Improve token management and add IP rate-limiting

- Implement asynchronous cleanup for expired transfer tokens in `FTransferTokenManager`.
- Integrate abuse protection to rate-limit client requests based on IP in the transfer token endpoint.
- Add response handling for incorrect tokens in the transfer token endpoint.

Author: Przemek2122

ProjectServer/Source/Private/Auth/TransferTokenManager.cpp

@@ -60,8 +60,40 @@ void FTransferTokenManager::AsyncWork()
 
 void FTransferTokenManager::AsyncClearOldTransferTokens()
 {
+    std::vector<std::string> ExpiredTokens;
 
+    {
+        std::shared_lock<std::shared_mutex> ReadLock(TransferTokensMapMutex);
+        const Uint64 CurrentTime = CurrentTimeCached;
+
+        for (const auto& [UserId, TokenData] : TransferTokensMap)
+        {
+            if (TokenData.ExpirationTime <= CurrentTime)
+            {
+                ExpiredTokens.push_back(TokenData.Token);
+            }
+        }
+    }
 
+    if (!ExpiredTokens.empty())
+    {
+        std::unique_lock<std::shared_mutex> WriteLock(TransferTokensMapMutex);
+
+        for (const std::string& Token : ExpiredTokens)
+        {
+            // We must double-check if the token still exists in the reverse map.
+            // Another thread might have overwritten or deleted it between our read and write locks.
+            auto TokenIt = TransferTokenToIdMap.find(Token);
+            if (TokenIt != TransferTokenToIdMap.end())
+            {
+                const Uint64 UserId = TokenIt->second;
+
+                // Safely erase from both maps
+                TransferTokensMap.erase(UserId);
+                TransferTokenToIdMap.erase(TokenIt);
+            }
+        }
+    }
 }
 
 std::string FTransferTokenManager::CreateTransferToken(const Uint64 UserId)

ProjectServer/Source/Private/Rest/TransferTokenEndpoint.cpp

@@ -6,6 +6,7 @@
 
 #include "PredefinedMessages.h"
 #include "ProjectEngine.h"
+#include "AbuseProtection/AbuseProtection.h"
 #include "Auth/TransferTokenManager.h"
 #include "Auth/UserManager.h"
 #include "Misc/Util.h"
@@ -26,7 +27,9 @@ void FTransferTokenEndpoint::RegisterRoutes(crow::App<FCrowAppMiddleware>& App)
         {
             crow::response OutResponse = FCrowUtils::CreateResponse(crow::status::INTERNAL_SERVER_ERROR, { { FPredefinedMessages::Status::Name, FPredefinedMessages::Status::Error }, { "message", "error."} });
 
-            // @TODO: Add limiting of requests per IP address
+            // @TODO: Add specific limiting of requests per IP address
+            const std::string& ClientIP = req.remote_ip_address;
+            ProjectEngine->GetAbuseProtection()->AddRateLimitedAttempt(ClientIP);
 
             const std::string CookieHeader = req.get_header_value("Cookie");
             const std::string AuthToken = ProjectEngine->ExtractCookieValue(CookieHeader, "auth_token");
@@ -56,6 +59,12 @@ void FTransferTokenEndpoint::RegisterRoutes(crow::App<FCrowAppMiddleware>& App)
                 return FCrowUtils::CreateResponse(crow::status::OK,
                     { { FPredefinedMessages::Status::Name, FPredefinedMessages::Status::Success }, { "token", Token } });
             }
+            else
+            {
+                return FCrowUtils::CreateResponse(crow::status::UNAUTHORIZED,
+                    { { "status", "error" }, { "message", "Token incorrect."} }
+                );
+            }
 
             return OutResponse;
         });