add rate limit

cesargb · Jan 4, 2025 · ce75c5e · ce75c5e
1 parent b9ebf27
commit ce75c5e
Show file tree

Hide file tree

Showing 6 changed files with 104 additions and 35 deletions.
diff --git a/config/magiclink.php b/config/magiclink.php
@@ -1,8 +1,17 @@
 <?php
 
+
 return [
 
     'access_code' => [
+        /*
+        |--------------------------------------------------------------------------
+        | Access Code View
+        |--------------------------------------------------------------------------
+        |
+        | Here you may specify the view to ask for access code.
+        |
+        */
         'view' => 'magiclink::ask-for-access-code-form',
     ],
 
@@ -32,7 +41,23 @@
         'class' => MagicLink\Responses\Response::class,
     ],
 
-    'token'           => [
+    'middlewares' => [
+        'throttle:magiclink',
+        MagicLink\Middlewares\MagiclinkMiddleware::class,
+        'web',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Rate Limit
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify the number of attempts to rate limit per minutes
+    |
+    */
+    'rate_limit' => 100,
+
+    'token' => [
         /*
         |--------------------------------------------------------------------------
         | Token size

diff --git a/routes/routes.php b/routes/routes.php
@@ -1,14 +1,10 @@
 <?php
 
 use Illuminate\Support\Facades\Route;
-use MagicLink\Middlewares\MagiclinkMiddleware;
 
 Route::group(
     [
-        'middleware' => [
-            MagiclinkMiddleware::class,
-            'web',
-        ],
+        'middleware' => config('magiclink.middlewares'),
     ],
     function () {
         Route::get(

diff --git a/src/MagicLinkServiceProvider.php b/src/MagicLinkServiceProvider.php
@@ -2,6 +2,8 @@
 
 namespace MagicLink;
 
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
 class MagicLinkServiceProvider extends ServiceProvider
@@ -15,11 +17,21 @@ public function boot()
     {
         $this->offerPublishing();
 
+        $this->registerRateLimit();
+
         $this->loadRouteMagicLink();
 
         $this->loadViewMagicLink();
     }
 
+    private function registerRateLimit(): void
+    {
+        RateLimiter::for(
+            'magiclink',
+            fn () => Limit::perMinute(config('magiclink.rate_limit', 100))
+        );
+    }
+
     private function loadRouteMagicLink(): void
     {
         $disableRegisterRoute = config('magiclink.disable_default_route', false);

diff --git a/tests/Http/HttpHeadTest.php b/tests/Http/HttpHeadTest.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace MagicLink\Test\Http;
+
+use MagicLink\Actions\ResponseAction;
+use MagicLink\MagicLink;
+use MagicLink\Test\TestCase;
+
+class HttpHeadTest extends TestCase
+{
+    public function test_http_head_request_has_not_effects()
+    {
+        $magiclink = MagicLink::create(new ResponseAction(function () {
+            return 'private content';
+        }));
+
+        $magiclink->num_visits = 4;
+        $magiclink->save();
+
+        $this->head($magiclink->url)
+            ->assertStatus(200)
+            ->assertDontSeeText('private content');
+
+        $magiclink->refresh();
+
+        $this->assertEquals(4, $magiclink->num_visits);
+    }
+
+    public function test_http_head_request_without_valid_magiclink()
+    {
+        $magiclink = MagicLink::create(new ResponseAction(function () {
+            return 'private content';
+        }));
+
+        $this->head($magiclink->url . '-bad')
+            ->assertStatus(404);
+    }
+}
diff --git a/tests/HttpTest.php → tests/Http/HttpTest.php b/tests/HttpTest.php → tests/Http/HttpTest.php
@@ -1,9 +1,10 @@
 <?php
 
-namespace MagicLink\Test;
+namespace MagicLink\Test\Http;
 
 use MagicLink\Actions\ResponseAction;
 use MagicLink\MagicLink;
+use MagicLink\Test\TestCase;
 
 class HttpTest extends TestCase
 {
@@ -25,24 +26,6 @@ public function test_http_get_request()
         $this->assertEquals(5, $magiclink->num_visits);
     }
 
-    public function test_http_head_request_has_not_effects()
-    {
-        $magiclink = MagicLink::create(new ResponseAction(function () {
-            return 'private content';
-        }));
-
-        $magiclink->num_visits = 4;
-        $magiclink->save();
-
-        $this->head($magiclink->url)
-            ->assertStatus(200)
-            ->assertDontSeeText('private content');
-
-        $magiclink->refresh();
-
-        $this->assertEquals(4, $magiclink->num_visits);
-    }
-
     public function test_http_options_request_has_not_effects()
     {
         $magiclink = MagicLink::create(new ResponseAction(function () {
@@ -73,14 +56,4 @@ public function test_http_urlencode_legacy()
             ->assertStatus(200)
             ->assertSeeText('private content');
     }
-
-    public function test_http_head_request_without_valid_magiclink()
-    {
-        $magiclink = MagicLink::create(new ResponseAction(function () {
-            return 'private content';
-        }));
-
-        $this->head($magiclink->url . '-bad')
-            ->assertStatus(404);
-    }
 }
diff --git a/tests/Http/HttpThrottleTest.php b/tests/Http/HttpThrottleTest.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace MagicLink\Test\Http;
+
+use MagicLink\Actions\ResponseAction;
+use MagicLink\MagicLink;
+use MagicLink\Test\TestCase;
+
+class HttpThrottleTest extends TestCase
+{
+    public function test_http_failed_when_rate_limit_is_exceeded()
+    {
+        config(['magiclink.rate_limit' => 1]);
+
+        $magiclink = MagicLink::create(new ResponseAction(function () {
+            return 'private content';
+        }));
+
+        $this->get($magiclink->url)
+            ->assertStatus(200);
+
+        $this->get($magiclink->url)
+            ->assertStatus(429);
+    }
+}