Dekescordes/spacebar
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

exempt users logic

Browse Source 
resolves #396
This commit is contained in:
Erkin Alp Güney 2022-04-28 21:30:41 +03:00 committed by GitHub
parent 1a45a36910
commit 2e451d8fd0
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
api/src/middlewares/RateLimit.ts
View File

@ -1,4 +1,4 @@
import { Config, listenEvent } from "@fosscord/util"; import { Config, getRights, listenEvent, Rights } from "@fosscord/util";
import { NextFunction, Request, Response, Router } from "express"; import { NextFunction, Request, Response, Router } from "express";
import { getIpAdress } from "@fosscord/api"; import { getIpAdress } from "@fosscord/api";
import { API_PREFIX_TRAILING_SLASH } from "./Authentication"; import { API_PREFIX_TRAILING_SLASH } from "./Authentication";
@ -9,6 +9,7 @@ import { API_PREFIX_TRAILING_SLASH } from "./Authentication";
/* /*
? bucket limit? Max actions/sec per bucket? ? bucket limit? Max actions/sec per bucket?
(ANSWER: a small fosscord instance might not need a complex rate limiting system)
TODO: delay database requests to include multiple queries TODO: delay database requests to include multiple queries
TODO: different for methods (GET/POST) TODO: different for methods (GET/POST)
@ -44,9 +45,12 @@ export default function rateLimit(opts: {
onlyIp?: boolean; onlyIp?: boolean;
}): any { }): any {
return async (req: Request, res: Response, next: NextFunction): Promise<any> => { return async (req: Request, res: Response, next: NextFunction): Promise<any> => {
// exempt user? if so, immediately short circuit
if (getRights(req.user_id).has("BYPASS_RATE_LIMITS")) return;
const bucket_id = opts.bucket || req.originalUrl.replace(API_PREFIX_TRAILING_SLASH, ""); const bucket_id = opts.bucket || req.originalUrl.replace(API_PREFIX_TRAILING_SLASH, "");
var executor_id = getIpAdress(req); var executor_id = getIpAdress(req);
if (!opts.onlyIp && req.user_id) executor_id = req.user_id; if (!opts.onlyIp && req.user_id) executor_id = req.user_id;
var max_hits = opts.count; var max_hits = opts.count;
if (opts.bot && req.user_bot) max_hits = opts.bot; if (opts.bot && req.user_bot) max_hits = opts.bot;