Sources/SophaxChatCore/Network/RelayRouter.swift

1// RelayRouter.swift
2// SophaxChatCore
3//
4// Deduplication and TTL management for the multihop relay system.
5//
6// When a node receives a RelayEnvelope it:
7//   1. Checks if the envelope ID is in the seen-set (dedup)
8//   2. If not seen AND TTL > 0: adds to seen-set, forwards decremented envelope
9//   3. If already seen OR TTL == 0: drops silently
10//
11// The seen-set is an in-memory LRU cache bounded to `maxSeen` entries.
12// This prevents a single malicious peer from exhausting memory by replaying
13// old envelopes with large IDs.
14
15import Foundation
16
17// Threading: RelayRouter is internally thread-safe — all mutable state is protected
18// by `lock` (NSLock). It is @unchecked Sendable only because NSLock is not Sendable
19// in the Swift 6 type system; the implementation is safe for concurrent use.
20public final class RelayRouter: @unchecked Sendable {
21
22    private let maxSeen: Int
23    private var seenSet:   Set<String>    = []
24    private var seenQueue: [String]       = []   // FIFO for LRU eviction
25    private let lock = NSLock()
26
27    // MARK: - Rate limiting (per relay sender + global)
28
29    /// Sliding window: max `maxRelaysPerWindow` relay forwards from one peer per `windowSeconds`.
30    private let maxRelaysPerWindow: Int
31    private let windowSeconds: TimeInterval
32    private struct SenderWindow { var count: Int; var windowStart: Date }
33    private var senderWindows: [String: SenderWindow] = [:]
34
35    /// Global relay counter — prevents a coordinated amplification attack where many peers each
36    /// stay within the per-sender limit but collectively flood the relay path.
37    private var globalRelayCount: Int = 0
38    private var globalWindowStart: Date = Date()
39    private let maxGlobalRelaysPerWindow: Int
40
41    public init(maxSeen: Int = 2000, maxRelaysPerWindow: Int = 10, windowSeconds: TimeInterval = 10,
42                maxGlobalRelaysPerWindow: Int = 50) {
43        self.maxSeen = maxSeen
44        self.maxRelaysPerWindow = maxRelaysPerWindow
45        self.windowSeconds = windowSeconds
46        self.maxGlobalRelaysPerWindow = maxGlobalRelaysPerWindow
47    }
48
49    // MARK: - Public API
50
51    /// Call this when a RelayEnvelope arrives.
52    /// Returns `true` if the envelope should be processed/forwarded,
53    /// `false` if it was already seen or TTL is exhausted.
54    public func shouldProcess(_ envelope: RelayEnvelope) -> Bool {
55        // Drop if TTL exhausted OR if a malicious peer crafted an inflated TTL
56        // that would cause unbounded flooding across the mesh.
57        guard envelope.ttl > 0, envelope.ttl <= RelayEnvelope.maxTTL else { return false }
58
59        lock.lock()
60        defer { lock.unlock() }
61
62        guard !seenSet.contains(envelope.id) else { return false }
63
64        seenSet.insert(envelope.id)
65        seenQueue.append(envelope.id)
66
67        // Evict oldest entry if we've exceeded the cap
68        if seenSet.count > maxSeen {
69            let evicted = seenQueue.removeFirst()
70            seenSet.remove(evicted)
71        }
72        return true
73    }
74
75    /// Returns `true` if `senderID` has exceeded the relay rate limit (per-sender or global).
76    public func isRateLimited(senderID: String) -> Bool {
77        lock.lock()
78        defer { lock.unlock() }
79
80        let now = Date()
81
82        // Global window reset
83        if now.timeIntervalSince(globalWindowStart) >= windowSeconds {
84            globalRelayCount = 0
85            globalWindowStart = now
86        }
87        // Global cap — prevents coordinated amplification by many peers each within per-sender limit
88        if globalRelayCount >= maxGlobalRelaysPerWindow { return true }
89        globalRelayCount += 1
90
91        // Evict expired sender windows to prevent unbounded memory growth
92        senderWindows = senderWindows.filter { now.timeIntervalSince($0.value.windowStart) < windowSeconds * 2 }
93
94        // Per-sender window
95        if var window = senderWindows[senderID] {
96            if now.timeIntervalSince(window.windowStart) >= windowSeconds {
97                window = SenderWindow(count: 1, windowStart: now)
98                senderWindows[senderID] = window
99                return false
100            }
101            if window.count >= maxRelaysPerWindow { return true }
102            window.count += 1
103            senderWindows[senderID] = window
104            return false
105        } else {
106            senderWindows[senderID] = SenderWindow(count: 1, windowStart: now)
107            return false
108        }
109    }
110
111    /// Remove all seen entries. Useful for testing.
112    public func reset() {
113        lock.lock()
114        defer { lock.unlock() }
115        seenSet.removeAll()
116        seenQueue.removeAll()
117    }
118
119    /// Number of unique relay IDs currently tracked.
120    public var seenCount: Int {
121        lock.lock()
122        defer { lock.unlock() }
123        return seenSet.count
124    }
125}