$ show mosparo/mosparo
Mosparo is a self-hosted, open-source spam protection system that replaces CAPTCHA on web forms. It is built as a monolithic Symfony 6.4 application (PHP 8.1+) with Doctrine ORM supporting MySQL, PostgreSQL, and SQLite. The system provides a multi-tenant architecture where each project (website) can define custom spam detection rules (field rules for words, emails, domains, IPs, user agents, etc. and submission rules like random value detection) and security measures (honeypot, minimum time, proof-of-work, request delaying, IP lockout, equal submission blocking). Integration is done via a frontend JavaScript widget that communicates with a verification API. The codebase also includes an administration panel for system settings, user management, GeoIP2 integration, rule package imports, statistics, and self-update capabilities. The architecture follows standard Symfony patterns with controllers, services (helpers), repositories, and Twig templates. The rule engine is extensible via interfaces and is reasonably well-tested at the unit level. The project is actively maintained with a robust CI/CD pipeline and Docker support.
The LLM identified 5 files worth highlighting for reuse:
Implements domain matching for spam detection rules. It extends AbstractRuleTester and compares submitted data against a list of allowed or blocked domains, supporting wildcard patterns. This component is isolated, implements a clear interface (RuleTesterInterface), and has unit tests. It can be extracted and reused in any PHP-based spam or validation system that needs domain-based filtering.
Provides hashing utilities used for generating submission data fingerprints and verifying data integrity. Methods include computeHash and compareHash with configurable algorithms. It's a standalone, well-tested utility class that could be reused in any PHP project requiring secure hashing operations.
Handles HMAC signature generation and verification for API requests between the frontend widget and the verification endpoint. It uses a shared secret key to sign payloads and verify them. This helper is cleanly separated, follows a clear interface, and could be extracted for any service that needs HMAC-based request authentication.
Builds Doctrine DBAL and ORM configuration arrays from environment variables and a custom .env loader. It supports multiple database drivers and handles connection parameters like host, port, dbname, user, password. This is a configurator pattern that decouples database setup from the application kernel and can be reused in any Symfony project needing dynamic database connection configuration.
Implements word-based rule testing, checking if submitted data contains specified words (or regex patterns). It supports case-insensitive and whole-word matching. The tester is self-contained, implements RuleTesterInterface, and is thoroughly tested. It can be extracted for use in other content filtering or spam detection systems.