add ALTCHA challenge endpoint and env config.

GET /api/altcha/challenge, nullcart-style env validation, and ALTCHA_ENABLED wiring.

backend/src/AppModule.ts

@@ -1,7 +1,9 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService, registerAs } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
-import { getAppConfig, getPostgresConfig } from './config';
+import { getAltchaConfig, getAppConfig, getPostgresConfig } from './config';
+import { validate } from './config/validate';
+import { AltchaModule } from './modules/altcha/AltchaModule';
 import { HealthCheckModule } from './modules/healthCheck/HealthCheckModule';
 import { StorageModule } from './modules/storage/StorageModule';
 import { UploadModule } from './modules/upload/UploadModule';
@@ -11,13 +13,19 @@ import { Config } from './types/Config';
     imports: [
         ConfigModule.forRoot({
             isGlobal: true,
-            load: [registerAs('postgres', getPostgresConfig), registerAs('app', getAppConfig)]
+            validate,
+            load: [
+                registerAs('postgres', getPostgresConfig),
+                registerAs('app', getAppConfig),
+                registerAs('altcha', getAltchaConfig)
+            ]
         }),
         TypeOrmModule.forRootAsync({
             useFactory: (configService: ConfigService) => configService.get('postgres') as Config['postgres'],
             inject: [ConfigService]
         }),
         HealthCheckModule,
+        AltchaModule,
         StorageModule,
         UploadModule
     ]

backend/src/config/index.ts

@@ -1,5 +1,6 @@
 import { AppConfig } from '../types/AppConfig';
-import { PostgresConfig } from '../types/Config';
+import { AltchaConfig } from '../types/AltchaConfig';
+import { PostgresConfig } from '../types/PostgresConfig';
 import { NodeEnv } from '../types/NodeEnv';
 
 const env = (key: string): string => process.env[key] || '';
@@ -23,6 +24,14 @@ export const getPostgresConfig = (): PostgresConfig => {
     };
 };
 
+export const getAltchaConfig = (): AltchaConfig => {
+    return {
+        enabled: isEnabled('ALTCHA_ENABLED'),
+        hmacKey: env('ALTCHA_HMAC_KEY'),
+        maxNumber: envInt('ALTCHA_MAX_NUMBER')
+    };
+};
+
 export const getAppConfig = (): AppConfig => {
     const rawOrigins = env('CORS_ORIGINS');
 

backend/src/config/validate.ts

@@ -0,0 +1,129 @@
+import { plainToClass } from 'class-transformer';
+import { IsBoolean, IsEnum, IsNotEmpty, IsNumber, IsString, Max, Min, validateSync } from 'class-validator';
+import { NodeEnv } from '../types/NodeEnv';
+
+class EnvironmentVariables {
+    @IsNotEmpty()
+    @IsEnum(NodeEnv)
+    NODE_ENV: NodeEnv;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(65535)
+    BACKEND_PORT: number;
+
+    @IsNotEmpty()
+    @IsString()
+    POSTGRES_USER: string;
+
+    @IsNotEmpty()
+    @IsString()
+    POSTGRES_PASSWORD: string;
+
+    @IsNotEmpty()
+    @IsString()
+    POSTGRES_DB: string;
+
+    @IsNotEmpty()
+    @IsString()
+    POSTGRES_HOST: string;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(65535)
+    POSTGRES_PORT: number;
+
+    @IsNotEmpty()
+    @IsBoolean()
+    POSTGRES_MIGRATIONS_RUN: boolean;
+
+    @IsNotEmpty()
+    @IsString()
+    CORS_ORIGINS: string;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(100)
+    MAX_IMAGES_PER_UPLOAD: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(50 * 1024 * 1024)
+    MULTER_MAX_FILE_BYTES: number;
+
+    @IsNotEmpty()
+    @IsBoolean()
+    ALTCHA_ENABLED: boolean;
+
+    @IsNotEmpty()
+    @IsString()
+    ALTCHA_HMAC_KEY: string;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(1_000_000)
+    ALTCHA_MAX_NUMBER: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(3650)
+    NEVER_MODE_INACTIVITY_DAYS: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1000)
+    @Max(3_600_000)
+    THROTTLE_UPLOAD_TTL_MS: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(10_000)
+    THROTTLE_UPLOAD_LIMIT: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1000)
+    @Max(3_600_000)
+    THROTTLE_HOTLINK_PER_IP_TTL_MS: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(1_000_000)
+    THROTTLE_HOTLINK_PER_IP_LIMIT: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1000)
+    @Max(3_600_000)
+    THROTTLE_HOTLINK_PER_ID_TTL_MS: number;
+
+    @IsNotEmpty()
+    @IsNumber()
+    @Min(1)
+    @Max(1_000_000)
+    THROTTLE_HOTLINK_PER_ID_LIMIT: number;
+}
+
+export const validate = (config: Record<string, unknown>) => {
+    const validatedConfig = plainToClass(EnvironmentVariables, config, {
+        enableImplicitConversion: true
+    });
+
+    const errors = validateSync(validatedConfig, {
+        skipMissingProperties: false
+    });
+
+    if (errors.length > 0) {
+        throw new Error(errors.toString());
+    }
+
+    return validatedConfig;
+};

backend/src/modules/altcha/AltchaModule.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { AltchaController } from './controllers/AltchaController';
+import { AltchaService } from './services/AltchaService';
+
+@Module({
+    controllers: [AltchaController],
+    providers: [AltchaService],
+    exports: [AltchaService]
+})
+export class AltchaModule {}

backend/src/modules/altcha/controllers/AltchaController.ts

@@ -0,0 +1,23 @@
+import { Controller, Get, NotFoundException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AltchaService } from '../services/AltchaService';
+import { Config } from '../../../types/Config';
+
+@Controller('altcha')
+export class AltchaController {
+    constructor(
+        private readonly altchaService: AltchaService,
+        private readonly configService: ConfigService
+    ) {}
+
+    @Get('challenge')
+    async getChallenge() {
+        const { enabled } = this.configService.get('altcha') as Config['altcha'];
+
+        if (!enabled) {
+            throw new NotFoundException();
+        }
+
+        return this.altchaService.createChallenge();
+    }
+}

backend/src/modules/altcha/services/AltchaService.ts

@@ -0,0 +1,19 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { createChallenge } from 'altcha-lib/v1';
+import type { Challenge } from 'altcha-lib/v1/types';
+import { Config } from '../../../types/Config';
+
+@Injectable()
+export class AltchaService {
+    constructor(private readonly configService: ConfigService) {}
+
+    async createChallenge(): Promise<Challenge> {
+        const { hmacKey, maxNumber } = this.configService.get('altcha') as Config['altcha'];
+
+        return createChallenge({
+            hmacKey,
+            maxNumber
+        });
+    }
+}

backend/src/types/AltchaConfig.ts

@@ -0,0 +1,5 @@
+export type AltchaConfig = {
+    enabled: boolean;
+    hmacKey: string;
+    maxNumber: number;
+};

backend/src/types/Config.ts

@@ -1,19 +1,9 @@
+import { AltchaConfig } from './AltchaConfig';
 import { AppConfig } from './AppConfig';
-
-export interface PostgresConfig {
-    type: 'postgres';
-    url: string;
-    host: string;
-    username: string;
-    password: string;
-    port: number;
-    database: string;
-    entities: string[];
-    migrations: string[];
-    migrationsRun: boolean;
-}
+import { PostgresConfig } from './PostgresConfig';
 
 export interface Config {
     app: AppConfig;
+    altcha: AltchaConfig;
     postgres: PostgresConfig;
 }

backend/src/types/PostgresConfig.ts

@@ -0,0 +1,12 @@
+export interface PostgresConfig {
+    type: 'postgres';
+    url: string;
+    host: string;
+    username: string;
+    password: string;
+    port: number;
+    database: string;
+    entities: string[];
+    migrations: string[];
+    migrationsRun: boolean;
+}