From 2c51831a81de0f737c5c2b4d72a4b2a3aba80e39 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Tue, 1 Sep 2026 17:15:40 +0200
Subject: [PATCH] feat(antispam): add server-side contact form spam guard
 (honeypot, time-trap, rate limit, link cap)

---
 app/actions/contact.ts           | 22 ++++++---
 components/ContactForm.tsx       |  3 ++
 components/RequestQuoteForm.tsx  |  7 ++-
 components/forms/ContactForm.tsx |  2 +
 lib/antispam/contact-guard.ts    | 76 ++++++++++++++++++++++++++++++++
 tests/contact-antispam.test.ts   | 62 ++++++++++++++++++++++++++
 6 files changed, 165 insertions(+), 7 deletions(-)
 create mode 100644 lib/antispam/contact-guard.ts
 create mode 100644 tests/contact-antispam.test.ts

diff --git a/app/actions/contact.ts b/app/actions/contact.ts
index 43a027a98..08a6d688d 100644
--- a/app/actions/contact.ts
+++ b/app/actions/contact.ts
@@ -25,11 +25,23 @@ export async function sendContactFormAction(formData: FormData) {
   // Track attempt
   services.analytics.track('contact-form-attempt');
 
-  // Anti-spam Honeypot Check
-  const honeypot = formData.get('company_website') as string;
-  if (honeypot) {
-    logger.warn('Spam detected via honeypot in contact request', { email: formData.get('email') });
-    // Silently succeed to fool the bot without doing actual work
+  // Anti-spam guard: honeypot, time-trap, email validation, link limit, IP rate limit
+  const { checkContactSubmission } = await import('@/lib/antispam/contact-guard');
+  const verdict = checkContactSubmission({
+    honeypot: (formData.get('company_website') as string) || null,
+    formLoadedAt: Number(formData.get('form_loaded_at')) || null,
+    now: Date.now(),
+    ip: requestHeaders.get('x-forwarded-for')?.split(',')[0]?.trim() || null,
+    email: (formData.get('email') as string) || null,
+    message: (formData.get('message') as string) || null,
+  });
+
+  if (!verdict.allowed) {
+    logger.warn('Spam blocked by anti-spam guard', {
+      reason: verdict.reason,
+      email: formData.get('email'),
+    });
+    // Silently succeed to fool bots without doing actual work
     return { success: true };
   }
 
diff --git a/components/ContactForm.tsx b/components/ContactForm.tsx
index d74346b77..a0e53ffa9 100644
--- a/components/ContactForm.tsx
+++ b/components/ContactForm.tsx
@@ -12,6 +12,7 @@ export default function ContactForm() {
   const { trackEvent } = useAnalytics();
   const [status, setStatus] = useState<'idle' | 'submitting' | 'success' | 'error'>('idle');
   const [hasStarted, setHasStarted] = useState(false);
+  const [formLoadedAt] = useState(() => Date.now());
 
   const handleFocus = (fieldId: string) => {
     // Initial form start
@@ -152,6 +153,8 @@ export default function ContactForm() {
           style={{ display: 'none' }}
           aria-hidden="true"
         />
+        {/* Anti-spam time-trap: server rejects submissions faster than a human could fill the form */}
+        <input type="hidden" name="form_loaded_at" value={formLoadedAt} />
         <div className="space-y-1 md:space-y-2">
           <Label htmlFor="contact-name">{t('form.name')}</Label>
           <Input
diff --git a/components/RequestQuoteForm.tsx b/components/RequestQuoteForm.tsx
index f2c31b6d1..03c16ee01 100644
--- a/components/RequestQuoteForm.tsx
+++ b/components/RequestQuoteForm.tsx
@@ -18,6 +18,7 @@ export default function RequestQuoteForm({ productName }: RequestQuoteFormProps)
   const [request, setRequest] = useState('');
   const [status, setStatus] = useState<'idle' | 'submitting' | 'success' | 'error'>('idle');
   const [hasStarted, setHasStarted] = useState(false);
+  const [formLoadedAt] = useState(() => Date.now());
 
   const handleFocus = (fieldId: string) => {
     // Initial form start
@@ -172,8 +173,10 @@ export default function RequestQuoteForm({ productName }: RequestQuoteFormProps)
         tabIndex={-1}
         autoComplete="off"
         style={{ display: 'none' }}
-        aria-hidden="true"
-      />
+          aria-hidden="true"
+        />
+        {/* Anti-spam time-trap: server rejects submissions faster than a human could fill the form */}
+        <input type="hidden" name="form_loaded_at" value={formLoadedAt} />
 
       <div className="space-y-2 !mt-0">
         <div className="space-y-1 !mt-0">
diff --git a/components/forms/ContactForm.tsx b/components/forms/ContactForm.tsx
index 01e3f99d6..fab6efe0c 100644
--- a/components/forms/ContactForm.tsx
+++ b/components/forms/ContactForm.tsx
@@ -7,6 +7,7 @@ import { sendContactFormAction } from '@/app/actions/contact';
 
 export function ContactForm() {
   const [status, setStatus] = React.useState<'idle' | 'loading' | 'success' | 'error'>('idle');
+  const [formLoadedAt] = React.useState(() => Date.now());
 
   const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
     e.preventDefault();
@@ -132,6 +133,7 @@ export function ContactForm() {
           </div>
 
           <input type="text" name="company_website" style={{ display: 'none' }} tabIndex={-1} autoComplete="off" />
+          <input type="hidden" name="form_loaded_at" value={formLoadedAt} />
 
           <Button 
             type="submit" 
diff --git a/lib/antispam/contact-guard.ts b/lib/antispam/contact-guard.ts
new file mode 100644
index 000000000..3de9e18b6
--- /dev/null
+++ b/lib/antispam/contact-guard.ts
@@ -0,0 +1,76 @@
+/**
+ * Server-side anti-spam guard for contact form submissions.
+ * Pure, dependency-free, in-memory rate limiting (sufficient for a single app instance).
+ */
+
+export const MIN_FILL_TIME_MS = 3_000;
+export const RATE_LIMIT_MAX_SUBMISSIONS = 3;
+export const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1_000;
+export const MAX_MESSAGE_LINKS = 5;
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+const LINK_PATTERN = /(https?:\/\/|www\.)\S+/gi;
+
+export type SpamReason = 'honeypot' | 'too_fast' | 'invalid_email' | 'too_many_links' | 'rate_limited';
+
+export interface ContactSubmissionInput {
+  honeypot: string | null;
+  formLoadedAt: number | null;
+  now: number;
+  ip: string | null;
+  email: string | null;
+  message: string | null;
+}
+
+export interface ContactSubmissionVerdict {
+  allowed: boolean;
+  reason?: SpamReason;
+}
+
+const submissionTimestampsByIp = new Map<string, number[]>();
+
+export function resetRateLimiter(): void {
+  submissionTimestampsByIp.clear();
+}
+
+function isRateLimited(ip: string, now: number): boolean {
+  const timestamps = (submissionTimestampsByIp.get(ip) ?? []).filter(
+    (ts) => now - ts < RATE_LIMIT_WINDOW_MS,
+  );
+  if (timestamps.length >= RATE_LIMIT_MAX_SUBMISSIONS) {
+    submissionTimestampsByIp.set(ip, timestamps);
+    return true;
+  }
+  timestamps.push(now);
+  submissionTimestampsByIp.set(ip, timestamps);
+  return false;
+}
+
+export function checkContactSubmission(input: ContactSubmissionInput): ContactSubmissionVerdict {
+  if (input.honeypot) {
+    return { allowed: false, reason: 'honeypot' };
+  }
+
+  if (
+    input.formLoadedAt === null ||
+    !Number.isFinite(input.formLoadedAt) ||
+    input.now - input.formLoadedAt < MIN_FILL_TIME_MS
+  ) {
+    return { allowed: false, reason: 'too_fast' };
+  }
+
+  if (!input.email || !EMAIL_PATTERN.test(input.email)) {
+    return { allowed: false, reason: 'invalid_email' };
+  }
+
+  const message = input.message ?? '';
+  if ((message.match(LINK_PATTERN) ?? []).length > MAX_MESSAGE_LINKS) {
+    return { allowed: false, reason: 'too_many_links' };
+  }
+
+  if (input.ip && isRateLimited(input.ip, input.now)) {
+    return { allowed: false, reason: 'rate_limited' };
+  }
+
+  return { allowed: true };
+}
diff --git a/tests/contact-antispam.test.ts b/tests/contact-antispam.test.ts
new file mode 100644
index 000000000..4be0f0dd5
--- /dev/null
+++ b/tests/contact-antispam.test.ts
@@ -0,0 +1,62 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { checkContactSubmission, resetRateLimiter } from '@/lib/antispam/contact-guard';
+
+const validInput = {
+  honeypot: '',
+  formLoadedAt: Date.now() - 10_000,
+  now: Date.now(),
+  ip: '1.2.3.4',
+  email: 'customer@example.com',
+  message: 'I would like a quote for 50 cables.',
+};
+
+describe('contact form anti-spam guard', () => {
+  beforeEach(() => resetRateLimiter());
+
+  it('allows a legitimate submission', () => {
+    const result = checkContactSubmission(validInput);
+    expect(result.allowed).toBe(true);
+  });
+
+  it('blocks submissions where the honeypot field is filled', () => {
+    const result = checkContactSubmission({ ...validInput, honeypot: 'http://spam.example' });
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toBe('honeypot');
+  });
+
+  it('blocks submissions sent faster than a human could fill the form', () => {
+    const result = checkContactSubmission({ ...validInput, formLoadedAt: validInput.now - 1_000 });
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toBe('too_fast');
+  });
+
+  it('blocks submissions with an invalid email address', () => {
+    const result = checkContactSubmission({ ...validInput, email: 'not-an-email' });
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toBe('invalid_email');
+  });
+
+  it('blocks messages containing more than 5 links (typical SEO spam)', () => {
+    const spammy = Array.from({ length: 6 }, (_, i) => `https://spam${i}.example`).join(' ');
+    const result = checkContactSubmission({ ...validInput, message: spammy });
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toBe('too_many_links');
+  });
+
+  it('rate-limits an IP after 3 submissions within 10 minutes', () => {
+    for (let i = 0; i < 3; i++) {
+      expect(checkContactSubmission(validInput).allowed).toBe(true);
+    }
+    const result = checkContactSubmission(validInput);
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toBe('rate_limited');
+  });
+
+  it('does not rate-limit different IPs independently', () => {
+    for (let i = 0; i < 3; i++) {
+      checkContactSubmission(validInput);
+    }
+    const result = checkContactSubmission({ ...validInput, ip: '5.6.7.8' });
+    expect(result.allowed).toBe(true);
+  });
+});