From c10b05c401bfc3d885f47021c761ea3682f39f45 Mon Sep 17 00:00:00 2001
From: wancat <wancat@wancat.cc>
Date: Mon, 30 Oct 2023 23:46:39 +0800
Subject: [PATCH] feat: add global and session rate limit

---
 server/package.json                       | 3 ++-
 server/src/api/routes/sessions.js         | 3 ++-
 server/src/index.js                       | 2 ++
 server/src/middleware/globalRateLimit.js  | 6 ++++++
 server/src/middleware/sessionRateLimit.js | 9 +++++++++
 yarn.lock                                 | 5 +++++
 6 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 server/src/middleware/globalRateLimit.js
 create mode 100644 server/src/middleware/sessionRateLimit.js

diff --git a/server/package.json b/server/package.json
index 9e3b98a..e78fd12 100644
--- a/server/package.json
+++ b/server/package.json
@@ -11,13 +11,14 @@
   },
   "dependencies": {
     "@linux-odyssey/file-graph": "*",
-    "@linux-odyssey/utils": "*",
     "@linux-odyssey/models": "*",
+    "@linux-odyssey/utils": "*",
     "bcrypt": "^5.1.1",
     "commander": "^11.0.0",
     "connect-mongo": "^5.0.0",
     "dockerode": "^3.3.5",
     "express": "^4.18.2",
+    "express-rate-limit": "^7.1.3",
     "express-session": "^1.17.3",
     "jsonwebtoken": "^9.0.1",
     "minimist": "^1.2.8",
diff --git a/server/src/api/routes/sessions.js b/server/src/api/routes/sessions.js
index d8f0b5d..8962045 100644
--- a/server/src/api/routes/sessions.js
+++ b/server/src/api/routes/sessions.js
@@ -1,10 +1,11 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
+import sessionRateLimit from '../../middleware/sessionRateLimit.js'
 
 const router = Router()
 
 router.get('/', sessionController.getSessionList)
-router.post('/', sessionController.createSession)
+router.post('/', sessionRateLimit, sessionController.createSession)
 router.post('/active', sessionController.getActiveSession)
 router.get('/:id', sessionController.getSessionById)
 router.delete('/:id', sessionController.deleteSessionById)
diff --git a/server/src/index.js b/server/src/index.js
index 6eb5b92..6ee7fe2 100644
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -12,6 +12,7 @@ import apiRouter from './api/routes/index.js'
 import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
+import globalRateLimit from './middleware/globalRateLimit.js'
 import sessionMiddleware from './middleware/session.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
 import { createTestUser } from './utils/auth.js'
@@ -37,6 +38,7 @@ async function main() {
   const server = http.createServer(app)
   socketServer(server)
   app.use(errorHandler)
+  app.use(globalRateLimit)
   app.use(sessionMiddleware)
   app.use(passport.session())
   app.use(
diff --git a/server/src/middleware/globalRateLimit.js b/server/src/middleware/globalRateLimit.js
new file mode 100644
index 0000000..85cd264
--- /dev/null
+++ b/server/src/middleware/globalRateLimit.js
@@ -0,0 +1,6 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 20,
+})
diff --git a/server/src/middleware/sessionRateLimit.js b/server/src/middleware/sessionRateLimit.js
new file mode 100644
index 0000000..be008e6
--- /dev/null
+++ b/server/src/middleware/sessionRateLimit.js
@@ -0,0 +1,9 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 10 * 1000,
+  max: 1,
+  keyGenerator: (req) => {
+    return req.user ? req.user._id : req.ip
+  },
+})
diff --git a/yarn.lock b/yarn.lock
index 9e4e5e4..4967bf3 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2695,6 +2695,11 @@ express-handlebars@^7.1.2:
     graceful-fs "^4.2.11"
     handlebars "^4.7.8"
 
+express-rate-limit@^7.1.3:
+  version "7.1.3"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-7.1.3.tgz#0eae6c7733316f3d9403a71ad488e31e94ca0aa4"
+  integrity sha512-BDes6WeNYSGRRGQU8QDNwUnwqaBro28HN/TTweM3RlxXRHDld8RLoH7tbfCxAc0hamQyn6aL0KrfR45+ZxknYg==
+
 express-session@^1.17.3:
   version "1.17.3"
   resolved "https://registry.yarnpkg.com/express-session/-/express-session-1.17.3.tgz#14b997a15ed43e5949cb1d073725675dd2777f36"