feat(antispam): add server-side contact form spam guard (honeypot, time-trap, rate limit, link cap)

app/actions/contact.ts

@@ -25,11 +25,23 @@ export async function sendContactFormAction(formData: FormData) {
   // Track attempt
   services.analytics.track('contact-form-attempt');
 
-  // Anti-spam Honeypot Check
-  const honeypot = formData.get('company_website') as string;
-  if (honeypot) {
-    logger.warn('Spam detected via honeypot in contact request', { email: formData.get('email') });
-    // Silently succeed to fool the bot without doing actual work
+  // Anti-spam guard: honeypot, time-trap, email validation, link limit, IP rate limit
+  const { checkContactSubmission } = await import('@/lib/antispam/contact-guard');
+  const verdict = checkContactSubmission({
+    honeypot: (formData.get('company_website') as string) || null,
+    formLoadedAt: Number(formData.get('form_loaded_at')) || null,
+    now: Date.now(),
+    ip: requestHeaders.get('x-forwarded-for')?.split(',')[0]?.trim() || null,
+    email: (formData.get('email') as string) || null,
+    message: (formData.get('message') as string) || null,
+  });
+
+  if (!verdict.allowed) {
+    logger.warn('Spam blocked by anti-spam guard', {
+      reason: verdict.reason,
+      email: formData.get('email'),
+    });
+    // Silently succeed to fool bots without doing actual work
     return { success: true };
   }