Files
einundzwanzig-verein/resources/views/livewire/association/project-support/show.blade.php
vk 9faae15212 [P1 Security] Rate Limiting für API-Routes und Livewire-Actions (vibe-kanban e1f85c61)
## Security Audit: Fehlendes Rate Limiting

### Problem
Die Anwendung hat **kein Rate Limiting** auf API-Routes oder Livewire-Actions. Das ermöglicht:
- Brute-Force-Angriffe auf Authentication-Endpoints
- Denial-of-Service durch massenhaftes Aufrufen von API-Endpoints
- Vote-Manipulation durch schnelle, wiederholte Requests
- Ressourcen-Erschöpfung durch unkontrollierte Datenbankabfragen

### Betroffene Endpoints

**API-Routes (`routes/api.php`):**
```php
Route::get('/nostr/profile/{key}', GetProfile::class);  // kein Rate Limit
Route::get('/members/{year}', GetPaidMembers::class);    // kein Rate Limit
```

**Kritische Livewire-Actions (kein Throttling):**
- Voting auf ProjectProposals (`association/project-support/show`)
- Login via Nostr (`handleNostrLogin`)
- ProjectProposal-Erstellung
- Election Voting

### Lösung

**1. API Rate Limiting in `bootstrap/app.php`:**
Nutze Laravel 12's Middleware-Konfiguration um Rate Limiting zu aktivieren:

```php
->withMiddleware(function (Middleware $middleware) {
    $middleware->api(prepend: [
        \Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
    ]);
})
```

Und definiere den `api` Rate Limiter in `app/Providers/AppServiceProvider.php`:

```php
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;

public function boot(): void
{
    RateLimiter::for('api', function (Request $request) {
        return Limit::perMinute(60)->by($request->ip());
    });
}
```

**2. Livewire Action Throttling:**
Nutze Livewire's `#[Throttle]` Attribut auf sensiblen Actions. Suche in der Livewire-Dokumentation nach der korrekten v4-Syntax mit `search-docs`:
- `queries: ['throttle', 'rate limiting']`
- `packages: ['livewire/livewire']`

Wende Throttling an auf:
- Vote-Submit-Methoden in den ProjectSupport-Components
- Login-Handler (`handleNostrLogin` in `WithNostrAuth` Trait)
- ProjectProposal Create/Update Actions

**3. Zusätzlicher Custom Rate Limiter für Voting:**

```php
RateLimiter::for('voting', function (Request $request) {
    return Limit::perMinute(10)->by($request->ip());
});
```

### Betroffene Dateien
- `bootstrap/app.php` – Middleware-Konfiguration (Rate Limit Middleware hinzufügen)
- `app/Providers/AppServiceProvider.php` – RateLimiter Definitionen
- `routes/api.php` – Rate Limit Middleware anwenden
- `app/Livewire/Traits/WithNostrAuth.php` – Throttle auf `handleNostrLogin`
- Livewire-Components in `app/Livewire/Association/ProjectSupport/` – Throttle auf Vote/Create Actions

### Vorgehen
1. `search-docs` nutzen für: `['rate limiting', 'throttle']` (Laravel) und `['throttle']` (Livewire)
2. Rate Limiter in AppServiceProvider definieren
3. API-Middleware in `bootstrap/app.php` konfigurieren
4. Livewire-Actions mit Throttle versehen
5. Pest-Tests schreiben, die verifizieren dass Rate Limiting greift (429 Response bei Überschreitung)
6. `vendor/bin/pint --dirty` und `php artisan test --compact`

### Akzeptanzkriterien
- API-Routes geben HTTP 429 nach 60 Requests/Minute zurück
- Voting-Actions sind auf max. 10/Minute limitiert
- Login-Attempts sind throttled
- Tests verifizieren Rate Limiting Verhalten
2026-02-11 21:13:36 +01:00

218 lines
8.5 KiB
PHP

<?php
use App\Livewire\Traits\WithNostrAuth;
use App\Models\ProjectProposal;
use App\Models\Vote;
use App\Support\NostrAuth;
use Illuminate\Support\Facades\RateLimiter;
use Livewire\Attributes\Locked;
use Livewire\Component;
new class extends Component {
use WithNostrAuth;
#[Locked]
public $projectProposal;
#[Locked]
public bool $isAllowed = false;
#[Locked]
public ?string $currentPubkey = null;
#[Locked]
public ?object $currentPleb = null;
#[Locked]
public bool $ownVoteExists = false;
public function mount($projectProposal): void
{
$this->projectProposal = ProjectProposal::query()->where('slug', $projectProposal)->firstOrFail();
if (NostrAuth::check()) {
$this->currentPubkey = NostrAuth::pubkey();
$this->isAllowed = true;
$this->mountWithNostrAuth();
$this->ownVoteExists = Vote::query()
->where('project_proposal_id', $this->projectProposal->id)
->where('einundzwanzig_pleb_id', $this->currentPleb->id)
->exists();
}
}
public function getBoardVotesProperty()
{
return Vote::query()
->where('project_proposal_id', $this->projectProposal->id)
->whereHas('einundzwanzigPleb', fn($q) => $q->whereIn('npub', config('einundzwanzig.config.current_board')))
->get();
}
public function getOtherVotesProperty()
{
return Vote::query()
->where('project_proposal_id', $this->projectProposal->id)
->whereDoesntHave(
'einundzwanzigPleb',
fn($q) => $q->whereIn('npub', config('einundzwanzig.config.current_board'))
)
->get();
}
public function handleApprove(): void
{
if (! $this->currentPleb) {
return;
}
$executed = RateLimiter::attempt(
'voting:'.request()->ip(),
10,
function () {},
);
if (! $executed) {
abort(429, 'Too many voting attempts.');
}
Vote::query()->updateOrCreate([
'project_proposal_id' => $this->projectProposal->id,
'einundzwanzig_pleb_id' => $this->currentPleb->id,
], [
'value' => true,
]);
$this->ownVoteExists = true;
}
public function handleNotApprove(): void
{
if (! $this->currentPleb) {
return;
}
$executed = RateLimiter::attempt(
'voting:'.request()->ip(),
10,
function () {},
);
if (! $executed) {
abort(429, 'Too many voting attempts.');
}
Vote::query()->updateOrCreate([
'project_proposal_id' => $this->projectProposal->id,
'einundzwanzig_pleb_id' => $this->currentPleb->id,
], [
'value' => false,
]);
$this->ownVoteExists = true;
}
}
?>
<div>
<div class="px-4 sm:px-6 lg:px-8 py-8 w-full">
<div class="mx-auto flex flex-col lg:flex-row lg:space-x-8 xl:space-x-12">
<div class="flex-1">
<div class="mb-6">
<flux:button :href="route('association.projectSupport')" variant="primary" size="sm"
icon="chevron-left">
Zurück zur Übersicht
</flux:button>
</div>
<div class="text-sm font-semibold text-violet-500 uppercase mb-2">
{{ $projectProposal->created_at->translatedFormat('d.m.Y') }}
</div>
<header class="mb-4">
<h1 class="text-2xl md:text-3xl text-zinc-800 dark:text-zinc-100 font-bold mb-2">
{{ $projectProposal->name }}
</h1>
<x-markdown>
{!! $projectProposal->description !!}
</x-markdown>
</header>
<div class="space-y-3 sm:flex sm:items-center sm:justify-between sm:space-y-0 mb-6">
<div class="flex items-center sm:mr-4">
<a class="block mr-2 shrink-0" href="#0">
<img class="rounded-full"
src="{{ $projectProposal->einundzwanzigPleb->profile?->picture ?? asset('einundzwanzig-alpha.jpg') }}"
width="32" height="32" alt="User">
</a>
<div class="text-sm whitespace-nowrap">Eingereicht von
<div class="font-semibold text-zinc-800 dark:text-zinc-100">
{{ $projectProposal->einundzwanzigPleb?->profile->name ?? str($projectProposal->einundzwanzigPleb->npub)->limit(32) }}
</div>
</div>
</div>
<div class="flex flex-wrap items-center sm:justify-end space-x-2">
<div
class="text-xs inline-flex items-center font-medium border border-zinc-200 dark:border-zinc-700/60 text-zinc-600 dark:text-zinc-400 rounded-full text-center px-2.5 py-1">
<a target="_blank" href="{{ $projectProposal->website }}">Webseite</a>
</div>
<div
class="text-xs inline-flex font-medium uppercase bg-green-500/20 text-green-700 rounded-full text-center px-2.5 py-1">
{{ number_format($projectProposal->support_in_sats, 0, ',', '.') }} Sats
</div>
</div>
</div>
<figure class="mb-6">
<img class="rounded-sm h-48" src="{{ $projectProposal->getSignedMediaUrl('main') }}"
alt="Picture">
</figure>
<hr class="my-6 border-t border-zinc-100 dark:border-zinc-700/60">
</div>
<div class="lg:w-80 xl:w-96 shrink-0 space-y-4">
@if($isAllowed)
<div class="bg-white dark:bg-zinc-800 p-5 shadow-sm rounded-xl">
@if(!$ownVoteExists)
<div class="space-y-2">
<flux:button wire:click="handleApprove" class="w-full">
<i class="fill-current shrink-0 fa-sharp-duotone fa-solid fa-thumbs-up mr-2"></i>
Zustimmen
</flux:button>
<flux:button wire:click="handleNotApprove" variant="danger" class="w-full">
<i class="fill-current shrink-0 fa-sharp-duotone fa-solid fa-thumbs-down mr-2"></i>
Ablehnen
</flux:button>
</div>
@else
<p class="text-sm text-zinc-700 dark:text-zinc-300">Du hast bereits abgestimmt.</p>
@endif
</div>
@endif
<div class="bg-white dark:bg-zinc-800 p-5 shadow-sm rounded-xl">
<div class="text-sm font-semibold text-zinc-800 dark:text-zinc-100 mb-2">
Zustimmungen des Vorstands ({{ count($this->boardVotes->where('value', 1)) }})
</div>
</div>
<div class="bg-white dark:bg-zinc-800 p-5 shadow-sm rounded-xl">
<div class="text-sm font-semibold text-zinc-800 dark:text-zinc-100 mb-2">
Ablehnungen des Vorstands ({{ count($this->boardVotes->where('value', 0)) }})
</div>
</div>
<div class="bg-white dark:bg-zinc-800 p-5 shadow-sm rounded-xl">
<div class="text-sm font-semibold text-zinc-800 dark:text-zinc-100 mb-2">
Zustimmungen der übrigen Mitglieder
({{ count($this->otherVotes->where('value', 1)) }})
</div>
</div>
<div class="bg-white dark:bg-zinc-800 p-5 shadow-sm rounded-xl">
<div class="text-sm font-semibold text-zinc-800 dark:text-zinc-100 mb-2">
Ablehnungen der übrigen Mitglieder
({{ count($this->otherVotes->where('value', 0)) }})
</div>
</div>
</div>
</div>
</div>
</div>