZKZsj@Brt0lAfpoE1)GJ7e%K@DA}SAV3-qQmd(IU5Thm~%&)R;;L7=E@tBn`@Xg zuWa0c6$8e(8s^Q(s&kB)mcPtlG}pT-=a)>Ln>l%U=G^RA`s$jogX-(X8}xa(nNw;O zm}?BPmrl<$n9TEMjdM+yL$gMAlX!~U-wM|H>!-XP+j~!w#L)3k3Kv2pN_82|c=#;B z8GC$!=2X-fGBtS6Jy@)^(y4=6zQcN+oN+#P#tX8j{t>YQtOABsdYv}*uF{!-2uL%W z_zQbJcyr(3(;rEh()s5e_7g(^G4IrjbQ^C;2FG%&%*nhpi-K^1QcOrfFPofx z%hF%@pO}J+<;$>QvTDM~|7C6u<_YyhLLjH}0j`7F6kCL`%*a*}SJ9M)5D2iSuu z(44;-6bDUVyNy0_+T9QBgq|UJ+`0!U5KYVgC(}?-+T^pt z=2-9?)9_zNXV`g;w8WHFC_?DzbT(MaA?`A1f0BzU=mhWl>B)hGPya%sS+JTh zn)0g3=+dE2ly3Ta+~&s+w0xf28Y(ALa0{k=($%Zu;mCQikCXD2dxSf+Ag)S}I{Q5< zrvWFnVD1iU?*z9K;W61`vrrIXf+M@Mc`Mhqu{e7IY!QTivUeQSEExc)Q>jozk|# zv+|G^b1!=bvIEvSg>e|Au+`)_A*cGrs3+pxW0u{9u71`%2G+J0)?cb(+bv8`g?r#o znBa+%-qAsr&Tma9@;+9*TD&c_tdzzCw%P<()KQo%Q)#E+m>hQSWlTc*yrYm3%Gd*% z99v~do18jpE#}y;zGuF4uSeWsFVjA1qtVaIfgeB9SXxZn5AV^sp{?r7nY z;65Txg(#&BTWv9v>na>&Rj{l8!#MB92%Z2-NvvR3PUAihD|p({_?of7$au`}aHR_q zU_iWZfU{Enmx~iHRxEDACr0eU;z+3p!Z!^65)Vm>Fv+t3ZEguV= z;r?X7yg=*lwbQZi?Ob-9(Sfy@R9DPot;XJ}yc8;{vJERzgdR}b4wb*%DMETv6{pxx z&@T;(kzn>y4h-%txMf)+rV3*(*)S?e71W-T&9yNwC{6GbEhtDA`dsoXRq4WcrWt76 zCsg`?f#8udnPUoRp7ZWq%<(bZbz_4j<_+$QdaC z;pv?Ngzx#t)@8NES{`LbE69sklW(2^^{MQZ%V3}WPePB#X8{4C3gEb37$|tEc)%f@ zkjv$}5`1B@uy!@rX%`VDh(xM))jIf+J%3^|g5ZFCe;$FRR&BD>I`DrGogq9GjG)k; z7Nl?z9L^A4mrw9vY}I(NC-|0Lct{=v;XoZ>W2Vqc2^8~RdS(isTRIc2OhKNPlqIZD zk?CDocpsU{K_ja=GaN~r(m6_UggEyL*@CA+7;r4GkSmyYMYQfjNQ7&1g%zsOSaW{r zK9CVbU{zO^%2}l^dBW7Jnfaqf z&CWB`mso2SSeBdY%d5%@^XrN#3W|!xPc57^enQ=(83SfJodfhmHTkpc)sqJ>Z`*JU z#;i>}c0)ylLl(n)!CHX3Y>aTI@Bu$W}Re zhM^)aXU5nWrhJ!qLAj+q%W0W5sd$oce)01Bs!6kLD`t!vH6yF2Xy(*;cDrH0jNF>} z<4xA0$>WN0=a=Oa4VXN-aAx7?qIvew6UJFanWj#HWk*R@PAe;Uxmbq9!K&CGpMvlR-53r+xsPNAnh4-T}$5;fxwBG=7>O-IBYvnSi9 z70oCq%9*&lZotx6MVYm(*>mQUIjRRtGCLeud6I+J0{ z+(A<&SSIIXk1>}|$eml9ZOyNmIH+z~mci&8HLl85=-;Kz4On~1}N-+g<$fVixtfrj2X_Hqht(xjsZmer?PM9^i z$l;nY#$H_4U>vk!jy`j2?%0O;*4&)p0)4@_*VE1EjMnLTGrk!5D#H0R_&;pJXLA0m>9*O^tl9Rmf*H1X^|^deO5x?jWW@4Xn5@oBCR|k@c-;PJgM|2t zWvWGkgjcyL=ue79YDOkza5U(+8&dXiE+`Zl6e}$2c>i_o+RXe1I*)g)LFX|}B*7iSgePPnv}m}Hq!b$73OJYtiWN&)-J8Db zlzKwS2*D=*=n{^~jSvfT`EtV$>%}Yy{lpcSSh#x?w(_mp(2=yHNcfh!kd4Z2PVyr) za{s*6Q!0Q*HGlh0BrJXcw+B%fDe&4TBx3$bmeE2|=&z(G8i4Ed#E)6+a_GJnD-Ug` z!OBBlj25aw^#-ap3FB;NwqX}z+l(x@cZ|U6=7r)EQQllEa`R95=<~-3Ayg>#!bugQ zxEGGYqi1iTmDi*VAYM9N_(|Sr$Ap%!izo$mWP%RT!pZo~xalT4lfUf0^zK*FXfd>z zl~-4hXEl~jFPLa@jVoSSp`Sm>xNP}cYr~kiWwlc#6fT%oQZco1OwpiOV{HZYy1aRV z8Y&%ibEfCimrW|0GTS_M#^|YamHG2Bt7pwNSW4Jkq^vl7RIp@VygY*dUBJjx0p74mJ5wNj^_Z z7K&tpF2MLXJw*swl~Gg8gYTyb2QOscwXVuRP;@oANu=q*1?5Yv(*<7Xuf;dXZ7KG# zzw1kcxZt&1G#BqliSx(Uu&ikpXgfogpt2OE%@E{tfB)8Pohe*g^9(4NgJC^v{pIt6 zc9@4=5Nrt69tO@5E-iD>{pl>h+te8wT0-I+;mSo9e<@rBYZ-Bg`N~b?nTSFLrE!HEe|3rTPzfD_lcIU)MO6W884Z2 zxX6KyO9W3LGHe%}3?D2J3YtpgU=3M43Z|a@?b9-4ZB%3HfE;AcZSB{vZDr1GN zl19vL=N@1Xu(cw8UEVf(VVR%{j{FIIGBa1Ou@7_`whwvmb(tWyVt3;{RFVI$J+N6T zO;xzj(A9|A4ENt4tD|q4vEFyNAi2j^3X(9b^){Vl+R`ishRO^=8+fEz*dkBro)-_* zCSh^wbn9>*HVIfYjl0IbTZ*`nU=i_9&JiMO1i67E>!N&1E3NctvykqgJ8TR7b}Nng zl2z#LAN7e=Z1N0`+J!T%NDvrra?wr3sWL$jhu0Y7mk@h|I_ciZWSD*vQp+t);XrU5 zPaZGZ~Za`7TC1{4%gstOI*Qx^Ju%+6p0f+=BP9fiug6 zX!j$_1*`$d+0AuFu)NRldLgBC&K?%uBE-6r8oca`va5x?NEfuu@a~6K2v~{R!zmKr zt1E?5tur!wepSHzN?{FR+d^G8b0 zqr(q-i2S+L!gZ~}uIRz}Ni_AVHuPXArsZFYBIk)U=$Yaq$1WGOm$#uC=BLBKzX^%0 zw8h{5%}aHFQms9;8d6~A4d|~qUMtkNpIR$CNT#-)EOFFYd66(KRPhZ9VE^^rfQEN^ zH%=cds-gExciLHH-pj0*>6T=I4~tp>ZZ+Sat;(tKxeI(W3K>;J!W z7w7sOD|{~7PVnfDVz~cg-r0m02j9Jr`HmeBGIHly3?{Lgd2+Lm)k;^SFZCV}(;~XV zl3RtFTjgN9dCV#+j5lKlTZhOP-i*P#1(7j}r=hEN^A>?atuMYqfIDhyAQNi`86X^J zrENL~UQR*-dx=A@{pjQDIsjp)k<+EN%KeCm#ql1Q%$`#v%tT36EAuE9q{e)QNcII&60sWbQ;d zU^Xty*(u0IuD6x&9QGQm+Ddq-6Ke)=q{Hc*0&iPfj&u0^82o#mwZ|To^TmUT3QbTZ zSf+@n^uZxf?w{{wcTQPz!q*Vm=di-2&;#Mxdxh&%{;I4maF;Nx$8+$%-zTIhEA%aO z+N^oJ;{&Y^kA&s-3#(-sS=U#JprzBptUfvkd}sU-duQ|qwG3yV>6K<{f#XG3ziz?< z!gl`7{x}c+68qS8gY(y6fscYm5GFP8L1DT|qwxUWS%^_CckOk~E^3;XC(WEbZ6=f) z#SlL4c)fQQul^ZFAAU4H;EL?Oo+R|ZbN5}1W{$UsYPWYkD9GI}aLCTE?;&B5nt*J~ zqh>VlDoOG+^nT)-uIa_IJ&}K!t-L)!N_-{5nAh=z8Bz82Aq<)w%)9f6@b3l4igD+A z!SE{(pSbK1#3w%YC+Wz}V5a}}xAY8}ojCweh;6Xi(7V(0p3Z2ygbcYu)bw50TAj6* zW4y7)#Ah9IVb*x-X-)U+@idRXc38Rn<@;O0hJvN`ieBblyLlCk+)5(MC&L z$${jiQYw%)kYpqD@_gKa5F-@(W&Zl$W#>WM@Je+&*6GA`YsZ8fT2#>4P5A$iN zCRc7owx;`Q>2d?zb9(~puoDcV?G~QqfnR#pFKuDr9>Ef!h~_U{P7jpEvYsRRqY+NbN5=F=B4XKhHzJRSd|KGfNK?yM zsl|{W@)?vr3%jCxjkp&>zERHzuQ2bk2SdB07wG`RE%a9L+&*sMoE#h<{~k6n8~LoT zU0J)`Y^;-O?f6s4`aCBuRSR#awNyQhDc6nr6T{M17h;XOxaS3fdB<-Ci>2OsatzVgRo+B;6s3=FP$m4)W`ogX(i1~+bul%ZS z{zI6rOf|4zM|OkG)nI1{GYN2IA&NEEd%}DVut`JI2TNPEU_n0wb=eJ7GQMj5TEtiN zdmnM`Dt3STeY7eWTX5g?Pa%VZvU3V=??liU#EuP7CBCAsP;sU`i8D)jd30Yy%5F!b$hXVzaU> z9|dZXZRUwRLzz>NXLjM7sMc5L>@`(DwulqqiBE*KFyuO1z`ydavFWyt184l=WAvzW zySX^$?QE%~#839=|6CU*{eb;*|O#d)g?M zfaD0jJC9xf!GP(X3p+w^-UP`Xv6#vo@J^}N)z|Wd7v_wIw#S9c5D+Gs&4Tpq5yu&( zpI7?4;)F1;oyUy;({3ek6z*m+LkmElshh*9uY@0i2mdtnDfgBC5iYE>QuGiOGW_N_ z5`{M@2hM&iY~bA6?=`WQtR{H36pwl5H@Ho_D9g%kg%qt+X4Un>5iD?oAQpSE0g=vU zzZKM#Rk8ZPSMmukl_hu=Qq31-D_((qB?jK455292pT8GC9vv$xM8lIm2q6@T(X6Wg zgHK`$>4L-o06T8 z7w91LFadVk!_wuSu}jC;LGZj0_kuGF703j(AF$2A%0^v<(aufrYkw4u%jb^$n%dE6 zXA+_DC*g6HxkB6hH96f3Y*)SCH_yhVq4aUtAjRy9&t zzsq8?R@o}b7<@DiMxPb_E-y0aXQ5#z=Y2s(_3#?`IbW2V6@-n4Ex%y`<;HDdhrryj z16$MKv!8{xI5jcXynFvILJsMs!7O0)b|EHkjNQfEXv(%2_~AFmaVZ`z&9Cr{)|Z~sA55|>Eg8kOc$Yj(-%I&VIuZzFn= zKHhI5e$*@Isi0()%M&YL+?HCGr=a@Q2NC2ZwG(%R2kHq{xg)`A?Zm$;HM^VIi!Uob znH(nm>SHzuVCx{3E3+1@2CJ7b5I9!UZzJzY*XUw`$N`*F^1N_LmBm0uhSfnc7h>^z)oyGQH z>8uO^uY7TO8+s=m&%)fv&hv#-J$lbt>^}=-XSD0?_|3hGDe@80{EzmP(phd$E-a1^ zGh~O_JrSZ@SwXAL4KH=96k6;&Fo#}_r>5rPapy*g4{~|p#-z~2WI)q5+w(iKfsOFw zXw6c6Rr;asHYxG{v27}U6)bCLG`KtV5K$)#phv3>jx0px>vz4+>51pbPxhCdV$@QZ z_!Opr6%|~sVZi?ONyH$8I((S6X&Ti_{F0HQ7Ltak4b7Jop=o#NVL)&3zw!%Y^$~B4 zRlKYNJL#ELc;XGdT$kd#Vk!*kE3Ut|%kXYr+*El+?9LkjAEZbT!!;CnO`8)t6q#*R z*nd3%Zk~(Dh{gTAdezzf;th&h2v-ddzmZiOY+l<1I!BRkm7cq8pxA;I>k3uOy4;C= zW}eN;!(Tge;sa`b?AVN!46j`L`3&)ZylMZ?i;F{1M-;AHTiH_9*^Tv{R!B1aWiFc^ z+9JT47ma0IUPra&O$n1eF*$k!Sk9y4phJHWfD~w9Z7D@1r{=cdve$$UaUcE%)z?P` z8VJqp2g?SnKtPlOn;qHI@~CyHq=&d8m!-OwLbH+gfQ5)swO2Vvy;r2?_Wm$Vrd zayU_WX%`N{OWPWmpHN&V$}nDt9xTR(fMyO-9T{WzR;;+l>N^-&{n9H%j$-RWH8zPp-wXnV&A|@(3nb@pGx#=<%Tl`37 zaqWkR3BkSgn&J_=r7<_~$YJ7PIqcqRxR^LmEUuM;VAfUxNOI1`J6T9f}|1Rx!^u$?J<%^ihsz7NV+0%XQ&X8aHjkCly4g>9*sF7 zkv?2X|50L{TBhwBB?d25r9mTlJAz59bmco;<%Y87MvF#9fm#}Y=BwM0s4XVC>|N~J zRVZe|Q)5IA%(`Z*7#ln)uSr!nI3h5hC>{-#W8a}q{iCrSBN8@^6XS!Qnx--Xd&Y_X zVK1*mJDTf*yT^;C)JL>&g7~z2ujWn^`>Ir)l@pOrxc<6+lDI`_GY4XNMo#vamGtUK z2{2)bSQ~sRHD8twp66|8_@*MW6f&oYsqQzXik&=);#bqe?#kc>|GC_?j>8jrO&9lv zRIyrfQE+m)7;@if1+RBMQ7n4O1qPUm-njKw!A@0sRr_X$&xan*P#}iv23NHXvF6wl zI99HE!-MDb`;cFKIaAi*wa86-VOP!)FX*bbVz&4id);IWW-BAs)YOJ6b=hElGNLDW zTPy1v5tLq3_BL?KIPA&Es(J7?Suj_ulnEFyZ7Fbiu2>j~cC1hf`6jWrq*6DwUn+J? zK_Niqi>LWY=?A~WK>PyH6+Gn0YE)=)Potw!=WLKcnOGrFhCl;0)!e9b-(uB2_8>

GX7saJ6v#g2qP#-BkILSWha)Vr-3P=)RjREbK&?RY*xmz zOJYkEqdu66=`^=@lOk12?_jCOOJ-QmR%-m zjfqt&^3=W4!%73{qHin_=d&9X3SBEnuD?O_AqoZAZel$k_d~{maE3A)q%jWfo#=bQRdl?p&<5(XJluEBDTTNR~?$t5;Tt$3opd1s)I^3Ylxs zCkQ9vP}}1g@>52Umm&(z-IT#O9LnWtfQ@G4T`W1Tp;D9+@d5ib*@G*)nEt252jGD! z@c?^AEs{oWkTyHFSBsuh&2c7ikce)qtvki86Ij$(Ucb)8N{(wSB=9*UUkE+3p@&Ze zZGN=YN-)T3#xJiiGiN+Y24M){*dj3!`kRrb@rcnBGe(SVTZ@1=rch1rBoAaWo_Y-e zn6NgW7Bl4pB5$yA;~?~uhW;V!+$H8TbZd6QY~^&>_3`x3CvD)IRium>wKyRQ4tV2M zP0JVetv0cqPJiks---&LLB?EycvtCC=YA;%Q$ z5$q_O;Yc4W>cr*o@a0~2sZs!|r=r?Vu0`JuH*I-V7Hdea z?DgS;_-0YG=ihZBj2fY}F);o*&#mA|z&G3#2VvKXwWBrc8O^nMr(yVA@*gsuO~UcJ z9=`;tIN@O3hD{sZxlt@EX@zN2@?+CHsXGk2NerXktmzB(o3LfW-q&N{(VOIpIPFqr zY-+m3Ubve$Rl?RA#Lkd$Ct9C9Z;-oeUA(!8=NJ#i{>09@)7E)?g_t<_57>2pgykrl zS8US_We9zfvn-WM3=&?SpVPEF(j1dX>7MlTYgqGkA0~3G+#n8s{aw-i$h?oVftNRk zi)2U>-pDR=^W-iUk|GBla!}pcTfA>)+bD)mXB!K5^WNo3<$u#g@kyDD%-JLk4qf?I zj6(N}kAo*Ri9f5?i$$z;RvYg@eS8G!LT5LN56ic${~^?XisMi#I!wi`q0bv1=zQc= zvhBKZv&~A+{AU7;yH&hLb-$186_e<1!=soRHU}nb5oHLi-~HnLU<-yC8E;jZu$jH0GRolea(04*{0&x2_@tuo$3Ag<=k&ug>cJDUKo_wYX&ys`p zKe!!j166`a$ts~6JiQ&g4)~IZFm9L-4qx7hG2H`qh&`0p3T)zLGuIh)<;!W*cdacI9){oPwf4^5DJEU26SeDI;va0gE}qSF-ywc1lX8chV$!fCV)_mQzj?5}>`x7~ z9`rjs`{u6*?=bRf6ZtVBHX`npwFfP`EtnGsj@>ODmlu5G9x=wF6DvRn4wJ=UsPwGa zhd^kW&B4ig5DUl!=dbsQLzNylhqDgR$v4Hp^!vnvY?~)HD?L0-%!Ut3Ey(DvwMQy; zjIL%0#@;U;QqIhtk}K)6`%ZU9w1K4$h}H5!|NVfNtYQ!3LGi3I(&RK)c`0b_xi5N1 zlrym5$A`pUmCiDJkYgB~j`EfiNoaA`Ha3qencBOFXy_m!=9NqY03{*eDxM*7; zitgWsmB=1JA+q8qViWn{R9%J1KMy^O;`Nso#i&8)rP;jxyaqA)=krci<}g6kW<(?Y znTWBHJ-g5gSKL*Mh5zhAN7|6F0xu9CPiK8pOoG)fpsVe*$1wFM{Bun5I{YZ6+?-oO zVzxepeyaA5Auwd_=Oh^>vcJx}E5?!Rt?~G0sO4_614TfSt1V}kxxl9`Yl~k6r1Qe{ zlsjxrr_O0NEa$<-xM z>RHyFK)dXh$5AQ$`yMeoA)U46^Ow0O#po}t7qi?>??Gybdr6G!z(~*Yq3%iiuwg$| zG5xeG46ILz2@5#%IxM|eJ`n`ybm2P$b|S_QFYCYc-IHP;x%F0`Mh`$#rdqCyAgxBg zs~u5T?P)~%mA)o1h?)((_bf7Cu3zN`5}wAoRB?pMN}`I?$qU!Snlz@!vC74NlD2Ty z(_)(3^!9_N6~1y`3&-ZWQnvV@M^K}f{4U`|GeXhJ6hM&+ zUl5Thm#ZyZp7wEjX1)Ngd08MU!HyZLfG5j%gb$y?3xI8nqoC9CG87?{T~612SAT*f zR=#Khw&%rm^ri!SVdwK=Upn>9SUC2)Y~0DW4xz_`;GP#SooC)F$XX7+fU%#ALnUkn z@gm}COXH9R(~E>IQ2e6UHlF7XSPU*XwSbp{C}jL)*^Btt;W%;P08a=kC^z)p(;#fy zYEu9kJt+ozF?W4`7!v2^y#YvkKr5p!tU4jI3uPCBof2XnvFPS%1P)kVLi@1z8MF@{ zeF?qBJ~X|}6R>Syx|)Zra)}=FfBk`& z#vNR|p9jvI0%f=2No+k3`UMF#$El&1tiY31bT4};$@a2`lDK)~@5{NnQB3R?+NpX; zT4@q?dPVfq1WtTa>>k`=(ssrby()UT*NuElObG5$4-$$pye57!rU|3Tuk)~glILGq z+A1swL(_Tj-w{N|%9qn=U-opDzAknn!Gmwz6*{8RXsu9bjoq)rsxV34BG|NFGJ;L9 zA$&6Z{kAwb`T_AcYJ6?rm5!wg$Eq-v)mABo*G@+3-9$3lg~Q4@WdU7KFtaS4ai~~0 zc~D#!sUCzH?&-~%E*+6s@bcG@1>g3zm=P-YOJzPCep_@a0UAz!i)OHQ#kl)N?}(m8 zZhkH6Sp)hSkGw064uxGRvVc6p*Zwb+r;rxF+udBE5~IAn-HwRAt4z~s15NuP9{*KrB3=`^ z`Wfak?|Z?g4gVAeD(S?H932yxxk38!2Vycu%3i$d1vxc`6JGQP?$aN#^aAFn>f#F; zIjfCk^KzS`0yb5M6JYem;w$_Ke>oqgsgnC-Qa%x1S30horYbA;X*AX&M4>--T($pH zRF^IK@Kf=ea$n%kXBb%IrQi=86&I_%%=lbka(#U*f+)xyOp$)ZVddH0#N( zvPAshN3kP}KP^7OH-zr|EE3*1iYD2wYtWbRM;|Q4HsVZZMOzf5QhYNZm>JbqB@5<> z4YyaKiMxM*kVVgZmIWJoO3`%qQCZL6BKhbV5>0m;ZQBA}LvfScfN$oZ{-=HtlSA38 z=3apn3Rb>?++P|i@_G78AAVMhpnH=rNusl-m>PeH7Iv3bAm993sG3?!KKi4#J{j3d zDQ`XGWK*H0FLSa`0FH1R>b+XMwCgN;o#$9 zrxp-LXe;<%WxF(cxVV70aMgid7OPb$Uz?_i%bt4^>LOH~eE&ah-~S*FC^S-S4c#ZS znJz!H6eKxX+9)dv2fet(I@N! zN4PI53|@+n)ES76bdw&JD@kdEhO8Hn}J*3VT-x5VU=;Pwui*aj$FLp@77bg zxC+$nk9*=3XNtd;j-`1~@D7{oSYfCFPHaK6$LY3+k;T_)3sZVaH8O3z*;`6f_6-B; zCNVCvMYUYLL8CAq0m7yk80MSs6Gqxb?h{dGPeApOPd&Mh!dEq%w*JNs~h0V57>a> z&sr?Q-1VWpa8M`h;)DA^fGz_|d4u6=&43=-Pyr-cr%emW)v?3@+{w`WT8RyGl-YrdLk(8JSK_0h47RbtVdZpKVU3}0ZI z6G+UGew1H6Ia?|U9?NW=SD;PouFCe=a#!X^Ge-qou;y?qR|+;6(P8MX_;lKWK7hWt z(mnh@{SCY1yeheI!k4+yo&0NmvHZZatIdz)01guaU*<`kGLYO{ydz)IsfY=Q-nnoe!$exbTy&Jm2%Z`!=mCTJ?P1>#X@}ov%#1_N@s<}63;D`W zsmDdatlfwkkkzC_K!5-e8a9~IN=O={oipdMQG0LfviZIQ9PDt-aOt*7&XjVej_}>8 z+>z1@En8nx0J>N=C3N%HYD}td4PdTUlB@uo8Y%UV+3l6nNonZGUsf!k@MVl$$pekb2TD(@?P>{u=W>|?>C7prV-^E(?W27$vBu}TY z(%#IbJ%gB~>;0uu=@h((%9Vx9Bz!hM39BAeR$EyKWE%>>9eL&7AU~()f#IWN1Sfh$qdOAWbovBn=OD9Ua9KcWoWF8y48Fe*S z*q?>j1J$pl_Z${Xl6VGoD3*be&p6@qDO3kXOqM+LkNQoK?rcgfyAbP$9EvTd0;9xw zTrUg$a~T(w?)g?Hm+cCC$n#MX&+?75WBCW2&1&YDGw;Ayi-S=S`%d}0W`}2m%N>X= zb{Q*tkc6P(H!BlP%p=h%mGRINw1(MrbswK9<&$dV!N|LS)77z;WStDv8)4;zECRj> zQCzZO=L6Xm`=A5fO~uKScRsjg1+_;>oHDWC@+nsSJy9-`<%V<>voi{yWG9wxxVl(E z9Mv7M@MN*ag(`CtmN(+@f++U7C3zz*Cqx;sPQuC($~C z%UtQ#OH;ov;qxpTLCdA1t*FB-^QAB4_r7j{RB-7IGB`CAtMgzRN~)~%bmR&t*1hfu zsV#RECBg#>r5-9~@a974tERbOIlKQzuX-2uZuN0Nr_oVobojsW{5!Ox!=8#wDOjES z9HG|Y&0wp36%|9FR06iwgBACt*1|auTU!XC<3O&E=zgJ8!gjG-N8y$w%J+_Nda+a= zDKk<3_^_i?O6tL0+{b5|kx9#zc=#x+F-WdZB$EPdUu!jCp+Ic$d;uu0HR8fbA^c65 z#MAbYG<1U0rkWF+ESK&GsWpwJQdevB;18i_Ev7>;%n*E8A=%^usWeIi|&Pu60Jkvplgy$((lnSu_840{o{+ zYDt4bU5l0k8!MQjG#krGJy(dpUEIJv@c5h99_-O-+_s7LlBiI~TuFPUs-**JF1*_$ zd2%Yf7DF3I941C8L%FpM6L!Q@iQML_fkG``uBIsfhifi0(=h<=Db#=~%t>yV1=Kps zx}`P~lw_dDVbz;rJ)crrNO+3ya3iEvZ~u ztGABIE?%CSpI=i}lsRSW0`t-d%O@MBR#gCZ1Xm06HMKP%EZQpN}IN>t%kHoU9@$b zijY=m|2rp8ht5F=Y2VH#-E+@#&)@&|=l7HC>6Z&#b8Th5G9yE1oIAc&JjZw8Xcc)k zbkOhQeB!#TLMRLZET9_V9WEcQwoA@^gtI&UM>yNzE%!#paIbTg`f`9h+9;A?ExvS9 z*@K_FrCdcA#py!>_{a5DWZcPf>&TF$!7pr8ZfHgt=;1kMV(%34v?moowev}d$^qY) zLRaSc%R6k#qL@bl*Wz%v1S~WspF!?>f>G*dj)k1$oDbmN?uF#R#b?mWLiPO3ee?BF zAjevRyLySf_8!z4l~AWk>Ix)K+tjo8!R({rtFw>XNs+DEkG|150z0-JzWy7}wG_^s z)U7mBJ(tCok0~~YAHJ@`yAGhAv>bz_(_nNYs?|<$N@rKQCNaXm$+$JxKaEbdhP^p` zR~1F`8XTlkKidioI&mvMEX^OOm(fO9A@cWI*hs?6FTh^{|fHI?=pm9IzL(*ssQaJc?E?(A57t+DiM}i|uFw(W;dI>YrPpSc{h(Lw}NYOeXB9U575B zUmb;$mz%$h)cy|tsE)EP4KEY@w8^ao`)vxHdMRceg&bq~Kf9fT4MGDtC z;cX1=pgI~%eE9@=xViVl-AxbpfQW7_l*HZ3p!E7=9I8eqUq(M&TsMNf?qsbS?$4ePyl=b>}EcgUjOI5#XT&mO>2k@=0{69Y>=9RaBDx6-jjv5sXm2Vg#Nw+ zNc{N1CfqoKZnPBFnm#yivF|L}8eDXrJ3745Bp15Xo#mgsujxaX=SyDo;AP+X0A#-* zgG|Vsv7enquSim?>agf9eBU0aeHagX1uTfh1IkcB^%2(_ch0=kJ?kKJ;$%oGUh{8- ztLYn$vs7ZpJ{*dLqSb~`lV^jYnUQ+6G7;6ehRp$u5KTrb4znRt5PvOCPOA0 zPEBQeflwsf(Aaf0dOR5!s#Vj;TxE<)xI&dWz7E~Y;-w4SGcN>|KlS$HpO?)1?ac!N zh^zBZVNEL65GHZpmt-&eEJI`>-7c%a9W;qAl{SVa#&deF5OR9bbycBk)71;9Ow6cd z(o85rafWopr=o@mk>1*|V@zcNWl2|wK{?8PT%vfjNQqHXU zq^yu{{osd+wKHcvE#CU-7YC9&`xEaX@!8AT%?n=vt6O+WO^RPX`veQ~%+eNqYD$=_ z=&dx(g`;u%=#ZZj?c!z_KGut&+~w~aP2S3Zso>Z6y|yWi&^^)H0^>QAs|*$bc-v6ZPEeQ75EK8 zd070s*dtyltP>yq>yM;X_$|$zS>mc4%Q-0pt>EQlZy+FJb&ys}6D>%d{$D7l)zI4_ z!*;<6=Px0$B%gxF(rg+Xan+qpzmrX~6P7^9Tl84zx^0ru$JwwY>-3Vt28)^1^Yvgp zGn%XM#oBnnWDuC7kzpKOQ`q4YTp<-(E~_+5#=sWSZWSJQ0z0uftq35#TKSQc5{ei zm|<_USmZ`SbSCED^Nich(6KnhsN5FQu*t$iix#InXXd>wJo!GM-Y-e2lx*BBNh{cm zxjZD)z<3DA}vdp0fKq{nh2dSTbAX}=c6VN*%mv;aah6KFWxrZuJ zE?XW8Znl6{WY$?Je(!HT3MB=5i%9SmZNV}j-=?xCY6l3>Cea2))V;6YNIx^^S z=G=OnHJfnKBLQ9BFg`RW_((2QHrvMwCV=+ZL3V@vk!VHmeoDEaOP;ydTkOMouL1^y z=_avF%Ehlhun=10wr^sid7jey+*1?d-cl_kG|JAfg(+1$)?z?tqz0!V8m*1CHDY<1 z3K%uUNg-GZq)lc=#+jh+W?&OoMY4;#~z+Yt5_SYKXOj2lCRXq|@luM_w5uD}O>P4qXH8x==- z6?{=*%ylf61w#@~NkGK&?+l0m+!fXfNqs(*@EeEtiajuq)WpoG$=XQ1VI7HAJxFzu=*g%*{qHnZ4Iq1B8;e4ye!h!~du4b|PMDu>lD>sWc~w4@K}tbndZ1fcctyE;WO`*}zFC@+NqTOjSB8G5QBqZSzL{5U z>U2haHks)k-m$W8-#49=H+uWk|Lneu+gJW%ZBX1EEW?&BH@$Kzqs(;9dM2^yH>}vy zr#D1#@K1L5%Rb$QlhI_lKny$Q^z*iC?9<)282Pu~=Vat%oW9PIjbr*OUPi9z+}w;m z!M>mF@R5~&`(9f%B}TA;+wa@46*Fzmb7brMx!ur?{iGYjo^P$pg46%iF=bA72?B=A zoO-6J=?6Xo?a*ms|2JK^gZ=gNr4F33(+%2Kc&2}t$z(R&;XkA9_6dFLl7ib$E@0=0 z->$^San&1Q+IJt0^V2<3nfHLrXkYHfv3 Config.get().limits.rate.ip.count) { - const timespan = Date.now() - limit.start; - - return res - .set("Retry-After", `${timespan.toFixed(0)}`) - .set("X-RateLimit-Global", "true") - .status(429) - .json({ - message: "You are being rate limited.", - retry_after: timespan, - global: true, - }); - } - - res.once("close", async () => { - if (res.statusCode >= 400) { - limit.count++; - await db.data.ratelimit.global[ip].set(limit); - } - }); - - return next(); - */ -} - -export function getIpAdress(req: Request): string { - const { forwadedFor } = Config.get().security; - const ip = forwadedFor ? req.headers[forwadedFor] : req.ip; - return ip.replaceAll(".", "_").replaceAll(":", "_"); -} diff --git a/src/middlewares/RateLimit.ts b/src/middlewares/RateLimit.ts index 09d109e1..24f4013f 100644 --- a/src/middlewares/RateLimit.ts +++ b/src/middlewares/RateLimit.ts @@ -1,45 +1,8 @@ -import { NextFunction, Request, Response } from "express"; +import { db, MongooseCache } from "@fosscord/server-util"; +import { NextFunction } from "express"; -import { getIpAdress } from "./GlobalRateLimit"; +const Cache = new MongooseCache(db.collection("ratelimit"), [], { onlyEvents: false }); -export function RateLimit({ count = 10, timespan = 1000 * 5, name = "/" }) { - return async (req: Request, res: Response, next: NextFunction) => { - return next(); - // TODO: use new db mongoose models - /* - - let id = req.user_id || getIpAdress(req); - - const limit: { count: number; start: number } = (await db.data.ratelimit.routes[name][id].get()) || { - count: 0, - start: Date.now(), - }; - - if (limit.start < Date.now() - timespan) { - limit.start = Date.now(); - limit.count = 0; - } - - if (limit.count > count) { - const wait = Date.now() - limit.start; - - return res - .set("Retry-After", `${wait.toFixed(0)}`) - .set("X-RateLimit-Limit", `${count}`) - .set("X-RateLimit-Remaining", "0") - .set("X-RateLimit-Reset", `${limit.start + wait}`) - .set("X-RateLimit-Reset-After", `${wait}`) - .set("X-RateLimit-Bucket", name) - .set("X-RateLimit-Global", "false") - .status(429) - .json({ - message: "You are being rate limited.", - retry_after: wait, - global: false, - }); - } - - return next(); - */ - }; +export default function RateLimit({}) { + return async (req: Request, res: Response, next: NextFunction) => {}; } diff --git a/src/routes/auth/register.ts b/src/routes/auth/register.ts index 49a3bd6c..f39206f2 100644 --- a/src/routes/auth/register.ts +++ b/src/routes/auth/register.ts @@ -4,6 +4,8 @@ import bcrypt from "bcrypt"; import { check, Email, EMAIL_REGEX, FieldErrors, Length } from "../../util/instanceOf"; import "missing-native-js-functions"; import { generateToken } from "./login"; +import { getIpAdress, IPAnalysis, isProxy } from "../../util/ipAddress"; +import { HTTPError } from "lambert-server"; const router: Router = Router(); @@ -34,7 +36,19 @@ router.post( gift_code_sku_id, // ? what is this captcha_key } = req.body; - console.log("register", req.body.email, req.body.username, req.headers["cf-connecting-ip"]); + + // get register Config + const { register, security } = Config.get(); + const ip = getIpAdress(req); + + if (register.blockProxies) { + if (isProxy(await IPAnalysis(ip))) { + console.log(`proxy ${ip} blocked from registration`); + throw new HTTPError("Your IP is blocked from registration"); + } + } + + console.log("register", req.body.email, req.body.username, ip); // TODO: automatically join invite // TODO: gift_code_sku_id? // TODO: check password strength @@ -51,9 +65,6 @@ router.post( // discriminator will be randomly generated let discriminator = ""; - // get register Config - const { register, security } = Config.get(); - // check if registration is allowed if (!register.allowNewRegistration) { throw FieldErrors({ diff --git a/src/routes/guilds/#guild_id/bans.ts b/src/routes/guilds/#guild_id/bans.ts index 87d2e7f8..cf6a059b 100644 --- a/src/routes/guilds/#guild_id/bans.ts +++ b/src/routes/guilds/#guild_id/bans.ts @@ -1,7 +1,7 @@ import { Request, Response, Router } from "express"; import { BanModel, getPermission, GuildBanAddEvent, GuildBanRemoveEvent, GuildModel, toObject } from "@fosscord/server-util"; import { HTTPError } from "lambert-server"; -import { getIpAdress } from "../../../middlewares/GlobalRateLimit"; +import { getIpAdress } from "../../../util/ipAddress"; import { BanCreateSchema } from "../../../schema/Ban"; import { emitEvent } from "../../../util/Event"; import { check } from "../../../util/instanceOf"; diff --git a/src/util/ipAddress.ts b/src/util/ipAddress.ts new file mode 100644 index 00000000..4467caef --- /dev/null +++ b/src/util/ipAddress.ts @@ -0,0 +1,87 @@ +import { Request } from "express"; +import { Config } from "../../../server-util/dist"; +// use ipdata package instead of simple fetch because of integrated caching +import IPData, { LookupResponse } from "ipdata"; + +var ipdata: IPData; +const cacheConfig = { + max: 1000, // max size + maxAge: 1000 * 60 * 60 * 24 // max age in ms (i.e. one day) +}; + +const exampleData = { + ip: "", + is_eu: true, + city: "", + region: "", + region_code: "", + country_name: "", + country_code: "", + continent_name: "", + continent_code: "", + latitude: 0, + longitude: 0, + postal: "", + calling_code: "", + flag: "", + emoji_flag: "", + emoji_unicode: "", + asn: { + asn: "", + name: "", + domain: "", + route: "", + type: "isp" + }, + languages: [ + { + name: "", + native: "" + } + ], + currency: { + name: "", + code: "", + symbol: "", + native: "", + plural: "" + }, + time_zone: { + name: "", + abbr: "", + offset: "", + is_dst: true, + current_time: "" + }, + threat: { + is_tor: false, + is_proxy: false, + is_anonymous: false, + is_known_attacker: false, + is_known_abuser: false, + is_threat: false, + is_bogon: false + }, + count: 0, + status: 200 +}; + +export async function IPAnalysis(ip: string): Promise { + const { ipdataApiKey } = Config.get().security; + if (!ipdataApiKey) return { ...exampleData, ip }; + if (!ipdata) ipdata = new IPData(ipdataApiKey, cacheConfig); + + return await ipdata.lookup(ip); +} + +export function isProxy(data: LookupResponse) { + if (data.asn.type !== "isp") return true; + if (Object.values(data.threat).some((x) => x)) return true; + + return false; +} + +export function getIpAdress(req: Request): string { + // @ts-ignore + return req.headers[Config.get().security.forwadedFor] || req.socket.remoteAddress; +}