clawbot
bf4d63bc4d
Some checks failed
check / check (push) Failing after 1m48s
closes #12 ## Summary Implements per-channel hashcash proof-of-work requirement for PRIVMSG as an anti-spam mechanism. Channel operators set a difficulty level via `MODE +H <bits>`, and clients must compute a proof-of-work stamp bound to the channel name and message body before sending. ## Changes ### Database - Added `hashcash_bits` column to `channels` table (default 0 = no requirement) - Added `spent_hashcash` table with `stamp_hash` unique key and `created_at` for TTL pruning - New queries: `GetChannelHashcashBits`, `SetChannelHashcashBits`, `RecordSpentHashcash`, `IsHashcashSpent`, `PruneSpentHashcash` ### Hashcash Validation (`internal/hashcash/channel.go`) - `ChannelValidator` type for per-channel stamp validation - `BodyHash()` computes hex-encoded SHA-256 of message body - `StampHash()` computes deterministic hash of stamp for spent-token key - `MintChannelStamp()` generates valid stamps (for clients) - Stamp format: `1:bits:YYMMDD:channel:bodyhash:counter` - Validates: version, difficulty, date freshness (48h), channel binding, body hash binding, proof-of-work ### Handler Changes (`internal/handlers/api.go`) - `validateChannelHashcash()` + `verifyChannelStamp()` — checks hashcash on PRIVMSG to protected channels - `extractHashcashFromMeta()` — parses hashcash stamp from meta JSON - `applyChannelMode()` / `setHashcashMode()` / `clearHashcashMode()` — MODE +H/-H support - `queryChannelMode()` — shows +nH in mode query when hashcash is set - Meta field now passed through the full dispatch chain (dispatchCommand → handlePrivmsg → handleChannelMsg → sendChannelMsg → fanOut → InsertMessage) - ISUPPORT updated: `CHANMODES=,H,,imnst` (H in type B = parameter when set) ### Replay Prevention - Spent stamps persisted to SQLite `spent_hashcash` table - 1-year TTL (per issue requirements) - Automatic pruning in cleanup loop ### Client Support (`internal/cli/api/hashcash.go`) - `MintChannelHashcash(bits, channel, body)` — computes stamps for channel messages ### Tests - **12 unit tests** in `internal/hashcash/channel_test.go`: happy path, wrong channel, wrong body hash, insufficient bits, zero bits skip, bad format, bad version, expired stamp, missing body hash, body hash determinism, stamp hash, mint+validate round-trip - **10 integration tests** in `internal/handlers/api_test.go`: set mode, query mode, clear mode, reject no stamp, accept valid stamp, reject replayed stamp, no requirement works, invalid bits range, missing bits arg ### README - Added `+H` to channel modes table - Added "Per-Channel Hashcash (Anti-Spam)" section with full documentation - Updated `meta` field description to mention hashcash ## How It Works 1. Channel operator sets requirement: `MODE #general +H 20` (20 bits) 2. Client mints stamp: computes SHA-256 hashcash bound to `#general` + SHA-256(body) 3. Client sends PRIVMSG with `meta.hashcash` field containing the stamp 4. Server validates stamp, checks spent cache, records as spent, relays message 5. Replayed stamps are rejected for 1 year ## Docker Build `docker build .` passes clean (formatting, linting, all tests). Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #79 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
61 lines
1.8 KiB
Makefile
61 lines
1.8 KiB
Makefile
.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
|
|
|
|
BINARY := neoircd
|
|
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
|
|
BUILDARCH := $(shell go env GOARCH)
|
|
LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
|
|
|
|
all: check build
|
|
|
|
# ensure-web-dist creates placeholder files so //go:embed dist/* in
|
|
# web/embed.go resolves without a full Node.js build. The real SPA is
|
|
# built by the web-builder Docker stage; these placeholders let
|
|
# "make test" and "make build" work outside Docker.
|
|
ensure-web-dist:
|
|
@if [ ! -d web/dist ]; then \
|
|
mkdir -p web/dist && \
|
|
touch web/dist/index.html web/dist/style.css web/dist/app.js && \
|
|
echo "==> Created placeholder web/dist/ for go:embed"; \
|
|
fi
|
|
|
|
build: ensure-web-dist
|
|
go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd
|
|
|
|
lint: ensure-web-dist
|
|
golangci-lint run --config .golangci.yml ./...
|
|
|
|
fmt:
|
|
gofmt -s -w .
|
|
goimports -w .
|
|
|
|
fmt-check:
|
|
@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
|
|
|
|
test: ensure-web-dist
|
|
go test -timeout 30s -v -race -cover ./...
|
|
|
|
# check runs all validation without making changes
|
|
# Used by CI and Docker build — fails if anything is wrong
|
|
check: test lint fmt-check
|
|
@echo "==> Building..."
|
|
go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/neoircd
|
|
@echo "==> All checks passed!"
|
|
|
|
run: build
|
|
./bin/$(BINARY)
|
|
|
|
debug: build
|
|
DEBUG=1 GOTRACEBACK=all ./bin/$(BINARY)
|
|
|
|
clean:
|
|
rm -rf bin/ neoircd
|
|
|
|
docker:
|
|
docker build -t neoirc .
|
|
|
|
hooks:
|
|
@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
|
|
@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
|
|
@printf 'make check\n' >> .git/hooks/pre-commit
|
|
@chmod +x .git/hooks/pre-commit
|