rate-limiter.js

/**
 * ExploitInject Hybrid Cross-Browser Form Rate Limiter & Anonymous Geo Tracker
 * Enforces 1 form submission per 5 minutes per IP Address & Email Address.
 * Ensures IP Address & Country are attached under all standard field names for FormFarm delivery.
 */

(function () {
    const RATE_LIMIT_MS = 5 * 60 * 1000; // 5 minutes
    const STORAGE_KEY = 'app_form_submissions';
    const GEO_CACHE_KEY = 'user_geo_data';

    let cachedGeo = { ip: '', country: '' };

    // 1. Fetch IP & Country Anonymously
    async function fetchGeoData() {
        try {
            const cached = sessionStorage.getItem(GEO_CACHE_KEY);
            if (cached) {
                const parsed = JSON.parse(cached);
                if (parsed && parsed.ip) {
                    cachedGeo = parsed;
                    updateAllFormGeoFields();
                    return cachedGeo;
                }
            }
        } catch (e) { }

        // Primary API: ipapi.co
        try {
            const controller = new AbortController();
            const timeoutId = setTimeout(() => controller.abort(), 3000);
            const res = await fetch('https://ipapi.co/json/', { signal: controller.signal });
            clearTimeout(timeoutId);
            if (res.ok) {
                const data = await res.json();
                if (data && data.ip) {
                    cachedGeo = {
                        ip: data.ip,
                        country: data.country_name || data.country || 'Unknown'
                    };
                    saveAndApplyGeo();
                    return cachedGeo;
                }
            }
        } catch (e) { }

        // Fallback 1: country.is
        try {
            const controller = new AbortController();
            const timeoutId = setTimeout(() => controller.abort(), 3000);
            const res = await fetch('https://api.country.is/', { signal: controller.signal });
            clearTimeout(timeoutId);
            if (res.ok) {
                const data = await res.json();
                if (data && data.ip) {
                    cachedGeo = {
                        ip: data.ip,
                        country: data.country || 'Unknown'
                    };
                    saveAndApplyGeo();
                    return cachedGeo;
                }
            }
        } catch (e) { }

        // Fallback 2: ipify
        try {
            const res = await fetch('https://api.ipify.org?format=json');
            if (res.ok) {
                const data = await res.json();
                if (data && data.ip) {
                    cachedGeo = {
                        ip: data.ip,
                        country: cachedGeo.country || 'Unknown'
                    };
                    saveAndApplyGeo();
                    return cachedGeo;
                }
            }
        } catch (e) { }

        return cachedGeo;
    }

    function saveAndApplyGeo() {
        try {
            sessionStorage.setItem(GEO_CACHE_KEY, JSON.stringify(cachedGeo));
        } catch (e) { }
        updateAllFormGeoFields();
    }

    // Ensures hidden fields exist with field names FormFarm formats into email notifications
    function updateFormGeoFields(form) {
        if (!form) return;

        const ipVal = cachedGeo.ip || 'Detecting...';
        const countryVal = cachedGeo.country || 'Detecting...';

        // Target field names that FormFarm and form services include in emails
        const fieldMappings = [
            { name: 'IP Address', value: ipVal },
            { name: 'Country', value: countryVal },
            { name: 'user_ip', value: ipVal },
            { name: 'user_country', value: countryVal }
        ];

        fieldMappings.forEach(field => {
            let input = form.querySelector(`input[name="${field.name}"]`);
            if (!input) {
                input = document.createElement('input');
                input.type = 'hidden';
                input.name = field.name;
                form.appendChild(input);
            }
            if (field.value && field.value !== 'Detecting...') {
                input.value = field.value;
            } else if (!input.value) {
                input.value = field.value;
            }
        });
    }

    function updateAllFormGeoFields() {
        document.querySelectorAll('form').forEach(updateFormGeoFields);
    }

    // Get active submissions from localStorage, clearing expired entries (>5 mins)
    function getValidSubmissions() {
        let submissions = [];
        try {
            const raw = localStorage.getItem(STORAGE_KEY);
            if (raw) {
                submissions = JSON.parse(raw);
            }
        } catch (e) { }

        const now = Date.now();
        submissions = submissions.filter(item => (now - item.timestamp) < RATE_LIMIT_MS);
        try {
            localStorage.setItem(STORAGE_KEY, JSON.stringify(submissions));
        } catch (e) { }
        return submissions;
    }

    function recordLocalSubmission(ip, email) {
        const submissions = getValidSubmissions();
        submissions.push({
            ip: ip,
            email: email,
            timestamp: Date.now()
        });
        try {
            localStorage.setItem(STORAGE_KEY, JSON.stringify(submissions));
        } catch (e) { }
    }

    // Display user-friendly rate limit error message
    function showRateLimitError(form, remainingSec) {
        const mins = Math.floor(remainingSec / 60);
        const secs = remainingSec % 60;
        const timeStr = mins > 0 ? `${mins}m ${secs}s` : `${secs}s`;

        let msgEl = form.querySelector('.rate-limit-error-banner');
        if (!msgEl) {
            msgEl = document.createElement('div');
            msgEl.className = 'rate-limit-error-banner';
            msgEl.style.cssText = `
                background-color: rgba(239, 68, 68, 0.15);
                border: 1px solid rgba(239, 68, 68, 0.5);
                color: #f87171;
                padding: 12px 16px;
                border-radius: 8px;
                margin-top: 15px;
                margin-bottom: 15px;
                font-size: 14px;
                line-height: 1.5;
                text-align: center;
                box-shadow: 0 4px 12px rgba(0, 0, 0, 0.2);
                animation: fadeIn 0.3s ease-in-out;
            `;
            const submitBtn = form.querySelector('button[type="submit"], input[type="submit"]');
            if (submitBtn && submitBtn.parentNode) {
                submitBtn.parentNode.insertBefore(msgEl, submitBtn);
            } else {
                form.appendChild(msgEl);
            }
        }

        msgEl.innerHTML = `<strong>⚠️ Rate Limit Exceeded</strong><br>To prevent spam, form submissions are limited to once every 5 minutes. Please wait <strong>${timeStr}</strong> before submitting again.`;
        msgEl.style.display = 'block';

        try {
            msgEl.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
        } catch (e) { }
    }

    function removeRateLimitError(form) {
        const msgEl = form.querySelector('.rate-limit-error-banner');
        if (msgEl) {
            msgEl.style.display = 'none';
        }
    }

    function resetSubmitButtons(form) {
        setTimeout(() => {
            const btns = form.querySelectorAll('button[type="submit"], input[type="submit"]');
            btns.forEach(btn => {
                btn.disabled = false;
                btn.classList.remove('loading');
            });
        }, 50);
    }

    // Check with server-side PHP endpoint (rate-check.php) for cross-browser rate limit
    async function checkServerRateLimit(email, ip) {
        try {
            if (window.location.protocol === 'file:') return null;
            const res = await fetch('/rate-check.php', {
                method: 'POST',
                headers: { 'Content-Type': 'application/json' },
                body: JSON.stringify({ email: email, ip: ip })
            });

            if (res.ok) {
                return await res.json();
            }
        } catch (e) { }
        return null;
    }

    // Main Form Submit Interceptor (Capturing Phase)
    async function handleFormSubmit(e) {
        const form = e.target;
        if (!form || form.tagName !== 'FORM') return;

        // Skip if already rate-verified for this submission event
        if (form.dataset.rateVerified === 'true') {
            delete form.dataset.rateVerified;
            // Always refresh geo fields right before final post
            updateFormGeoFields(form);
            return;
        }

        // Make sure geo data is fetched if still empty
        if (!cachedGeo.ip) {
            await fetchGeoData();
        }
        updateFormGeoFields(form);

        // Extract Email
        let userEmail = '';
        const emailInput = form.querySelector('input[type="email"], input[name="email"], input[name="fi-sender-email"], input[name="user_email"]');
        if (emailInput && emailInput.value) {
            userEmail = emailInput.value.trim().toLowerCase();
        }

        const userIp = cachedGeo.ip || '';
        const now = Date.now();

        // 1. Fast Local Check
        const submissions = getValidSubmissions();
        const localMatch = submissions.find(item => {
            const ipMatch = userIp && item.ip && item.ip === userIp;
            const emailMatch = userEmail && item.email && item.email === userEmail;
            return ipMatch || emailMatch;
        });

        if (localMatch) {
            e.preventDefault();
            e.stopPropagation();
            e.stopImmediatePropagation();

            const elapsed = now - localMatch.timestamp;
            const remainingSec = Math.ceil((RATE_LIMIT_MS - elapsed) / 1000);
            showRateLimitError(form, remainingSec);
            resetSubmitButtons(form);
            return false;
        }

        // 2. Cross-Browser Server Check (rate-check.php)
        if (window.location.protocol !== 'file:') {
            e.preventDefault();
            e.stopPropagation();
            e.stopImmediatePropagation();

            const serverRes = await checkServerRateLimit(userEmail, userIp);
            if (serverRes) {
                if (serverRes.clientIp && !cachedGeo.ip) {
                    cachedGeo.ip = serverRes.clientIp;
                }
                if (serverRes.allowed === false) {
                    recordLocalSubmission(userIp, userEmail);
                    showRateLimitError(form, serverRes.remainingSec || 300);
                    resetSubmitButtons(form);
                    return false;
                }
            }

            // Allowed by server -> sync local and re-trigger submission
            removeRateLimitError(form);
            recordLocalSubmission(userIp, userEmail);

            // Update geo fields again right before final submit
            updateFormGeoFields(form);

            form.dataset.rateVerified = 'true';

            // Re-trigger form submission smoothly
            if (typeof form.requestSubmit === 'function') {
                form.requestSubmit();
            } else {
                form.submit();
            }
            return;
        }

        // 3. File protocol / Local fallback
        removeRateLimitError(form);
        recordLocalSubmission(userIp, userEmail);
    }

    // Initialize
    document.addEventListener('DOMContentLoaded', () => {
        updateAllFormGeoFields();
        fetchGeoData();
    });

    // Capture submit events BEFORE any other page handlers
    document.addEventListener('submit', handleFormSubmit, true);

    // Initial fetch in case DOM is already loaded
    if (document.readyState === 'interactive' || document.readyState === 'complete') {
        updateAllFormGeoFields();
        fetchGeoData();
    }
})();