This commit is contained in:
syuilo 2017-03-01 22:33:43 +09:00
parent 93c3faf141
commit 58c7cd5dad
3 changed files with 450 additions and 111 deletions

View file

@ -1,12 +1,12 @@
import * as express from 'express'; import * as express from 'express';
import { IEndpoint } from './endpoints'; import { Endpoint } from './endpoints';
import authenticate from './authenticate'; import authenticate from './authenticate';
import { IAuthContext } from './authenticate'; import { IAuthContext } from './authenticate';
import _reply from './reply'; import _reply from './reply';
import limitter from './limitter'; import limitter from './limitter';
export default async (endpoint: IEndpoint, req: express.Request, res: express.Response) => { export default async (endpoint: Endpoint, req: express.Request, res: express.Response) => {
const reply = _reply.bind(null, res); const reply = _reply.bind(null, res);
let ctx: IAuthContext; let ctx: IAuthContext;
@ -21,7 +21,7 @@ export default async (endpoint: IEndpoint, req: express.Request, res: express.Re
return reply(403, 'ACCESS_DENIED'); return reply(403, 'ACCESS_DENIED');
} }
if (endpoint.shouldBeSignin && ctx.user == null) { if (endpoint.withCredential && ctx.user == null) {
return reply(401, 'PLZ_SIGNIN'); return reply(401, 'PLZ_SIGNIN');
} }
@ -31,7 +31,7 @@ export default async (endpoint: IEndpoint, req: express.Request, res: express.Re
} }
} }
if (endpoint.shouldBeSignin) { if (endpoint.withCredential && endpoint.limit) {
try { try {
await limitter(endpoint, ctx); // Rate limit await limitter(endpoint, ctx); // Rate limit
} catch (e) { } catch (e) {

View file

@ -1,105 +1,442 @@
const second = 1000; import * as ms from 'ms';
const minute = 60 * second;
const hour = 60 * minute;
const day = 24 * hour;
export interface IEndpoint { /**
*
*/
export type Endpoint = {
/**
*
*/
name: string; name: string;
shouldBeSignin: boolean;
limitKey?: string; /**
limitDuration?: number; *
limitMax?: number; * false
*/
withCredential?: boolean;
/**
*
*
* withCredential false
*/
limit?: {
/**
*
*/
key?: string;
/**
* (ms)
* max
*/
duration?: number;
/**
* durationで指定した期間内にいくつまでリクエストできるのか
* duration
*/
max?: number;
/**
* (ms)
*/
minInterval?: number; minInterval?: number;
};
/**
*
* false
*/
withFile?: boolean; withFile?: boolean;
/**
*
* false
*/
secure?: boolean; secure?: boolean;
/**
*
*
*/
kind?: string; kind?: string;
} };
export default [ const endpoints: Endpoint[] = [
{ name: 'meta', shouldBeSignin: false }, {
name: 'meta'
},
{
name: 'username/available'
},
{
name: 'my/apps',
withCredential: true
},
{
name: 'app/create',
withCredential: true,
limit: {
duration: ms('1day'),
max: 3
}
},
{
name: 'app/show'
},
{
name: 'app/name_id/available'
},
{
name: 'auth/session/generate'
},
{
name: 'auth/session/show'
},
{
name: 'auth/session/userkey'
},
{
name: 'auth/accept',
withCredential: true,
secure: true
},
{
name: 'auth/deny',
withCredential: true,
secure: true
},
{
name: 'aggregation/users/post',
},
{
name: 'aggregation/users/like'
},
{
name: 'aggregation/users/followers'
},
{
name: 'aggregation/users/following'
},
{
name: 'aggregation/posts/like'
},
{
name: 'aggregation/posts/likes'
},
{
name: 'aggregation/posts/repost'
},
{
name: 'aggregation/posts/reply'
},
{ name: 'username/available', shouldBeSignin: false }, {
name: 'i',
withCredential: true
},
{
name: 'i/update',
withCredential: true,
limit: {
duration: ms('1day'),
max: 50
},
kind: 'account-write'
},
{
name: 'i/appdata/get',
withCredential: true
},
{
name: 'i/appdata/set',
withCredential: true
},
{
name: 'i/signin_history',
withCredential: true,
kind: 'account-read'
},
{
name: 'i/authorized_apps',
withCredential: true,
secure: true
},
{ name: 'my/apps', shouldBeSignin: true }, {
name: 'i/notifications',
withCredential: true,
kind: 'notification-read'
},
{
name: 'notifications/delete',
withCredential: true,
kind: 'notification-write'
},
{
name: 'notifications/delete_all',
withCredential: true,
kind: 'notification-write'
},
{
name: 'notifications/mark_as_read',
withCredential: true,
kind: 'notification-write'
},
{
name: 'notifications/mark_as_read_all',
withCredential: true,
kind: 'notification-write'
},
{ name: 'app/create', shouldBeSignin: true, limitDuration: day, limitMax: 3 }, {
{ name: 'app/show', shouldBeSignin: false }, name: 'drive',
{ name: 'app/name_id/available', shouldBeSignin: false }, withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/stream',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/files',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/files/create',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
withFile: true,
kind: 'drive-write'
},
{
name: 'drive/files/upload_from_url',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 10
},
kind: 'drive-write'
},
{
name: 'drive/files/show',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/files/find',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/files/delete',
withCredential: true,
kind: 'drive-write'
},
{
name: 'drive/files/update',
withCredential: true,
kind: 'drive-write'
},
{
name: 'drive/folders',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/folders/create',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 50
},
kind: 'drive-write'
},
{
name: 'drive/folders/show',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/folders/find',
withCredential: true,
kind: 'drive-read'
},
{
name: 'drive/folders/update',
withCredential: true,
kind: 'drive-write'
},
{ name: 'auth/session/generate', shouldBeSignin: false }, {
{ name: 'auth/session/show', shouldBeSignin: false }, name: 'users'
{ name: 'auth/session/userkey', shouldBeSignin: false }, },
{ name: 'auth/accept', shouldBeSignin: true, secure: true }, {
{ name: 'auth/deny', shouldBeSignin: true, secure: true }, name: 'users/show'
},
{
name: 'users/search'
},
{
name: 'users/search_by_username'
},
{
name: 'users/posts'
},
{
name: 'users/following'
},
{
name: 'users/followers'
},
{
name: 'users/recommendation',
withCredential: true,
kind: 'account-read'
},
{ name: 'aggregation/users/post', shouldBeSignin: false }, {
{ name: 'aggregation/users/like', shouldBeSignin: false }, name: 'following/create',
{ name: 'aggregation/users/followers', shouldBeSignin: false }, withCredential: true,
{ name: 'aggregation/users/following', shouldBeSignin: false }, limit: {
{ name: 'aggregation/posts/like', shouldBeSignin: false }, duration: ms('1hour'),
{ name: 'aggregation/posts/likes', shouldBeSignin: false }, max: 100
{ name: 'aggregation/posts/repost', shouldBeSignin: false }, },
{ name: 'aggregation/posts/reply', shouldBeSignin: false }, kind: 'following-write'
},
{
name: 'following/delete',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'following-write'
},
{ name: 'i', shouldBeSignin: true }, {
{ name: 'i/update', shouldBeSignin: true, limitDuration: day, limitMax: 50, kind: 'account-write' }, name: 'posts'
{ name: 'i/appdata/get', shouldBeSignin: true }, },
{ name: 'i/appdata/set', shouldBeSignin: true }, {
{ name: 'i/signin_history', shouldBeSignin: true, kind: 'account-read' }, name: 'posts/show'
{ name: 'i/authorized_apps', shouldBeSignin: true, secure: true }, },
{
name: 'posts/replies'
},
{
name: 'posts/context'
},
{
name: 'posts/create',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 120,
minInterval: 1 * second
},
kind: 'post-write'
},
{
name: 'posts/reposts'
},
{
name: 'posts/search'
},
{
name: 'posts/timeline',
withCredential: true,
limit: {
duration: ms('10minutes'),
max: 100
}
},
{
name: 'posts/mentions',
withCredential: true,
limit: {
duration: ms('10minutes'),
max: 100
}
},
{
name: 'posts/likes',
withCredential: true
},
{
name: 'posts/likes/create',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'like-write'
},
{
name: 'posts/likes/delete',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'like-write'
},
{
name: 'posts/favorites/create',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'favorite-write'
},
{
name: 'posts/favorites/delete',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'favorite-write'
},
{
name: 'posts/polls/vote',
withCredential: true,
limit: {
duration: ms('1hour'),
max: 100
},
kind: 'vote-write'
},
{ name: 'i/notifications', shouldBeSignin: true, kind: 'notification-read' }, {
{ name: 'notifications/delete', shouldBeSignin: true, kind: 'notification-write' }, name: 'messaging/history',
{ name: 'notifications/delete_all', shouldBeSignin: true, kind: 'notification-write' }, withCredential: true,
{ name: 'notifications/mark_as_read', shouldBeSignin: true, kind: 'notification-write' }, kind: 'messaging-read'
{ name: 'notifications/mark_as_read_all', shouldBeSignin: true, kind: 'notification-write' }, },
{
name: 'messaging/unread',
withCredential: true,
kind: 'messaging-read'
},
{
name: 'messaging/messages',
withCredential: true,
kind: 'messaging-read'
},
{
name: 'messaging/messages/create',
withCredential: true,
kind: 'messaging-write'
}
{ name: 'drive', shouldBeSignin: true, kind: 'drive-read' }, ];
{ name: 'drive/stream', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/files', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/files/create', shouldBeSignin: true, limitDuration: hour, limitMax: 100, withFile: true, kind: 'drive-write' },
{ name: 'drive/files/upload_from_url', shouldBeSignin: true, limitDuration: hour, limitMax: 10, kind: 'drive-write' },
{ name: 'drive/files/show', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/files/find', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/files/delete', shouldBeSignin: true, kind: 'drive-write' },
{ name: 'drive/files/update', shouldBeSignin: true, kind: 'drive-write' },
{ name: 'drive/folders', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/folders/create', shouldBeSignin: true, limitDuration: hour, limitMax: 50, kind: 'drive-write' },
{ name: 'drive/folders/show', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/folders/find', shouldBeSignin: true, kind: 'drive-read' },
{ name: 'drive/folders/update', shouldBeSignin: true, kind: 'drive-write' },
{ name: 'users', shouldBeSignin: false }, export default endpoints;
{ name: 'users/show', shouldBeSignin: false },
{ name: 'users/search', shouldBeSignin: false },
{ name: 'users/search_by_username', shouldBeSignin: false },
{ name: 'users/posts', shouldBeSignin: false },
{ name: 'users/following', shouldBeSignin: false },
{ name: 'users/followers', shouldBeSignin: false },
{ name: 'users/recommendation', shouldBeSignin: true, kind: 'account-read' },
{ name: 'following/create', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'following-write' },
{ name: 'following/delete', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'following-write' },
{ name: 'posts', shouldBeSignin: false },
{ name: 'posts/show', shouldBeSignin: false },
{ name: 'posts/replies', shouldBeSignin: false },
{ name: 'posts/context', shouldBeSignin: false },
{ name: 'posts/create', shouldBeSignin: true, limitDuration: hour, limitMax: 120, minInterval: 1 * second, kind: 'post-write' },
{ name: 'posts/reposts', shouldBeSignin: false },
{ name: 'posts/search', shouldBeSignin: false },
{ name: 'posts/timeline', shouldBeSignin: true, limitDuration: 10 * minute, limitMax: 100 },
{ name: 'posts/mentions', shouldBeSignin: true, limitDuration: 10 * minute, limitMax: 100 },
{ name: 'posts/likes', shouldBeSignin: true },
{ name: 'posts/likes/create', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'like-write' },
{ name: 'posts/likes/delete', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'like-write' },
{ name: 'posts/favorites/create', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'favorite-write' },
{ name: 'posts/favorites/delete', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'favorite-write' },
{ name: 'posts/polls/vote', shouldBeSignin: true, limitDuration: hour, limitMax: 100, kind: 'vote-write' },
{ name: 'messaging/history', shouldBeSignin: true, kind: 'messaging-read' },
{ name: 'messaging/unread', shouldBeSignin: true, kind: 'messaging-read' },
{ name: 'messaging/messages', shouldBeSignin: true, kind: 'messaging-read' },
{ name: 'messaging/messages/create', shouldBeSignin: true, kind: 'messaging-write' }
] as IEndpoint[];

View file

@ -1,26 +1,28 @@
import * as Limiter from 'ratelimiter'; import * as Limiter from 'ratelimiter';
import * as debug from 'debug'; import * as debug from 'debug';
import limiterDB from '../db/redis'; import limiterDB from '../db/redis';
import { IEndpoint } from './endpoints'; import { Endpoint } from './endpoints';
import { IAuthContext } from './authenticate'; import { IAuthContext } from './authenticate';
const log = debug('misskey:limitter'); const log = debug('misskey:limitter');
export default (endpoint: IEndpoint, ctx: IAuthContext) => new Promise((ok, reject) => { export default (endpoint: Endpoint, ctx: IAuthContext) => new Promise((ok, reject) => {
const limitKey = endpoint.hasOwnProperty('limitKey') const limitation = endpoint.limit;
? endpoint.limitKey
const key = limitation.hasOwnProperty('key')
? limitation.key
: endpoint.name; : endpoint.name;
const hasMinInterval = const hasShortTermLimit =
endpoint.hasOwnProperty('minInterval'); limitation.hasOwnProperty('minInterval');
const hasRateLimit = const hasLongTermLimit =
endpoint.hasOwnProperty('limitDuration') && limitation.hasOwnProperty('duration') &&
endpoint.hasOwnProperty('limitMax'); limitation.hasOwnProperty('max');
if (hasMinInterval) { if (hasShortTermLimit) {
min(); min();
} else if (hasRateLimit) { } else if (hasLongTermLimit) {
max(); max();
} else { } else {
ok(); ok();
@ -29,8 +31,8 @@ export default (endpoint: IEndpoint, ctx: IAuthContext) => new Promise((ok, reje
// Short-term limit // Short-term limit
function min() { function min() {
const minIntervalLimiter = new Limiter({ const minIntervalLimiter = new Limiter({
id: `${ctx.user._id}:${limitKey}:min`, id: `${ctx.user._id}:${key}:min`,
duration: endpoint.minInterval, duration: limitation.minInterval,
max: 1, max: 1,
db: limiterDB db: limiterDB
}); });
@ -45,7 +47,7 @@ export default (endpoint: IEndpoint, ctx: IAuthContext) => new Promise((ok, reje
if (info.remaining === 0) { if (info.remaining === 0) {
reject('BRIEF_REQUEST_INTERVAL'); reject('BRIEF_REQUEST_INTERVAL');
} else { } else {
if (hasRateLimit) { if (hasLongTermLimit) {
max(); max();
} else { } else {
ok(); ok();
@ -57,9 +59,9 @@ export default (endpoint: IEndpoint, ctx: IAuthContext) => new Promise((ok, reje
// Long term limit // Long term limit
function max() { function max() {
const limiter = new Limiter({ const limiter = new Limiter({
id: `${ctx.user._id}:${limitKey}`, id: `${ctx.user._id}:${key}`,
duration: endpoint.limitDuration, duration: limitation.duration,
max: endpoint.limitMax, max: limitation.max,
db: limiterDB db: limiterDB
}); });