Merge pull request #6 from adab-tech/claude/globalopportunities-deploy-yukhn1

Add login rate-limiting, manual opportunity entry, and a public submission address

Author: adab-tech

backend/app/routes/admin_auth.py

@@ -17,12 +17,25 @@
 
 from app.config import settings
 from app.security import create_session_token, verify_password, verify_session_token
+from app.services.rate_limit import LockedOutError, LoginAttemptLimiter
 
 router = APIRouter(prefix="/admin", tags=["Admin Auth"])
 
 SESSION_COOKIE_NAME = "of_admin_session"
 _SESSION_MAX_AGE_SECONDS = 12 * 60 * 60
 
+# Keyed by submitted email, not caller IP — there's exactly one valid
+# admin account (see module docstring), so this directly protects it
+# regardless of how many source addresses an attacker spreads across.
+_LOGIN_MAX_ATTEMPTS = 5
+_LOGIN_WINDOW_SECONDS = 15 * 60
+_LOGIN_LOCKOUT_SECONDS = 15 * 60
+_login_limiter = LoginAttemptLimiter(
+    max_attempts=_LOGIN_MAX_ATTEMPTS,
+    window_seconds=_LOGIN_WINDOW_SECONDS,
+    lockout_seconds=_LOGIN_LOCKOUT_SECONDS,
+)
+
 
 class LoginRequest(BaseModel):
     email: str
@@ -42,14 +55,26 @@ def login(request: LoginRequest, response: Response):
             "SESSION_SECRET_KEY unset).",
         )
 
+    login_key = request.email.strip().lower()
+    try:
+        _login_limiter.check(login_key)
+    except LockedOutError:
+        wait = _login_limiter.seconds_remaining(login_key)
+        raise HTTPException(
+            status_code=429,
+            detail=f"Too many failed attempts. Try again in {wait}s.",
+        ) from None
+
     # Always run verify_password, even on an email mismatch, so a wrong
     # email doesn't return faster than a wrong password and leak which
     # one was wrong via response timing.
-    email_matches = hmac.compare_digest(request.email.strip().lower(), settings.ADMIN_EMAIL.strip().lower())
+    email_matches = hmac.compare_digest(login_key, settings.ADMIN_EMAIL.strip().lower())
     password_matches = verify_password(request.password, settings.ADMIN_PASSWORD_HASH)
     if not (email_matches and password_matches):
+        _login_limiter.record_failure(login_key)
         raise HTTPException(status_code=401, detail="Invalid email or password.")
 
+    _login_limiter.record_success(login_key)
     token = create_session_token(settings.SESSION_SECRET_KEY)
     response.set_cookie(
         key=SESSION_COOKIE_NAME,

backend/app/routes/admin_listings.py

@@ -14,7 +14,12 @@
 from app.database import get_db
 from app.models import Opportunity
 from app.routes.admin_auth import require_admin_session
-from app.schemas import AdminOpportunityUpdate, OpportunityResponse, PaginatedOpportunities
+from app.schemas import (
+    AdminOpportunityCreate,
+    AdminOpportunityUpdate,
+    OpportunityResponse,
+    PaginatedOpportunities,
+)
 from app.scrapers.dedup import normalize_title
 from app.scrapers.url_utils import clean_url
 
@@ -74,6 +79,41 @@ def list_all(
     )
 
 
+@router.post("/", response_model=OpportunityResponse, status_code=201)
+def create(request: AdminOpportunityCreate, db: Session = Depends(get_db)):
+    """Manually add a listing. Unlike every automated ingest path, this
+    one is trusted by construction (an admin typed it in), so it skips
+    the moderation queue entirely and goes live immediately.
+    """
+    cleaned_url = clean_url(request.url)
+    if cleaned_url is None:
+        raise HTTPException(status_code=400, detail="Invalid URL: must be a plain http:// or https:// link.")
+
+    if db.query(Opportunity).filter(Opportunity.url == cleaned_url).first():
+        raise HTTPException(status_code=409, detail="An opportunity with this URL already exists.")
+
+    opp = Opportunity(
+        title=request.title.strip(),
+        title_normalized=normalize_title(request.title),
+        description=request.description,
+        summary=request.summary,
+        opportunity_type=request.opportunity_type.lower(),
+        field=request.field,
+        location=request.location,
+        deadline=request.deadline,
+        deadline_at=request.deadline_at,
+        url=cleaned_url,
+        source_name=request.source_name or "Manual entry",
+        tags=request.tags,
+        is_active=True,
+        review_status="approved",
+    )
+    db.add(opp)
+    db.commit()
+    db.refresh(opp)
+    return opp
+
+
 @router.patch("/{opportunity_id}", response_model=OpportunityResponse)
 def update(opportunity_id: int, request: AdminOpportunityUpdate, db: Session = Depends(get_db)):
     opp = _get_or_404(db, opportunity_id)

backend/app/schemas.py

@@ -115,6 +115,26 @@ class BulkModerationResponse(BaseModel):
     ids: list[int]
 
 
+class AdminOpportunityCreate(BaseModel):
+    """A manually-added listing — trusted by definition (an admin typed
+    it in directly), so it skips the moderation queue and goes live
+    immediately as review_status="approved", unlike the low-trust
+    open web-search discovery path (see routes/moderation.py).
+    """
+
+    title: str = Field(min_length=1, max_length=500)
+    opportunity_type: str
+    url: str
+    description: str | None = None
+    summary: str | None = None
+    field: str | None = None
+    location: str | None = None
+    deadline: str | None = None
+    deadline_at: date | None = None
+    source_name: str | None = None
+    tags: str | None = None
+
+
 class AdminOpportunityUpdate(BaseModel):
     """Partial update for the admin listing-management table — every
     field optional, only the ones the admin actually changed are sent.

backend/app/services/rate_limit.py

@@ -42,3 +42,61 @@ def check(self, key: str) -> None:
             if last is not None and now - last < self._seconds:
                 raise RateLimitedError()
             self._last_seen[key] = now
+
+
+class LockedOutError(Exception):
+    """Raised when `key` is currently locked out after too many failures."""
+
+
+class LoginAttemptLimiter:
+    """Locks a key out after too many failed attempts in a row.
+
+    Keyed by the submitted email rather than caller IP: this app has
+    exactly one valid admin account (single-admin by design — see
+    routes/admin_auth.py), so locking out repeated failures against
+    that one email directly protects the real target regardless of how
+    many source IPs an attacker spreads requests across. A wrong email
+    can never succeed anyway, so tracking those separately costs
+    nothing.
+    """
+
+    def __init__(self, max_attempts: int, window_seconds: float, lockout_seconds: float):
+        self._max_attempts = max_attempts
+        self._window = window_seconds
+        self._lockout = lockout_seconds
+        self._lock = threading.Lock()
+        self._failures: dict[str, tuple[int, float]] = {}  # key -> (count, first_failure_at)
+        self._locked_until: dict[str, float] = {}
+
+    def check(self, key: str) -> None:
+        """Raise LockedOutError if `key` is currently locked out."""
+        now = time.monotonic()
+        with self._lock:
+            locked_until = self._locked_until.get(key)
+            if locked_until is not None and now < locked_until:
+                raise LockedOutError()
+
+    def record_failure(self, key: str) -> None:
+        now = time.monotonic()
+        with self._lock:
+            count, first_failure_at = self._failures.get(key, (0, now))
+            if now - first_failure_at > self._window:
+                count, first_failure_at = 0, now
+            count += 1
+            if count >= self._max_attempts:
+                self._locked_until[key] = now + self._lockout
+                self._failures.pop(key, None)
+            else:
+                self._failures[key] = (count, first_failure_at)
+
+    def record_success(self, key: str) -> None:
+        with self._lock:
+            self._failures.pop(key, None)
+            self._locked_until.pop(key, None)
+
+    def seconds_remaining(self, key: str) -> int:
+        with self._lock:
+            locked_until = self._locked_until.get(key)
+        if locked_until is None:
+            return 0
+        return max(0, int(locked_until - time.monotonic()))

backend/tests/test_admin_auth.py

@@ -60,8 +60,11 @@ def test_expired_token_fails(self):
 class TestLoginEndpoint:
     def setup_method(self):
         from app.config import settings
+        from app.routes import admin_auth
 
         self._prior = (settings.ADMIN_EMAIL, settings.ADMIN_PASSWORD_HASH, settings.SESSION_SECRET_KEY)
+        admin_auth._login_limiter._failures.clear()
+        admin_auth._login_limiter._locked_until.clear()
 
     def teardown_method(self):
         from app.config import settings
@@ -118,6 +121,84 @@ def test_login_email_check_is_case_insensitive(self, monkeypatch):
         assert response.status_code == 200
 
 
+class TestLoginLockout:
+    """No lockout existed before this — an attacker could brute-force
+    the single admin password with unlimited attempts. See
+    app/services/rate_limit.py::LoginAttemptLimiter.
+    """
+
+    def setup_method(self):
+        from app.config import settings
+        from app.routes import admin_auth
+
+        self.admin_auth = admin_auth
+        self._prior = (settings.ADMIN_EMAIL, settings.ADMIN_PASSWORD_HASH, settings.SESSION_SECRET_KEY)
+        admin_auth._login_limiter._failures.clear()
+        admin_auth._login_limiter._locked_until.clear()
+        settings.ADMIN_EMAIL = "lockout-test@example.org"
+        settings.ADMIN_PASSWORD_HASH = self._hash("a-strong-password-123")
+        settings.SESSION_SECRET_KEY = "test-secret"
+
+    def teardown_method(self):
+        from app.config import settings
+
+        settings.ADMIN_EMAIL, settings.ADMIN_PASSWORD_HASH, settings.SESSION_SECRET_KEY = self._prior
+        self.admin_auth._login_limiter._failures.clear()
+        self.admin_auth._login_limiter._locked_until.clear()
+
+    @staticmethod
+    def _hash(password: str) -> str:
+        from app.security import hash_password
+
+        return hash_password(password)
+
+    def _bad_login(self):
+        return client.post(
+            "/api/v1/admin/login",
+            json={"email": "lockout-test@example.org", "password": "wrong-password"},
+        )
+
+    def test_locks_out_after_max_attempts(self):
+        for _ in range(self.admin_auth._LOGIN_MAX_ATTEMPTS):
+            response = self._bad_login()
+            assert response.status_code == 401
+        # One more, still within the window, now locked out.
+        locked = self._bad_login()
+        assert locked.status_code == 429
+
+    def test_locked_out_rejects_even_the_correct_password(self):
+        for _ in range(self.admin_auth._LOGIN_MAX_ATTEMPTS):
+            self._bad_login()
+        response = client.post(
+            "/api/v1/admin/login",
+            json={"email": "lockout-test@example.org", "password": "a-strong-password-123"},
+        )
+        assert response.status_code == 429
+
+    def test_successful_login_resets_the_failure_count(self):
+        for _ in range(self.admin_auth._LOGIN_MAX_ATTEMPTS - 1):
+            self._bad_login()
+        success = client.post(
+            "/api/v1/admin/login",
+            json={"email": "lockout-test@example.org", "password": "a-strong-password-123"},
+        )
+        assert success.status_code == 200
+        # Failure count should be cleared, not still one shy of lockout.
+        response = self._bad_login()
+        assert response.status_code == 401
+
+    def test_different_email_is_not_affected_by_another_lockout(self):
+        for _ in range(self.admin_auth._LOGIN_MAX_ATTEMPTS):
+            self._bad_login()
+        # A wrong-but-different email must not be caught by the
+        # lockout recorded for "lockout-test@example.org".
+        response = client.post(
+            "/api/v1/admin/login",
+            json={"email": "someone-else@example.org", "password": "whatever"},
+        )
+        assert response.status_code == 401
+
+
 class TestSessionEndpoint:
     def setup_method(self):
         from app.config import settings

backend/tests/test_admin_listings.py

@@ -94,6 +94,73 @@ def test_search_filters_by_title(self):
         assert response.status_code == 200
         assert response.json()["total"] == 1
 
+    def test_create_adds_an_approved_active_listing(self):
+        response = client.post(
+            "/api/v1/admin/opportunities/",
+            json={
+                "title": "Manually Added Fellowship",
+                "opportunity_type": "fellowship",
+                "url": f"{_TEST_URL_PREFIX}manual-1",
+                "field": "Public Health",
+                "location": "Kenya",
+            },
+            cookies=self._cookies(),
+        )
+        assert response.status_code == 201
+        body = response.json()
+        assert body["is_active"] is True
+        assert body["review_status"] == "approved"
+        assert body["title"] == "Manually Added Fellowship"
+        assert body["source_name"] == "Manual entry"
+
+        row = self.db.query(Opportunity).filter(Opportunity.id == body["id"]).first()
+        assert row is not None
+        assert row.title_normalized == "manually added fellowship"
+
+    def test_create_rejects_javascript_url(self):
+        response = client.post(
+            "/api/v1/admin/opportunities/",
+            json={
+                "title": "Bad URL Listing",
+                "opportunity_type": "grant",
+                "url": "javascript:alert(1)",
+            },
+            cookies=self._cookies(),
+        )
+        assert response.status_code == 400
+
+    def test_create_rejects_duplicate_url(self):
+        _make_row(self.db, "dup", url=f"{_TEST_URL_PREFIX}dup")
+        response = client.post(
+            "/api/v1/admin/opportunities/",
+            json={
+                "title": "Different Title, Same URL",
+                "opportunity_type": "grant",
+                "url": f"{_TEST_URL_PREFIX}dup",
+            },
+            cookies=self._cookies(),
+        )
+        assert response.status_code == 409
+
+    def test_create_requires_title_and_type(self):
+        response = client.post(
+            "/api/v1/admin/opportunities/",
+            json={"url": f"{_TEST_URL_PREFIX}missing-fields"},
+            cookies=self._cookies(),
+        )
+        assert response.status_code == 422
+
+    def test_create_requires_session(self):
+        response = client.post(
+            "/api/v1/admin/opportunities/",
+            json={
+                "title": "No Session",
+                "opportunity_type": "job",
+                "url": f"{_TEST_URL_PREFIX}no-session",
+            },
+        )
+        assert response.status_code == 401
+
     def test_update_edits_fields(self):
         opp = _make_row(self.db, "edit-me", title="Original Title")
         response = client.patch(

frontend/admin.html

@@ -202,6 +202,7 @@ <h2 style="margin-bottom:0;">All listings</h2>
             <option value="other">Other</option>
           </select>
           <button type="button" class="btn-secondary" id="listingsRefresh">Refresh</button>
+          <button type="button" class="btn-primary" id="listingsAddBtn">+ Add opportunity</button>
         </div>
         <div class="mod-list" id="listingsList"></div>
         <p class="mod-empty" id="listingsEmpty" style="display:none;">No listings match this search.</p>
@@ -214,7 +215,7 @@ <h2 style="margin-bottom:0;">All listings</h2>
   <!-- Edit listing modal -->
   <div id="editModal" class="modal-overlay" style="display:none">
     <div class="modal-box edit-modal-box">
-      <h3>Edit listing</h3>
+      <h3 id="editModalTitle">Edit listing</h3>
       <form id="editForm">
         <input type="hidden" id="editId" />
         <div class="edit-form-grid">
@@ -274,7 +275,7 @@ <h3>Edit listing</h3>
         </div>
         <div style="display:flex; gap:10px; justify-content:flex-end;">
           <button type="button" class="btn-secondary" id="closeEditModal">Cancel</button>
-          <button type="submit" class="btn-primary">Save changes</button>
+          <button type="submit" class="btn-primary" id="editSubmitBtn">Save changes</button>
         </div>
       </form>
       <p id="editError" style="color:#b91c1c; display:none; font-size:.85rem; margin-top:10px;"></p>