add antibot infrastructure

.gitignore

@@ -1,4 +1,7 @@
+antibot
+
 node_modules
+bun.lock
 
 **/.DS_store
 .env

index.js

@@ -1,6 +1,7 @@
 import 'dotenv/config';
 
 import { ipFilterMiddleware, ipFilterError } from './server/moderation/ip-filter.js';
+import { isUsingAntibot } from './server/moderation/using-antibot.js';
 import { WEBSOCKET_MAX_PAYLOAD, COOKIE_MAX_AGE } from './constants.js';
 import indexRouter from './routes/index.js';
 import webhookRouter from './routes/api/webhook.js';
@@ -44,6 +45,11 @@ app.use(cookieSession({
 app.use(ipFilterMiddleware);
 app.use(ipFilterError);
 
+if (isUsingAntibot) {
+    const { default: antibot } = await import('./server/antibot/middleware.js');
+    app.use(antibot);
+}
+
 wss.on('connection', handleWssConnection);
 
 app.use(indexRouter);

server/moderation/using-antibot.js

@@ -0,0 +1,5 @@
+import fs from 'fs';
+import path from 'path';
+
+const isUsingAntibot = fs.existsSync(path.join(import.meta.dirname, '..', 'antibot'));
+export { isUsingAntibot };

server/multiplayer/handle-wss-connection.js

@@ -4,6 +4,7 @@ import { checkToken } from '../authentication.js';
 import getRandomName from '../../quizbowl/get-random-name.js';
 import hasValidCharacters from '../moderation/has-valid-characters.js';
 import isAppropriateString from '../moderation/is-appropriate-string.js';
+import { isUsingAntibot } from '../moderation/using-antibot.js';
 
 import createDOMPurify from 'dompurify';
 import { JSDOM } from 'jsdom';
@@ -45,7 +46,12 @@ function createAndReturnRoom (roomName, userId, isPrivate = false, isControlled
  * @param {WebSocket} ws
  * @param {http.IncomingMessage} req
  */
-export default function handleWssConnection (ws, req) {
+export default async function handleWssConnection (ws, req) {
+  if (isUsingAntibot) {
+    let clearance = (await import('../antibot/check.js')).canConnectTo(ws, req);
+    if (!clearance) return ws.close();
+  }
+
   const parsedUrl = new url.URL(req.url, process.env.BASE_URL ?? 'http://localhost');
   const isPrivate = parsedUrl.searchParams.get('private') === 'true';
   const isControlled = parsedUrl.searchParams.get('controlled') === 'true';