Feature rate limiting #30
Conversation
- Define RateLimitService abstract class with checkRequest and dispose methods - Implement rate limiting logic to prevent abuse of sensitive or expensive endpoints - Use unique key (e.g., IP address) to track and limit requests - Throw ForbiddenException when rate limit is exceeded - Provide flexibility for different rate limiting strategies in implementations
- Add MongoDbRateLimitService class implementing RateLimitService interface - Use MongoDB TTL index for efficient automatic purging of old records - Implement checkRequest method with counting and limiting logic - Add error handling and logging
- Add RateLimitService interface - Implement MongoDbRateLimitService - Integrate RateLimitService into AppDependencies - Update dependency initialization and disposal
- Add TTL index for automatic document expiration in rate limit attempts collection - Add key index for faster lookups in rate limit attempts collection - Implement indexing in the DatabaseSeedingService
- Add rateLimiter middleware function to enforce rate limiting on routes - Include ipKeyExtractor for IP-based rate limiting - Implement _getIpAddress to extract client's IP address from request - Add RateLimitService for tracking and limiting requests
- Add special case for ForbiddenException containing 'too many requests' - Map to 429 Too Many Requests status code for rate limiting errors
- Import RateLimitService from services package - Add RateLimitService to the middleware chain using provider
- Implement rate limiting middleware for the /request-code endpoint - Allow up to 3 requests per IP address every 24 hours - Use ipKeyExtractor for rate limiting key generation - Refactor handler logic to include rate limiting
- Add new environment variables for rate limiting configuration - Include settings for /auth/request-code and /data API endpoints - Specify limit and time window for each endpoint
- Introduce new environment variables for request-code and data API rate limiting - Implement getters for rate limit parameters with default values - Add documentation for new configuration options
…e limiting - Rename request-code.dart to index.dart for better modularity - Implement rate limiting middleware directly in the handler - Improve code structure and prepare for additional endpoint implementations
- Implement rate limiting specifically for the `/api/v1/auth/request-code` endpoint - Use custom rate limit configuration from EnvironmentConfig - Apply rateLimiter middleware with ipKeyExtractor for key generation
- Reduced the whitespace between blocks in the `onRequest` function - Improved code readability and formatting without changing functionality
- Add new permission 'rate_limiting.bypass' to permissions.dart - Grant this new permission to dashboard publisher and admin roles in role_permissions.dart
- Add rate limiting middleware for /api/v1/data routes - Implement bypass permission for rate limiting - Configure rate limit using environment variables - Update middleware documentation and comments
- Removed detailed documentation from _middleware.dart file - Kept existing middleware functions intact
- Add explanation for optional rate limiting configuration - Provide default values and units for rate limit settings - Improve clarity on purpose and usage of rate limiting options
- Add information about built-in API rate limiting to README.md - Highlight protection against abuse and denial-of-service attacks - Mention configurable, user-aware limits and trusted role bypass - Emphasize stability and cost prevention benefits
- Change default JWT expiry hours from 1 hour to 720 hours (1 month) - Modify the fallback value in int.tryParse from '1' to '720' - This change affects the jwtExpiryDuration getter in EnvironmentConfig class
- Change JWT_EXPIRY_HOURS default from 1 hour to 720 hours (1 month) - Update ADMIN OVERRIDE to REQUIRED for the single administrator account setting - Clarify optional rate limit configuration for API endpoints
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @fulleni, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request introduces a comprehensive API rate limiting feature to enhance the security and stability of the application. It provides a flexible, configurable mechanism to prevent abuse of key endpoints, integrating seamlessly with existing middleware and role-based access controls.
Highlights
- Core Feature: API Rate Limiting: Implemented a robust, configurable API rate limiting system to protect critical endpoints from abuse. This includes a new
RateLimitServiceinterface and a MongoDB-backed implementation (MongoDbRateLimitService) that leverages TTL indexes for efficient record management. - Configurable Limits: Introduced new environment variables (
RATE_LIMIT_REQUEST_CODE_LIMIT,RATE_LIMIT_REQUEST_CODE_WINDOW_HOURS,RATE_LIMIT_DATA_API_LIMIT,RATE_LIMIT_DATA_API_WINDOW_MINUTES) to allow administrators to easily configure rate limits for the/auth/request-codeand generic/dataAPI endpoints. - Middleware Integration: Developed a generic
rateLimitermiddleware that can be applied to any route. This middleware is specifically integrated into the/auth/request-codeendpoint (IP-based limiting) and the/api/v1/dataendpoints (user-ID based limiting for authenticated users). - Role-Based Bypass: Added a new
rate_limiting.bypasspermission, which is granted toadminandpublisherroles. This ensures that dashboard users with these roles are not subjected to rate limits, preventing disruption to their administrative tasks. - Improved Error Handling: Enhanced the global error handler to correctly map rate limit exceeded errors (specifically
ForbiddenExceptionwith a 'too many requests' message) to an HTTP 429 (Too Many Requests) status code, providing clearer feedback to clients.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces a robust, configurable rate-limiting feature for the API, which is a great addition for security and stability. The implementation is clean, leveraging middleware and a dedicated service. My review focuses on a few key areas to enhance the new functionality:
- Improving the robustness of error handling by using type-safe custom exceptions instead of string matching.
- Correcting a logic bug in an environment variable fallback value.
- Increasing code clarity by removing a redundant permission entry.
These changes will make the new feature more reliable and easier to maintain. Overall, this is a well-executed feature.
Status
READY/IN DEVELOPMENT/HOLD
Description
Type of Change