app/routes/webmention.ts

Functions

Imports

It imports app/db/index.ts, app/lib/client-ip.ts, app/lib/context.ts, app/lib/error-message.mjs, app/lib/rate-limit.mjs, app/lib/seo.ts, app/lib/webmention/queue.ts, app/lib/webmention/urls.mjs. No module of this repo imports it.

Source

1import { countOpenWebmentions, receiveWebmention, webmentionTarget } from "~/db";
2import { clientIp } from "~/lib/client-ip";
3import { getEnv } from "~/lib/context";
4import { readCapped } from "@dustinedwards/site-runtime/body";
5import { limitHit } from "~/lib/rate-limit.mjs";
6import { SITE_ORIGIN } from "~/lib/seo";
7import type { WebmentionVerifyMessage } from "~/lib/webmention/queue";
8import { sourceVerdict, targetSlug } from "~/lib/webmention/urls.mjs";
9
10import type { Route } from "./+types/webmention";
11import { errorMessage } from "~/lib/error-message.mjs";
12
13/**
14 * Public by necessity, and it writes rows, so four bounds: a per-IP rate, a publicly visible target,
15 * one row per (source, target), and a global cap on open rows. It stores no IP address.
16 */
17
18/** Bytes. A real webmention is well under 500; 4 KB allows heavy percent-encoding. */
19const MAX_BODY_BYTES = 4 * 1024;
20
21const RATE_LIMIT = 20;
22const RATE_PERIOD_SECONDS = 60;
23
24/**
25 * Small: a higher cap buys a real sender nothing and raises what an attacker can store. 503, not
26 * 429: the condition is this site's state, not the caller's rate.
27 */
28const OPEN_QUEUE_CAP = 500;
29
30const NO_STORE = "private, no-store";
31
32/** One string for every target problem: a distinct message for a draft would be an oracle for unpublished slugs. */
33const BAD_TARGET = "target must be a published post on this site";
34
35const BAD_FORM = "send application/x-www-form-urlencoded with source and target";
36
37/** Two origins, not one: pre-cutover, pinning a constant would refuse the other host at the moment of the move. */
38function siteOrigins(request: Request): string[] {
39  try {
40    return [...new Set([SITE_ORIGIN, new URL(request.url).origin])];
41  } catch {
42    return [SITE_ORIGIN];
43  }
44}
45
46function answer(body: string, status: number, extra: HeadersInit = {}): Response {
47  const headers = new Headers({
48    "content-type": "text/plain; charset=utf-8",
49    "cache-control": NO_STORE,
50  });
51  for (const [name, value] of new Headers(extra)) headers.set(name, value);
52  return new Response(body, { status, headers });
53}
54
55export async function action({ request, context }: Route.ActionArgs) {
56  if (request.method !== "POST") {
57    return answer("Method Not Allowed", 405, { allow: "POST" });
58  }
59
60  /* Content-Length is a client hint: used to refuse early, never to permit. */
61  const declared = Number(request.headers.get("content-length") ?? "");
62  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
63    return answer("Payload Too Large", 413);
64  }
65
66  const env = getEnv(context);
67  /* Absent on a Worker Preview, which cannot consume a queue: refused before anything is written. */
68  if (!env.ASK_BUDGET || !env.WEBMENTION_VERIFY) {
69    return answer("Webmentions unavailable", 503);
70  }
71
72  /* The rate limit precedes the body read: every check below it costs something. */
73  const ip = clientIp(request);
74  const rate = await limitHit(env, `wm:${ip}`, RATE_LIMIT, RATE_PERIOD_SECONDS);
75  if (rate.status === "unavailable") {
76    return answer("Webmentions unavailable", 503, { "retry-after": String(rate.retryAfterSeconds) });
77  }
78  if (rate.status === "limited") {
79    return answer("Too Many Requests", 429, { "retry-after": String(rate.retryAfterSeconds) });
80  }
81
82  /* Checked on the header, where it is free. The protocol specifies only this encoding. */
83  const contentType = (request.headers.get("content-type") ?? "").toLowerCase();
84  if (!contentType.includes("application/x-www-form-urlencoded")) {
85    return answer(BAD_FORM, 400);
86  }
87
88  let body: string | null;
89  try {
90    body = await readCapped(request, MAX_BODY_BYTES);
91  } catch (error) {
92    // The sender's body broke mid-read: its request is malformed, not this site down, so 400, logged.
93    console.error(JSON.stringify({ alert: "webmention-body-unreadable", detail: errorMessage(error) }));
94    return answer(BAD_FORM, 400);
95  }
96  if (body === null) {
97    return answer("Payload Too Large", 413);
98  }
99
100  const fields = new URLSearchParams(body);
101  const source = fields.get("source") ?? "";
102  const target = fields.get("target") ?? "";
103  if (!source || !target) {
104    return answer(BAD_FORM, 400);
105  }
106
107  const origins = siteOrigins(request);
108  const slug = targetSlug(target, origins);
109  if (slug === null) {
110    return answer(BAD_TARGET, 400);
111  }
112
113  // Refused before anything is written, so a URL this Worker will not fetch never becomes a row.
114  const verdict = sourceVerdict(source, target, origins);
115  if (!verdict.ok) {
116    return answer(verdict.reason, 400);
117  }
118
119  /* After the source check: only this costs a query, so garbage sources cannot make this site read D1. */
120  if (!(await webmentionTarget(env, slug))) {
121    return answer(BAD_TARGET, 400);
122  }
123
124  /* A count, not a reservation: two concurrent requests can both pass at the boundary, one row past the cap. */
125  const open = await countOpenWebmentions(env);
126  if (open >= OPEN_QUEUE_CAP) {
127    // Moderating /admin/mentions reopens the endpoint.
128    console.log(JSON.stringify({ event: "webmention-open-cap-refused", open, cap: OPEN_QUEUE_CAP }));
129    return answer("Webmention queue is full, please retry later", 503);
130  }
131
132  const id = await receiveWebmention(env, { sourceUrl: source, targetSlug: slug });
133
134  /*
135   * 202 first, verification on the queue: retried there and dead-lettered rather than lost with the
136   * isolate. A failed send answers 503 so the sender retries; its re-send resets the same row.
137   */
138  try {
139    const message: WebmentionVerifyMessage = { id, source, target };
140    await env.WEBMENTION_VERIFY.send(message);
141  } catch (error) {
142    console.error(
143      JSON.stringify({ alert: "webmention-enqueue-failed", id, detail: errorMessage(error) }),
144    );
145    return answer("Webmentions unavailable", 503, { "retry-after": "60" });
146  }
147
148  return answer("Accepted. It will be verified and reviewed before it appears.", 202);
149}
150
151export function loader() {
152  return answer(
153    "Webmention endpoint. POST source and target as application/x-www-form-urlencoded.",
154    200,
155  );
156}