From 201a23535750601b0506a4503627ad598f5a4156 Mon Sep 17 00:00:00 2001
From: Abdullah Atta <abdullahatta@streetwriters.co>
Date: Mon, 25 Aug 2025 10:46:04 +0500
Subject: [PATCH] identity: make otp rate limiting more strict

---
 Streetwriters.Identity/Controllers/MFAController.cs | 2 +-
 Streetwriters.Identity/Services/MFAService.cs       | 2 ++
 Streetwriters.Identity/Startup.cs                   | 8 ++++++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/Streetwriters.Identity/Controllers/MFAController.cs b/Streetwriters.Identity/Controllers/MFAController.cs
index bc6c042..f2bc718 100644
--- a/Streetwriters.Identity/Controllers/MFAController.cs
+++ b/Streetwriters.Identity/Controllers/MFAController.cs
@@ -91,7 +91,7 @@ namespace Streetwriters.Identity.Controllers
         [HttpPost("send")]
         [Authorize("mfa")]
         [Authorize(LocalApi.PolicyName)]
-        [EnableRateLimiting("strict")]
+        [EnableRateLimiting("super_strict")]
         public async Task<IActionResult> RequestCode([FromForm] string type)
         {
             var client = Clients.FindClientById(User.FindFirstValue("client_id"));
diff --git a/Streetwriters.Identity/Services/MFAService.cs b/Streetwriters.Identity/Services/MFAService.cs
index f8c82e0..11603d0 100644
--- a/Streetwriters.Identity/Services/MFAService.cs
+++ b/Streetwriters.Identity/Services/MFAService.cs
@@ -24,6 +24,7 @@ using System.Text;
 using System.Text.Encodings.Web;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
+using Streetwriters.Common;
 using Streetwriters.Common.Enums;
 using Streetwriters.Common.Interfaces;
 using Streetwriters.Common.Models;
@@ -185,6 +186,7 @@ namespace Streetwriters.Identity.Services
                 case "sms":
                     await UserManager.SetPhoneNumberAsync(user, form.PhoneNumber);
                     var id = await SMSSender.SendOTPAsync(form.PhoneNumber, client);
+                    await Slogger<MFAService>.Info("SendOTPAsync", user.Id.ToString(), id);
                     await this.ReplaceClaimAsync(user, MFAService.SMS_ID_CLAIM, id);
                     break;
 
diff --git a/Streetwriters.Identity/Startup.cs b/Streetwriters.Identity/Startup.cs
index 2b63d57..129cb2b 100644
--- a/Streetwriters.Identity/Startup.cs
+++ b/Streetwriters.Identity/Startup.cs
@@ -145,6 +145,14 @@ namespace Streetwriters.Identity
                     options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
                     options.QueueLimit = 0;
                 });
+                options.AddSlidingWindowLimiter("super_strict", options =>
+                {
+                    options.PermitLimit = 1;
+                    options.Window = TimeSpan.FromMinutes(1);
+                    options.SegmentsPerWindow = 1;
+                    options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+                    options.QueueLimit = 2;
+                });
             });
 
             services.AddAuthorization(options =>