diff --git a/.auto-claude-security.json b/.auto-claude-security.json deleted file mode 100644 index eed60a2..0000000 --- a/.auto-claude-security.json +++ /dev/null @@ -1,227 +0,0 @@ -{ - "base_commands": [ - ".", - "[", - "[[", - "ag", - "awk", - "basename", - "bash", - "bc", - "break", - "cat", - "cd", - "chmod", - "clear", - "cmp", - "column", - "comm", - "command", - "continue", - "cp", - "curl", - "cut", - "date", - "df", - "diff", - "dig", - "dirname", - "du", - "echo", - "egrep", - "env", - "eval", - "exec", - "exit", - "expand", - "export", - "expr", - "false", - "fd", - "fgrep", - "file", - "find", - "fmt", - "fold", - "gawk", - "gh", - "git", - "grep", - "gunzip", - "gzip", - "head", - "help", - "host", - "iconv", - "id", - "jobs", - "join", - "jq", - "kill", - "killall", - "less", - "let", - "ln", - "ls", - "lsof", - "man", - "mkdir", - "mktemp", - "more", - "mv", - "nl", - "paste", - "pgrep", - "ping", - "pkill", - "popd", - "printenv", - "printf", - "ps", - "pushd", - "pwd", - "read", - "readlink", - "realpath", - "reset", - "return", - "rev", - "rg", - "rm", - "rmdir", - "sed", - "seq", - "set", - "sh", - "shuf", - "sleep", - "sort", - "source", - "split", - "stat", - "tail", - "tar", - "tee", - "test", - "time", - "timeout", - "touch", - "tr", - "tree", - "true", - "type", - "uname", - "unexpand", - "uniq", - "unset", - "unzip", - "watch", - "wc", - "wget", - "whereis", - "which", - "whoami", - "xargs", - "yes", - "yq", - "zip", - "zsh" - ], - "stack_commands": [ - "ar", - "clang", - "clang++", - "cmake", - "composer", - "dive", - "docker", - "docker-buildx", - "docker-compose", - "dockerfile", - "eslint", - "g++", - "gcc", - "ipython", - "jupyter", - "ld", - "make", - "meson", - "next", - "ninja", - "nm", - "node", - "notebook", - "npm", - "npx", - "objdump", - "pdb", - "php", - "pip", - "pip3", - "pipx", - "pnpm", - "pnpx", - "pudb", - "python", - "python3", - "react-scripts", - "strip", - "ts-node", - "tsc", - "tsx", - "vitest" - ], - "script_commands": [ - "bun", - "npm", - "pnpm", - "yarn" - ], - "custom_commands": [], - "detected_stack": { - "languages": [ - "python", - "javascript", - "typescript", - "php", - "c" - ], - "package_managers": [ - "pnpm" - ], - "frameworks": [ - "nextjs", - "react", - "vitest", - "eslint" - ], - "databases": [], - "infrastructure": [ - "docker" - ], - "cloud_providers": [], - "code_quality_tools": [], - "version_managers": [] - }, - "custom_scripts": { - "npm_scripts": [ - "dev", - "build", - "start", - "lint", - "build:images", - "generate:images", - "generate:images:dry", - "test", - "test:coverage" - ], - "make_targets": [], - "poetry_scripts": [], - "cargo_aliases": [], - "shell_scripts": [] - }, - "project_dir": "C:\\Users\\damja\\WebstormProjects\\Portfolio", - "created_at": "2026-01-22T15:28:38.237190", - "project_hash": "c4ad399e16be367eb4e6b076fe1d9ee3", - "inherited_from": "C:\\Users\\damja\\WebstormProjects\\Portfolio" -} \ No newline at end of file diff --git a/.auto-claude-status b/.auto-claude-status deleted file mode 100644 index 2cea5e4..0000000 --- a/.auto-claude-status +++ /dev/null @@ -1,25 +0,0 @@ -{ - "active": true, - "spec": "015-add-brute-force-protection-to-login-form", - "state": "building", - "subtasks": { - "completed": 5, - "total": 6, - "in_progress": 1, - "failed": 0 - }, - "phase": { - "current": "Manual Testing and Verification", - "id": null, - "total": 2 - }, - "workers": { - "active": 0, - "max": 1 - }, - "session": { - "number": 2, - "started_at": "2026-01-25T11:51:53.203339" - }, - "last_update": "2026-01-25T11:55:09.418401" -} \ No newline at end of file diff --git a/.claude_settings.json b/.claude_settings.json deleted file mode 100644 index 7d2d590..0000000 --- a/.claude_settings.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "sandbox": { - "enabled": true, - "autoAllowBashIfSandboxed": true - }, - "permissions": { - "defaultMode": "acceptEdits", - "allow": [ - "Read(./**)", - "Write(./**)", - "Edit(./**)", - "Glob(./**)", - "Grep(./**)", - "Read(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form/**)", - "Write(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form/**)", - "Edit(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form/**)", - "Glob(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form/**)", - "Grep(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form/**)", - "Read(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form\\.auto-claude\\specs\\015-add-brute-force-protection-to-login-form/**)", - "Write(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form\\.auto-claude\\specs\\015-add-brute-force-protection-to-login-form/**)", - "Edit(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude\\worktrees\\tasks\\015-add-brute-force-protection-to-login-form\\.auto-claude\\specs\\015-add-brute-force-protection-to-login-form/**)", - "Read(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude/**)", - "Write(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude/**)", - "Edit(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude/**)", - "Glob(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude/**)", - "Grep(C:\\Users\\damja\\WebstormProjects\\Portfolio\\.auto-claude/**)", - "Bash(*)", - "WebFetch(*)", - "WebSearch(*)", - "mcp__context7__resolve-library-id(*)", - "mcp__context7__get-library-docs(*)", - "mcp__graphiti-memory__search_nodes(*)", - "mcp__graphiti-memory__search_facts(*)", - "mcp__graphiti-memory__add_episode(*)", - "mcp__graphiti-memory__get_episodes(*)", - "mcp__graphiti-memory__get_entity_edge(*)" - ] - } -} \ No newline at end of file diff --git a/.gitignore b/.gitignore index fa65296..5f6257c 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,10 @@ source-images/ # Auto Claude data directory .auto-claude/ + +# AI Agent Framework Files +.auto-claude-security.json +.auto-claude-status +.claude_settings.json +*-verification.md +manual-test-verification.md diff --git a/src/components/auth/LoginForm.tsx b/src/components/auth/LoginForm.tsx index 3e4b4d3..5ebbdf4 100644 --- a/src/components/auth/LoginForm.tsx +++ b/src/components/auth/LoginForm.tsx @@ -27,8 +27,11 @@ export default function LoginForm() { setIsLockedOut(false); try { - // Check rate limiting - const clientIp = '127.0.0.1'; // In production, get this from the request + // Rate limiting per browser session (client-side UX protection) + // Real brute-force protection relies on Supabase's server-side rate limiting + const clientIp = '127.0.0.1'; + + // Check if already locked out BEFORE attempting auth if (rateLimiter.isRateLimited(clientIp)) { const timeToReset = Math.ceil(rateLimiter.getTimeToReset(clientIp) / 1000 / 60); setIsLockedOut(true); @@ -44,11 +47,16 @@ export default function LoginForm() { }); if (error) { - // Get remaining attempts after failed login + // Only track FAILED attempts + rateLimiter.trackFailedAttempt(clientIp); + + // Get remaining attempts after tracking the failure const remaining = rateLimiter.getRemainingAttempts(clientIp); setRemainingAttempts(remaining); throw error; } + + // Success - DON'T track, just redirect router.push(`/${locale}/dashboard`); } catch (err) { setError(err instanceof Error ? err.message : t('form.errors.default')); diff --git a/src/utils/rateLimiting.ts b/src/utils/rateLimiting.ts index 2ca3385..ee194ac 100644 --- a/src/utils/rateLimiting.ts +++ b/src/utils/rateLimiting.ts @@ -1,3 +1,10 @@ +/** + * Client-side rate limiter for UX protection. + * This provides immediate user feedback but does NOT prevent + * server-side brute force attacks. Relies on Supabase's + * built-in server-side rate limiting for actual security. + */ + interface RateLimitEntry { count: number; timestamp: number; @@ -18,21 +25,28 @@ class RateLimiter { const entry = this.cache.get(ip); if (!entry) { - this.cache.set(ip, { count: 1, timestamp: now }); - return false; + return false; // No entry = not limited } if (now - entry.timestamp > WINDOW_SIZE_MS) { - this.cache.set(ip, { count: 1, timestamp: now }); + // Window expired - clear entry and allow + this.cache.delete(ip); return false; } - if (entry.count >= MAX_REQUESTS) { - return true; - } + // Check if at or over limit (don't increment here) + return entry.count >= MAX_REQUESTS; + } - entry.count++; - return false; + trackFailedAttempt(ip: string): void { + const now = Date.now(); + const entry = this.cache.get(ip); + + if (!entry || now - entry.timestamp > WINDOW_SIZE_MS) { + this.cache.set(ip, { count: 1, timestamp: now }); + } else { + entry.count++; + } } getRemainingAttempts(ip: string): number { diff --git a/subtask-2-2-verification.md b/subtask-2-2-verification.md deleted file mode 100644 index 0a78808..0000000 --- a/subtask-2-2-verification.md +++ /dev/null @@ -1,168 +0,0 @@ -# Subtask 2-2 Verification: Successful Login After Failed Attempts - -## Task Description -Test successful login after some failed attempts to ensure legitimate users can still authenticate before hitting the rate limit. - -## Code Review Analysis - -### Test Scenario Verification - -#### 1. Attempt 2-3 Failed Logins ✅ -**Implementation Support:** -- LoginForm.tsx lines 22-58: `handleLogin()` allows multiple login attempts -- Rate limiter tracks attempts per IP (rateLimiting.ts lines 16-36) -- MAX_REQUESTS = 5, so 2-3 failed attempts are well within the limit - -#### 2. Warning Message Shows Remaining Attempts ✅ -**Implementation Support:** -- LoginForm.tsx lines 46-50: After failed login, gets remaining attempts: - ```typescript - if (error) { - const remaining = rateLimiter.getRemainingAttempts(clientIp); - setRemainingAttempts(remaining); - throw error; - } - ``` -- LoginForm.tsx lines 90-97: Displays warning with remaining attempts: - ```typescript - {remainingAttempts !== null && remainingAttempts > 0 && ( -

- {t('rateLimit.warning.message', { - attempts: remainingAttempts, - unit: remainingAttempts === 1 ? t('rateLimit.warning.attempt') : t('rateLimit.warning.attempts') - })} -

- )} - ``` -- Translation keys support pluralization for accurate messaging - -**Example Flow:** -- After 1st failed attempt: "You have 4 attempts remaining" -- After 2nd failed attempt: "You have 3 attempts remaining" -- After 3rd failed attempt: "You have 2 attempts remaining" - -#### 3. Use Correct Credentials ✅ -**Implementation Support:** -- LoginForm.tsx lines 40-44: Supabase authentication attempt: - ```typescript - const supabase = createClient(); - const { error } = await supabase.auth.signInWithPassword({ - email, - password, - }); - ``` -- Standard authentication flow - accepts correct credentials at any point before lockout - -#### 4. Successful Login and Redirect to Dashboard ✅ -**Implementation Support:** -- LoginForm.tsx line 52: On successful authentication (no error): - ```typescript - router.push(`/${locale}/dashboard`); - ``` -- Redirects to localized dashboard route -- No error handling blocks this - direct redirect on success - -#### 5. Rate Limit Counter NOT Reset on Success ✅ (Security Measure) -**Implementation Support:** -- rateLimiting.ts lines 30-35: Counter incremented on EVERY call to `isRateLimited()`: - ```typescript - if (entry.count >= MAX_REQUESTS) { - return true; - } - entry.count++; - return false; - ``` -- LoginForm.tsx line 32: `isRateLimited()` called BEFORE authentication attempt -- Counter increments regardless of authentication outcome -- Only resets after time window expires (rateLimiting.ts lines 25-27): - ```typescript - if (now - entry.timestamp > WINDOW_SIZE_MS) { - this.cache.set(ip, { count: 1, timestamp: now }); - return false; - } - ``` - -**Security Rationale:** -This behavior prevents attackers from: -1. Making multiple failed attempts -2. Occasionally succeeding to reset the counter -3. Continuing the brute force attack - -The counter tracks ALL login attempts (successful and failed) within the time window. - -## Expected User Experience - -### Scenario: 3 Failed Attempts, Then Success - -1. **Attempt 1 (Wrong Password):** - - Rate limiter count: 1 - - Error: "Invalid login credentials" - - Warning: "You have 4 attempts remaining" - -2. **Attempt 2 (Wrong Password):** - - Rate limiter count: 2 - - Error: "Invalid login credentials" - - Warning: "You have 3 attempts remaining" - -3. **Attempt 3 (Wrong Password):** - - Rate limiter count: 3 - - Error: "Invalid login credentials" - - Warning: "You have 2 attempts remaining" - -4. **Attempt 4 (Correct Password):** - - Rate limiter count: 4 - - Success: Redirect to dashboard - - Counter NOT reset (still at 4) - - Remaining attempts: 1 (if user were to fail again) - -5. **Subsequent Login (within 15 min window):** - - User has 1 attempt remaining - - 5th failed attempt would trigger lockout - - 5th successful attempt would still work - -## Configuration -- **MAX_REQUESTS:** 5 attempts -- **WINDOW_SIZE_MS:** 900000ms (15 minutes) -- **Client IP:** Currently hardcoded to '127.0.0.1' (placeholder for production) - -## Acceptance Criteria Status - -✅ **Legitimate users can login after failed attempts**: Users have 5 total attempts before lockout -✅ **Clear feedback on remaining attempts**: Warning message displays after each failed attempt -✅ **Successful login redirects properly**: Direct redirect to dashboard on success -✅ **Security: Counter not reset on success**: All attempts (successful/failed) count toward limit -✅ **No regressions**: Standard login flow preserved, enhanced with rate limiting - -## Translation Support - -All messages support internationalization with proper pluralization: -- `rateLimit.warning.message` - "You have {attempts} {unit} remaining" -- `rateLimit.warning.attempt` / `rateLimit.warning.attempts` - Singular/plural forms -- Implemented in English (en), German (de), and Serbian (sr) - -## Code Quality Verification - -✅ **No console.log statements**: Clean code -✅ **Error handling**: Try-catch block with proper error display -✅ **Loading states**: Button disabled during authentication -✅ **State management**: React hooks properly used -✅ **Type safety**: TypeScript types enforced -✅ **Accessibility**: Semantic HTML with proper labels - -## Conclusion - -**Status: IMPLEMENTATION VERIFIED ✅** - -The code implementation correctly supports all verification steps for subtask-2-2: -1. Users can make multiple failed login attempts (2-3 as specified) -2. Warning messages accurately show remaining attempts after each failure -3. Correct credentials are accepted at any point before lockout -4. Successful login properly redirects to the dashboard -5. Rate limit counter correctly tracks ALL attempts as a security measure - -The implementation follows security best practices by not resetting the counter on successful login, preventing attackers from exploiting successful guesses to continue brute force attacks. - ---- -*Verification Method: Comprehensive Code Review* -*Date: 2026-01-25* -*Agent: AI Code Reviewer (Unable to perform manual browser testing)*