feat: added support for limiting the number of attempts (#59)(@sviat9440)

* feat: added support for limiting the number of attempts

* fixes

Author: sviat9440

examples/auth.ts

@@ -1,11 +1,11 @@
-import AdminJS from "adminjs";
-import express from "express";
-import mongoose from "mongoose";
-import MongooseAdapter from "@adminjs/mongoose";
-import AdminJSExpress from "../src";
+import MongooseAdapter from '@adminjs/mongoose';
+import AdminJS from 'adminjs';
+import express from 'express';
+import mongoose from 'mongoose';
+import AdminJSExpress from '../src';
+import './mongoose/admin-model';
 
-import "./mongoose/article-model";
-import "./mongoose/admin-model";
+import './mongoose/article-model';
 
 AdminJS.registerAdapter(MongooseAdapter);
 
@@ -33,6 +33,10 @@ const start = async () => {
       return null;
     },
     cookiePassword: "somasd1nda0asssjsdhb21uy3g",
+    maxRetries: {
+      count: 3,
+      duration: 120,
+    },
   });
 
   app.use(adminJs.options.rootPath, router);

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminjs/express",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "This is an official AdminJS plugin which integrates it with Express.js framework",
   "main": "lib/index.js",
   "scripts": {

src/authentication/login.handler.ts

@@ -1,6 +1,9 @@
-import AdminJS from "adminjs";
-import { Router } from "express";
-import { AuthenticationOptions } from "../types";
+import AdminJS from 'adminjs';
+import { Router } from 'express';
+import {
+  AuthenticationMaxRetriesOptions,
+  AuthenticationOptions,
+} from '../types';
 
 const getLoginPath = (admin: AdminJS): string => {
   const { loginPath, rootPath } = admin.options;
@@ -15,6 +18,48 @@ const getLoginPath = (admin: AdminJS): string => {
     : `/${normalizedLoginPath}`;
 };
 
+class Retry {
+  private static retriesContainer: Map<string, Retry> = new Map();
+  private lastRetry: Date | undefined;
+  private retriesCount = 0;
+
+  constructor(ip: string) {
+    const existing = Retry.retriesContainer.get(ip);
+    if (existing) {
+      return existing;
+    }
+    Retry.retriesContainer.set(ip, this);
+  }
+
+  public canLogin(
+    maxRetries: number | AuthenticationMaxRetriesOptions | undefined
+  ): boolean {
+    if (maxRetries === undefined) {
+      return true;
+    } else if (typeof maxRetries === "number") {
+      maxRetries = {
+        count: maxRetries,
+        duration: 60,
+      };
+    } else if (maxRetries.count <= 0) {
+      return true;
+    }
+    if (
+      !this.lastRetry ||
+      new Date().getTime() - this.lastRetry.getTime() >
+        maxRetries.duration * 1000
+    ) {
+      this.lastRetry = new Date();
+      this.retriesCount = 1;
+      return true;
+    } else {
+      this.lastRetry = new Date();
+      this.retriesCount++;
+      return this.retriesCount <= maxRetries.count;
+    }
+  }
+}
+
 export const withLogin = (
   router: Router,
   admin: AdminJS,
@@ -32,6 +77,14 @@ export const withLogin = (
   });
 
   router.post(loginPath, async (req, res, next) => {
+    if (!new Retry(req.ip).canLogin(auth.maxRetries)) {
+      const login = await admin.renderLogin({
+        action: admin.options.loginPath,
+        errorMessage: "tooManyRequests",
+      });
+      res.send(login);
+      return;
+    }
     const { email, password } = req.fields as {
       email: string;
       password: string;

src/buildAuthenticatedRouter.ts

@@ -1,13 +1,16 @@
-import AdminJS from "adminjs";
-import express, { Router } from "express";
-import session from "express-session";
-import { withLogout } from "./authentication/logout.handler";
-import { buildRouter } from "./buildRouter";
-import { OldBodyParserUsedError } from "./errors";
-import { AuthenticationOptions, FormidableOptions } from "./types";
-import { withLogin } from "./authentication/login.handler";
-import { withProtectedRoutesHandler } from "./authentication/protected-routes.handler";
-import formidableMiddleware from "express-formidable";
+import AdminJS from 'adminjs';
+import express, { Router } from 'express';
+import formidableMiddleware from 'express-formidable';
+import session from 'express-session';
+import { withLogin } from './authentication/login.handler';
+import { withLogout } from './authentication/logout.handler';
+import { withProtectedRoutesHandler } from './authentication/protected-routes.handler';
+import { buildRouter } from './buildRouter';
+import { OldBodyParserUsedError } from './errors';
+import {
+  AuthenticationOptions,
+  FormidableOptions,
+} from './types';
 
 /**
  * @typedef {Function} Authenticate

src/types.ts

@@ -10,8 +10,23 @@ export type FormidableOptions = {
   multiples?: boolean;
 };
 
+export type AuthenticationMaxRetriesOptions = {
+  /**
+   * @description Count of retries
+   */
+  count: number;
+  /**
+   * @description Time to reset (in seconds)
+   */
+  duration: number;
+};
+
 export type AuthenticationOptions = {
   cookiePassword: string;
   cookieName?: string;
   authenticate: (email: string, password: string) => unknown | null;
+  /**
+   * @description Maximum number of authorization attempts (if number - per minute)
+   */
+  maxRetries?: number | AuthenticationMaxRetriesOptions;
 };