feat: adding mechanisms to avoid api abuse

Author: jagalindo

Dockerfile

@@ -12,6 +12,7 @@ COPY . .
 # Make port 8000 available to the world outside this container
 EXPOSE 8000
 
-# Run app.py when the container launches
+# Run app.py when the container launches; bind/workers/timeout/logging come
+# from gunicorn.conf.py (overridable via WEB_CONCURRENCY / GUNICORN_TIMEOUT).
 # In case of wish the dev server use CMD [ "python3", "-m" , "flask", "run", "--host=0.0.0.0"]
-CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]
+CMD ["gunicorn", "app:app"]

README.md

@@ -143,6 +143,30 @@ in the Swagger UI at <http://localhost:8000/docs/>.
 
 <p align="right">(<a href="#top">back to top</a>)</p>
 
+## Abuse controls & configuration
+
+The API ships with per-IP rate limiting, a per-operation time budget, upload size limits and a
+result cache, all configurable through environment variables (e.g. `docker run -e FLAMAPY_...`):
+
+| Env var | Default | Meaning |
+|---|---|---|
+| `FLAMAPY_MAX_CONTENT_LENGTH` | `16777216` | Max upload size in bytes; larger requests get **413** |
+| `FLAMAPY_RATELIMIT_ENABLED` | `true` | Turn rate limiting on/off |
+| `FLAMAPY_RATELIMIT_DEFAULT` | `60 per minute` | Per-IP limit for cheap operations |
+| `FLAMAPY_RATELIMIT_EXPENSIVE` | `10 per minute` | Per-IP limit for enumeration/solver-heavy operations (`configurations`, `configurations_number`, `sampling`, …); exceeding a limit returns **429** |
+| `FLAMAPY_RATELIMIT_STORAGE_URI` | `memory://` | Limiter storage; use `redis://host:6379` when running several gunicorn workers so they share counters |
+| `FLAMAPY_OPERATION_TIMEOUT` | `60` | Seconds an operation may run before it is killed and **504** is returned; `0` disables |
+| `FLAMAPY_CACHE_TTL` | `3600` | Seconds a result stays cached (same model + operation + arguments); `0` disables. Responses carry an `X-Cache: HIT|MISS` header |
+| `FLAMAPY_CACHE_MAXSIZE` | `128` | Max cached results per worker |
+| `FLAMAPY_TRUST_PROXY` | `false` | Set to `true` behind a reverse proxy so rate limits see the real client IP (`X-Forwarded-For`) |
+| `WEB_CONCURRENCY` | `2` | gunicorn worker count (Docker image) |
+| `GUNICORN_TIMEOUT` | `120` | gunicorn hard worker timeout; keep it above `FLAMAPY_OPERATION_TIMEOUT` |
+
+Every request is logged to stdout (client IP, path, status, duration, upload size, cache result),
+so `docker logs` is enough to spot heavy users.
+
+<p align="right">(<a href="#top">back to top</a>)</p>
+
 ## API Documentation
 
 All documentation is registered with Swagger UI and OAS 3.0, served at

app.py

@@ -1,16 +1,69 @@
-from flask import Flask, Response
+import logging
+import time
+
+from flask import Flask, Response, g, jsonify, request
 from flask_cors import CORS
 from flasgger import Swagger
+from werkzeug.exceptions import HTTPException
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 # Importing routes
 from flamapy.interfaces.rest.operations_routes import operations_bp
+from flamapy.interfaces.rest.config import load_config
+from flamapy.interfaces.rest.extensions import limiter, result_cache
 
 # Creating the app and configuring the cors
 app = Flask(__name__)
 CORS(app)
-# Reject oversized uploads early (feature model files are small); guards against
-# memory-exhaustion DoS via huge multipart bodies.
-app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16 MB
+# Abuse controls (upload size, rate limits, operation timeout, result cache);
+# every value is overridable through FLAMAPY_* env vars.
+app.config.update(load_config())
+
+if app.config['TRUST_PROXY']:
+    # Honor X-Forwarded-For so per-IP rate limits see the real client address
+    # when the API runs behind a reverse proxy.
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1)  # type: ignore[method-assign]
+
+limiter.init_app(app)
+result_cache.init_app(app)
+
+# One structured line per request on stdout (Docker-friendly).
+logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s %(message)s')
+request_logger = logging.getLogger('flamapy.rest.requests')
+
+
+@app.before_request
+def _start_timer() -> None:
+    g.start_time = time.monotonic()
+
+
+@app.after_request
+def _log_request(response: Response) -> Response:
+    duration_ms = (time.monotonic() - g.get('start_time', time.monotonic())) * 1000
+    request_logger.info(
+        'remote=%s method=%s path=%s status=%s duration_ms=%.1f bytes_in=%s cache=%s',
+        request.remote_addr,
+        request.method,
+        request.path,
+        response.status_code,
+        duration_ms,
+        request.content_length or 0,
+        response.headers.get('X-Cache', '-'),
+    )
+    return response
+
+
+@app.errorhandler(HTTPException)
+def _json_http_error(error: HTTPException) -> tuple[Response, int]:
+    # Covers 400/404/413/429/504...; keeps API errors as JSON instead of HTML.
+    return jsonify(error=error.description), error.code or 500
+
+
+@app.errorhandler(Exception)
+def _json_unexpected_error(error: Exception) -> tuple[Response, int]:
+    request_logger.exception('Unhandled error on %s: %s', request.path, error)
+    return jsonify(error='Internal server error'), 500
+
 
 #Now we are configuring the self generation of swagger by means of flasgger
 config = {

flamapy/interfaces/rest/config.py

@@ -0,0 +1,36 @@
+import os
+from typing import Any
+
+
+def _env_bool(name: str, default: bool) -> bool:
+    raw = os.environ.get(name)
+    if raw is None:
+        return default
+    return raw.strip().lower() in ('1', 'true', 'yes', 'on')
+
+
+def _env_int(name: str, default: int) -> int:
+    raw = os.environ.get(name)
+    if raw is None or raw.strip() == '':
+        return default
+    return int(raw)
+
+
+def load_config() -> dict[str, Any]:
+    """Abuse-control settings, every one overridable through an env var so the
+    Docker image stays a single self-contained container."""
+    return {
+        'MAX_CONTENT_LENGTH': _env_int('FLAMAPY_MAX_CONTENT_LENGTH', 16 * 1024 * 1024),
+        'RATELIMIT_ENABLED': _env_bool('FLAMAPY_RATELIMIT_ENABLED', True),
+        'RATELIMIT_STORAGE_URI': os.environ.get('FLAMAPY_RATELIMIT_STORAGE_URI', 'memory://'),
+        'RATELIMIT_DEFAULT_OPERATION': os.environ.get(
+            'FLAMAPY_RATELIMIT_DEFAULT', '60 per minute'
+        ),
+        'RATELIMIT_EXPENSIVE_OPERATION': os.environ.get(
+            'FLAMAPY_RATELIMIT_EXPENSIVE', '10 per minute'
+        ),
+        'OPERATION_TIMEOUT': _env_int('FLAMAPY_OPERATION_TIMEOUT', 60),
+        'CACHE_TTL': _env_int('FLAMAPY_CACHE_TTL', 3600),
+        'CACHE_MAXSIZE': _env_int('FLAMAPY_CACHE_MAXSIZE', 128),
+        'TRUST_PROXY': _env_bool('FLAMAPY_TRUST_PROXY', False),
+    }

flamapy/interfaces/rest/extensions.py

@@ -0,0 +1,52 @@
+import threading
+from typing import Any, Optional
+
+from cachetools import TTLCache
+from flask import Flask, current_app
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
+
+
+def default_operation_limit() -> str:
+    return current_app.config['RATELIMIT_DEFAULT_OPERATION']
+
+
+def expensive_operation_limit() -> str:
+    return current_app.config['RATELIMIT_EXPENSIVE_OPERATION']
+
+
+# Storage URI and enabled flag are picked up from app.config (RATELIMIT_*)
+# during init_app; per-route limits are attached in operations_routes.
+limiter = Limiter(key_func=get_remote_address)
+
+
+class ResultCache:
+    """Per-process TTL cache for operation results. The cache object is created
+    on init_app so its size/TTL follow the app configuration; a TTL of 0
+    disables caching entirely."""
+
+    def __init__(self) -> None:
+        self._cache: Optional[TTLCache[str, Any]] = None
+        self._lock = threading.Lock()
+
+    def init_app(self, app: Flask) -> None:
+        ttl = app.config['CACHE_TTL']
+        if ttl > 0:
+            self._cache = TTLCache(maxsize=app.config['CACHE_MAXSIZE'], ttl=ttl)
+        else:
+            self._cache = None
+
+    def get(self, key: str) -> Any:
+        if self._cache is None:
+            return None
+        with self._lock:
+            return self._cache.get(key)
+
+    def set(self, key: str, value: Any) -> None:
+        if self._cache is None:
+            return
+        with self._lock:
+            self._cache[key] = value
+
+
+result_cache = ResultCache()

flamapy/interfaces/rest/operations_routes.py

@@ -1,21 +1,46 @@
 import os
+import hashlib
 import inspect
 import json
 import shutil
 import tempfile
 import typing
 from typing import Any, Callable
 
-from flask import Blueprint, request, jsonify, abort
+from flask import Blueprint, Response, current_app, request, jsonify, abort
 from werkzeug.datastructures import FileStorage
 from werkzeug.utils import secure_filename
 from flamapy.interfaces.python.flamapy_feature_model import FLAMAFeatureModel, Backend
-from flamapy.core.exceptions import FlamaException
 from flamapy.metamodels.configuration_metamodel.models import Configuration
 
+from flamapy.interfaces.rest.extensions import (
+    limiter,
+    result_cache,
+    default_operation_limit,
+    expensive_operation_limit,
+)
+from flamapy.interfaces.rest.runner import ModelParseError, OperationTimeout, run_operation
+
 
 operations_bp = Blueprint('operations_bp', __name__, url_prefix='/api/v1/operations')
 
+# Operations that enumerate or repeatedly invoke a solver; they get the stricter
+# rate-limit tier because a single call can monopolize a CPU for a long time.
+_EXPENSIVE_OPERATIONS = {
+    'configurations',
+    'configurations_number',
+    'configurations_with_n_features',
+    'conflict',
+    'diagnosis',
+    'feature_inclusion_probability',
+    'homogeneity',
+    'product_distribution',
+    'sampling',
+    'unique_features',
+    'variability',
+    'variant_features',
+}
+
 # Backward-compatible multipart field names for parameters that the API exposed
 # before the dispatcher became generic. Any other parameter derives its field
 # name from the parameter itself (file params drop the trailing "_path").
@@ -116,6 +141,26 @@ def _resolve_kwargs(operation: Any, work_dir: str) -> dict[str, Any]:
     return kwargs
 
 
+def _cache_key(
+    operation_name: str, operation: Any, model_path: str, kwargs: dict[str, Any]
+) -> str:
+    """Digest of everything that determines the result: the operation, the model
+    contents and every argument (file arguments by content, not by temp path)."""
+    file_params = {p.name for p in _operation_params(operation) if _is_file_param(p)}
+    digest = hashlib.sha256()
+    digest.update(operation_name.encode())
+    with open(model_path, 'rb') as model_file:
+        digest.update(model_file.read())
+    for name in sorted(kwargs):
+        digest.update(b'\x00' + name.encode() + b'\x00')
+        if name in file_params:
+            with open(kwargs[name], 'rb') as uploaded_file:
+                digest.update(uploaded_file.read())
+        else:
+            digest.update(repr(kwargs[name]).encode())
+    return digest.hexdigest()
+
+
 def _api_call(operation_name: str) -> Any:
     uploaded_model = request.files.get('model')
     if uploaded_model is None or not uploaded_model.filename:
@@ -126,19 +171,34 @@ def _api_call(operation_name: str) -> Any:
     work_dir = tempfile.mkdtemp(prefix='flamapy_')
     try:
         model_path = _save_upload(uploaded_model, work_dir)
+        operation = getattr(FLAMAFeatureModel, operation_name)
+        kwargs = _resolve_kwargs(operation, work_dir)
+
+        key = _cache_key(operation_name, operation, model_path, kwargs)
+        payload = result_cache.get(key)
+        if payload is not None:
+            response: Response = jsonify(payload)
+            response.headers['X-Cache'] = 'HIT'
+            return response
+
         try:
-            fm = FLAMAFeatureModel(model_path)
-        except FlamaException:
+            result = run_operation(
+                model_path, operation_name, kwargs, current_app.config['OPERATION_TIMEOUT']
+            )
+        except ModelParseError:
             abort(400, "The uploaded model could not be parsed")
-        operation = getattr(fm, operation_name)
-        kwargs = _resolve_kwargs(operation, work_dir)
-        result = operation(**kwargs)
+        except OperationTimeout as exc:
+            abort(504, str(exc))
     finally:
         shutil.rmtree(work_dir, ignore_errors=True)
 
     if result is None:
         return jsonify(error='Not valid result'), 404
-    return jsonify(json.loads(json.dumps(result, cls=CustomJSONEncoder)))
+    payload = json.loads(json.dumps(result, cls=CustomJSONEncoder))
+    result_cache.set(key, payload)
+    response = jsonify(payload)
+    response.headers['X-Cache'] = 'MISS'
+    return response
 
 
 def extract_docstring_with_swagger_info(method: Any) -> str:
@@ -189,9 +249,12 @@ def route_function() -> Any:
 
 
 # Introspect FLAMAFeatureModel to expose every public method as a POST route,
-# generating its Swagger spec from the method signature.
+# generating its Swagger spec from the method signature. Limits are passed as
+# callables so they read the app config of whichever app the blueprint joins.
 for name, method in inspect.getmembers(FLAMAFeatureModel, predicate=inspect.isfunction):
     if name.startswith('_'):
         continue
     docstring = extract_docstring_with_swagger_info(method)
-    operations_bp.route(f'/{name}', methods=['POST'])(create_route(name, docstring))
+    limit = expensive_operation_limit if name in _EXPENSIVE_OPERATIONS else default_operation_limit
+    route_view = limiter.limit(limit)(create_route(name, docstring))
+    operations_bp.route(f'/{name}', methods=['POST'])(route_view)