add outbound abuse guards

Digidai · Digidai · commit e7cede61340e · 2026-05-14T17:21:19.000+08:00
diff --git a/test/unit/rate-limit.test.ts b/test/unit/rate-limit.test.ts
@@ -97,6 +97,77 @@ describe('Per-mailbox Send Rate Limits', () => {
     expect(res.status).toBe(429)
   })
 
+  test('blocks known phishing-style account verification subjects from untrusted mailbox', async () => {
+    let resendCalled = false
+    globalThis.fetch = mock(async () => {
+      resendCalled = true
+      return new Response(JSON.stringify({ id: 'should-not-send' }))
+    }) as typeof fetch
+
+    const db = {
+      prepare: (sql: string) => ({
+        bind: (..._args: unknown[]) => ({
+          first: async () => {
+            if (sql.includes('suppression_list')) return null
+            if (sql.includes('auth_tokens')) return null
+            if (sql.includes("direction = 'inbound'")) return { count: 0 }
+            return null
+          },
+          run: async () => ({ meta: { changes: 1 } }),
+          all: async () => ({ results: [] }),
+        }),
+      }),
+    } as unknown as D1Database
+
+    const env = { DB: db, RESEND_API_KEY: 'test' } as any
+    const mailbox = 'fresh@mails0.com'
+    const request = new Request('http://localhost/api/send', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        from: mailbox,
+        to: ['recipient@example.com'],
+        subject: 'Action Required: Verify Your Account',
+        text: 'Please verify your account at https://example.com/login',
+      }),
+    })
+
+    const res = await handleSend(request, env, mailbox)
+    expect(res.status).toBe(400)
+    expect(resendCalled).toBe(false)
+    const data = await res.json() as { error: string }
+    expect(data.error).toContain('abuse protection')
+  })
+
+  test('returns 429 when global daily send limit is reached', async () => {
+    const db = {
+      prepare: (sql: string) => ({
+        bind: (..._args: unknown[]) => ({
+          first: async () => {
+            if (sql.includes('suppression_list')) return null
+            if (sql.includes('SELECT created_at FROM auth_tokens')) {
+              return { created_at: '2026-01-01T00:00:00.000Z' }
+            }
+            if (sql.includes("direction = 'inbound'")) return { count: 1 }
+            if (sql.includes('COALESCE(SUM(count)')) return { count: 201 }
+            if (sql.includes('daily_send_counts')) return { count: 1 }
+            return null
+          },
+          run: async () => ({ meta: { changes: 1 } }),
+          all: async () => ({ results: [] }),
+        }),
+      }),
+    } as unknown as D1Database
+
+    const env = { DB: db, RESEND_API_KEY: 'test', GLOBAL_DAILY_SEND_LIMIT: '200' } as any
+    const mailbox = 'sender@mails0.com'
+    const res = await handleSend(makeRequest(mailbox), env, mailbox)
+
+    expect(res.status).toBe(429)
+    const data = await res.json() as { error: string }
+    expect(data.error).toContain('Global daily send limit')
+  })
+
   test('skips rate limit when no mailbox (self-hosted)', async () => {
     globalThis.fetch = mock(async () => {
       return new Response(JSON.stringify({ id: 'resend-nomail' }))
diff --git a/worker/migrations/0009-claim-ip-abuse-guards.sql b/worker/migrations/0009-claim-ip-abuse-guards.sql
@@ -0,0 +1,7 @@
+-- Store claim source metadata so hosted deployments can rate-limit mailbox
+-- creation by client IP instead of relying only on coarse global limits.
+ALTER TABLE claim_sessions ADD COLUMN ip_address TEXT;
+ALTER TABLE claim_sessions ADD COLUMN user_agent TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_claim_sessions_ip_created ON claim_sessions(ip_address, created_at);
+CREATE INDEX IF NOT EXISTS idx_claim_sessions_created_at ON claim_sessions(created_at);
diff --git a/worker/schema.sql b/worker/schema.sql
@@ -100,11 +100,15 @@ CREATE TABLE IF NOT EXISTS claim_sessions (
   status TEXT NOT NULL DEFAULT 'pending',
   api_key TEXT,
   mailbox TEXT,
+  ip_address TEXT,
+  user_agent TEXT,
   created_at TEXT NOT NULL,
   expires_at TEXT NOT NULL
 );
 
 CREATE INDEX IF NOT EXISTS idx_claim_sessions_status ON claim_sessions(status, expires_at);
+CREATE INDEX IF NOT EXISTS idx_claim_sessions_ip_created ON claim_sessions(ip_address, created_at);
+CREATE INDEX IF NOT EXISTS idx_claim_sessions_created_at ON claim_sessions(created_at);
 
 -- Email labels for auto-classification
 CREATE TABLE IF NOT EXISTS email_labels (
diff --git a/worker/src/handlers/send.ts b/worker/src/handlers/send.ts
@@ -5,6 +5,20 @@ const MAX_TOTAL_RECIPIENTS = 50
 const MAX_ATTACHMENTS = 20
 const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024
 const MAX_TOTAL_ATTACHMENT_BYTES = 40 * 1024 * 1024
+const DEFAULT_GLOBAL_DAILY_SEND_LIMIT = 200
+const DEFAULT_NEW_MAILBOX_SEND_LIMIT = 5
+const DEFAULT_NEW_MAILBOX_SEND_WINDOW_HOURS = 24
+
+const KNOWN_ABUSE_SUBJECTS = new Set([
+  'action required: verify your account',
+  'payment required for your account',
+  'your account requires attention',
+  'your account is past due',
+  'important: account update needed',
+  'security alert: account activity',
+  'notice: account status change',
+  'urgent: account verification required',
+])
 
 export async function handleSend(request: Request, env: Env, mailbox?: string, ctx?: ExecutionContext): Promise<Response> {
   if (!env.RESEND_API_KEY) {
@@ -172,6 +186,27 @@ export async function handleSend(request: Request, env: Env, mailbox?: string, c
   // Check suppression list for all recipients (fail-closed: reject if check fails)
   // Normalize to lowercase: suppression_list stores lowercase, but senders may use mixed case
   const allRecipients = [...body.to, ...(body.cc ?? []), ...(body.bcc ?? [])].map(e => e.toLowerCase())
+
+  if (mailbox) {
+    try {
+      const abuseResult = await checkOutboundAbuseGuard(env, mailbox, {
+        subject: body.subject,
+        text: body.text ?? '',
+        html: body.html ?? '',
+        recipients: allRecipients,
+      })
+      if (abuseResult) {
+        return Response.json({ error: abuseResult }, { status: 400 })
+      }
+    } catch (err) {
+      console.error('Outbound abuse guard failed, rejecting send:', err)
+      return Response.json(
+        { error: 'Unable to verify message safety, please try again' },
+        { status: 503 },
+      )
+    }
+  }
+
   try {
     const suppressedCheck = await checkSuppressionList(env, allRecipients)
     if (suppressedCheck) {
@@ -404,6 +439,99 @@ export async function checkSuppressionList(
   return row ?? null
 }
 
+type OutboundAbuseInput = {
+  subject: string
+  text: string
+  html: string
+  recipients: string[]
+}
+
+async function checkOutboundAbuseGuard(
+  env: Env,
+  mailbox: string,
+  input: OutboundAbuseInput,
+): Promise<string | null> {
+  if (env.SEND_ABUSE_GUARD_ENABLED === '0' || env.SEND_ABUSE_GUARD_ENABLED === 'false') {
+    return null
+  }
+
+  const risk = scoreOutboundRisk(input)
+  if (risk.score < 3) return null
+
+  let mailboxCreatedAt: string | null = null
+  let inboundCount = 0
+  try {
+    const tokenRow = await env.DB.prepare(
+      'SELECT created_at FROM auth_tokens WHERE mailbox = ? LIMIT 1'
+    ).bind(mailbox).first<{ created_at: string }>()
+    mailboxCreatedAt = tokenRow?.created_at ?? null
+
+    const inboundRow = await env.DB.prepare(
+      "SELECT COUNT(*) as count FROM emails WHERE mailbox = ? AND direction = 'inbound'"
+    ).bind(mailbox).first<{ count: number }>()
+    inboundCount = inboundRow?.count ?? 0
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err)
+    if (msg.includes('no such table')) return null
+    throw err
+  }
+
+  const ageHours = mailboxCreatedAt ? hoursSince(mailboxCreatedAt) : null
+  const newOrUntrustedMailbox =
+    inboundCount === 0 ||
+    ageHours === null ||
+    ageHours < DEFAULT_NEW_MAILBOX_SEND_WINDOW_HOURS
+
+  if (KNOWN_ABUSE_SUBJECTS.has(input.subject.trim().toLowerCase()) && newOrUntrustedMailbox) {
+    return 'Message rejected by abuse protection: high-risk account/payment/security template'
+  }
+
+  if (risk.score >= 5 && newOrUntrustedMailbox) {
+    return `Message rejected by abuse protection: ${risk.flags.slice(0, 3).join(', ')}`
+  }
+
+  return null
+}
+
+function scoreOutboundRisk(input: OutboundAbuseInput): { score: number; flags: string[] } {
+  const subject = input.subject.trim().toLowerCase()
+  const body = `${input.text}\n${stripHtml(input.html)}`.toLowerCase()
+  const content = `${subject}\n${body}`
+  const flags: string[] = []
+  let score = 0
+
+  if (KNOWN_ABUSE_SUBJECTS.has(subject)) {
+    flags.push('known abuse subject')
+    score += 5
+  }
+  if (/\b(action required|urgent|immediate action|requires attention)\b/.test(subject)) {
+    flags.push('urgency language')
+    score += 1
+  }
+  if (/\b(verify|verification|confirm|update)\b/.test(content) && /\b(account|login|identity|email)\b/.test(content)) {
+    flags.push('account verification language')
+    score += 2
+  }
+  if (/\b(payment required|past due|overdue|unpaid|billing issue)\b/.test(content)) {
+    flags.push('payment pressure language')
+    score += 2
+  }
+  if (/\b(security alert|account activity|status change|suspicious activity)\b/.test(content)) {
+    flags.push('security alert impersonation language')
+    score += 2
+  }
+  if (/\b(click here|sign in|log in|login|reset password|update your account)\b/.test(content) && /https?:\/\//.test(content)) {
+    flags.push('credential-action link')
+    score += 2
+  }
+  if (input.recipients.length > 10) {
+    flags.push('bulk recipient fanout')
+    score += 1
+  }
+
+  return { score, flags }
+}
+
 /**
  * Check daily send rate limit for a mailbox using atomic increment-then-verify.
  * Increments the counter first (atomic), then checks the new count against the limit.
@@ -415,6 +543,12 @@ async function checkDailySendLimit(env: Env, mailbox: string): Promise<string |
   try {
     const today = new Date().toISOString().slice(0, 10) // YYYY-MM-DD
     const dailyLimit = env.DAILY_SEND_LIMIT ? parseInt(env.DAILY_SEND_LIMIT as string, 10) : 100
+    const globalDailyLimit = readNonNegativeInt(env.GLOBAL_DAILY_SEND_LIMIT, DEFAULT_GLOBAL_DAILY_SEND_LIMIT)
+    const newMailboxLimit = readNonNegativeInt(env.NEW_MAILBOX_SEND_LIMIT, DEFAULT_NEW_MAILBOX_SEND_LIMIT)
+    const newMailboxWindowHours = readNonNegativeInt(
+      env.NEW_MAILBOX_SEND_WINDOW_HOURS,
+      DEFAULT_NEW_MAILBOX_SEND_WINDOW_HOURS,
+    )
 
     // Atomic increment
     await env.DB.prepare(
@@ -434,7 +568,28 @@ async function checkDailySendLimit(env: Env, mailbox: string): Promise<string |
       ).bind(mailbox, today).run()
       return `Daily send limit reached (${row.count - 1}/${dailyLimit})`
     }
-    // Under limit: increment already applied, no further action needed
+
+    if (row && newMailboxLimit > 0 && row.count > newMailboxLimit) {
+      const tokenRow = await env.DB.prepare(
+        'SELECT created_at FROM auth_tokens WHERE mailbox = ? LIMIT 1'
+      ).bind(mailbox).first<{ created_at: string }>()
+      const ageHours = tokenRow?.created_at ? hoursSince(tokenRow.created_at) : null
+      if (ageHours === null || ageHours < newMailboxWindowHours) {
+        await decrementDailySendCount(env, mailbox, today)
+        return `New mailbox send limit reached (${newMailboxLimit}/${newMailboxWindowHours}h warmup window)`
+      }
+    }
+
+    if (globalDailyLimit > 0) {
+      const globalRow = await env.DB.prepare(
+        'SELECT COALESCE(SUM(count), 0) as count FROM daily_send_counts WHERE date = ?'
+      ).bind(today).first<{ count: number }>()
+      if ((globalRow?.count ?? 0) > globalDailyLimit) {
+        await decrementDailySendCount(env, mailbox, today)
+        return `Global daily send limit reached (${globalDailyLimit}/day)`
+      }
+    }
+    // Under limits: increment already applied, no further action needed
   } catch (err) {
     // Fail-open: rate limit check failure should not block sending
     const msg = err instanceof Error ? err.message : String(err)
@@ -445,6 +600,12 @@ async function checkDailySendLimit(env: Env, mailbox: string): Promise<string |
   return null
 }
 
+async function decrementDailySendCount(env: Env, mailbox: string, date: string): Promise<void> {
+  await env.DB.prepare(
+    'UPDATE daily_send_counts SET count = count - 1 WHERE mailbox = ? AND date = ?'
+  ).bind(mailbox, date).run()
+}
+
 /** @deprecated Rate limit counting is now handled inside checkDailySendLimit atomically. */
 async function incrementDailySendCount(env: Env, _mailbox: string): Promise<void> {
   // No-op: counting is now part of checkDailySendLimit's atomic increment-then-verify
@@ -464,3 +625,20 @@ function base64DecodedLength(value: string): number {
   const padding = value.endsWith('==') ? 2 : value.endsWith('=') ? 1 : 0
   return Math.max(0, Math.floor(value.length * 3 / 4) - padding)
 }
+
+function stripHtml(html: string): string {
+  return html.replace(/<[^>]*>/g, ' ')
+}
+
+function hoursSince(value: string): number | null {
+  const normalized = value.includes('T') ? value : `${value.replace(' ', 'T')}Z`
+  const parsed = Date.parse(normalized)
+  if (!Number.isFinite(parsed)) return null
+  return Math.max(0, (Date.now() - parsed) / 3_600_000)
+}
+
+function readNonNegativeInt(value: string | undefined, fallback: number): number {
+  if (!value) return fallback
+  const parsed = Number.parseInt(value, 10)
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback
+}
diff --git a/worker/src/types.ts b/worker/src/types.ts
@@ -12,6 +12,10 @@ export interface Env {
   WEBHOOK_SECRET?: string
   RESEND_WEBHOOK_SECRET?: string
   DAILY_SEND_LIMIT?: string
+  GLOBAL_DAILY_SEND_LIMIT?: string
+  NEW_MAILBOX_SEND_LIMIT?: string
+  NEW_MAILBOX_SEND_WINDOW_HOURS?: string
+  SEND_ABUSE_GUARD_ENABLED?: string
   DAILY_CLAIM_LIMIT?: string
 }
 
