138 lines
4.1 KiB
TypeScript
138 lines
4.1 KiB
TypeScript
"use server";
|
|
|
|
import { count, eq } from "drizzle-orm";
|
|
import { redirect } from "next/navigation";
|
|
import { z } from "zod";
|
|
import { sendVerification } from "@/actions/email-verify";
|
|
import { hashPassword } from "@/lib/auth/password";
|
|
import { db, User } from "@/lib/db";
|
|
import { logger } from "@/lib/logger";
|
|
import { clientIp, rateLimit } from "@/lib/rate-limit";
|
|
import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
|
|
import { checkVpn } from "@/lib/services/ip-lookup";
|
|
import { siteSettings } from "@/lib/services/site-settings";
|
|
|
|
const registerSchema = z.object({
|
|
username: z
|
|
.string()
|
|
.min(3, "Username must be at least 3 characters")
|
|
.max(25, "Username must be at most 25 characters")
|
|
.regex(/^[A-Za-z0-9_\-=?!@:.,]+$/, "Username contains invalid characters"),
|
|
mail: z
|
|
.string()
|
|
.email("Enter a valid email address")
|
|
.optional()
|
|
.or(z.literal("")),
|
|
password: z
|
|
.string()
|
|
.min(8, "Password must be at least 8 characters")
|
|
.regex(/[A-Z]/, "Password must contain at least one uppercase letter")
|
|
.regex(/[a-z]/, "Password must contain at least one lowercase letter")
|
|
.regex(/[0-9]/, "Password must contain at least one digit"),
|
|
look: z.string().optional(),
|
|
});
|
|
|
|
// A valid starter Habbo figure so the avatar renders in-client immediately.
|
|
const DEFAULT_LOOK = "hr-100-.hd-180-1.ch-255-66.lg-280-110.sh-305-62";
|
|
|
|
export async function register(
|
|
_prevState: string | null,
|
|
formData: FormData,
|
|
): Promise<string | null> {
|
|
const raw = {
|
|
username: String(formData.get("username") ?? "")
|
|
.normalize("NFC")
|
|
.trim(),
|
|
mail: String(formData.get("mail") ?? "")
|
|
.normalize("NFC")
|
|
.trim()
|
|
.toLowerCase(),
|
|
password: String(formData.get("password") ?? "").normalize("NFC"),
|
|
look:
|
|
String(formData.get("look") ?? "")
|
|
.normalize("NFC")
|
|
.trim() || DEFAULT_LOOK,
|
|
};
|
|
|
|
const parsed = registerSchema.safeParse(raw);
|
|
if (!parsed.success) {
|
|
return parsed.error.issues[0]?.message ?? "Invalid input";
|
|
}
|
|
|
|
const { username, mail, password, look } = parsed.data;
|
|
const hasEmail = !!mail;
|
|
const ip = await clientIp();
|
|
|
|
// Throttle sign-ups per IP (5 per 10 minutes) to curb account spam.
|
|
if (!(await rateLimit(`register:${ip}`, 5, 10 * 60_000)).ok) {
|
|
return "Too many sign-up attempts. Please wait a few minutes and try again.";
|
|
}
|
|
|
|
// CAPTCHA (Turnstile / reCAPTCHA) — only enforced when configured in settings.
|
|
const cfg = await captchaConfig();
|
|
if (cfg.provider !== "none") {
|
|
const token = String(formData.get(cfg.field) ?? "").normalize("NFC");
|
|
if (!(await verifyCaptcha(token, ip)))
|
|
return "Captcha verification failed. Please try again.";
|
|
}
|
|
|
|
// VPN/proxy block (only when enabled in /admin/vpn).
|
|
if ((await checkVpn(ip)).blocked) {
|
|
return (
|
|
(await siteSettings.get("vpn_block_message", "")) ||
|
|
"Registrations from VPN/proxy connections are not allowed."
|
|
);
|
|
}
|
|
|
|
// Max accounts per IP (0 / unset = unlimited), mirrors AtomCMS.
|
|
const max = Number(await siteSettings.get("max_accounts_per_ip", "0")) || 0;
|
|
if (max > 0) {
|
|
const [row] = await db
|
|
.select({ total: count() })
|
|
.from(User)
|
|
.where(eq(User.ipRegister, ip))
|
|
.catch(() => [{ total: 0 }]);
|
|
if (Number(row?.total ?? 0) >= max)
|
|
return "You have reached the maximum number of accounts for your connection.";
|
|
}
|
|
|
|
// Uniqueness check.
|
|
try {
|
|
const [existing] = await db
|
|
.select({ id: User.id })
|
|
.from(User)
|
|
.where(eq(User.username, username))
|
|
.limit(1);
|
|
if (existing) return "That username is already taken";
|
|
} catch {
|
|
logger.warn("Username uniqueness check failed during registration");
|
|
return "Registration is temporarily unavailable";
|
|
}
|
|
|
|
const now = Math.floor(Date.now() / 1000);
|
|
try {
|
|
await db.insert(User).values({
|
|
username,
|
|
password: await hashPassword(password),
|
|
mail: hasEmail ? mail : null,
|
|
accountCreated: now,
|
|
ipRegister: ip,
|
|
ipCurrent: ip,
|
|
look,
|
|
});
|
|
|
|
if (hasEmail) {
|
|
try {
|
|
await sendVerification(mail);
|
|
} catch {
|
|
logger.warn("Failed to send verification email after registration");
|
|
}
|
|
}
|
|
} catch {
|
|
logger.warn("Account creation failed");
|
|
return "Could not create the account (is the username unique?)";
|
|
}
|
|
|
|
redirect("/login?registered=1");
|
|
}
|