fix: adding rate-limit

Author: Tbaile

app/Providers/AppServiceProvider.php

@@ -5,8 +5,11 @@
 use App\Logic\LicenceVerification;
 use App\Logic\NetifydCatalogRepository;
 use App\Logic\NetifydLicenseRepository;
+use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Events\DiagnosingHealth;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Nightwatch\Facades\Nightwatch;
 
@@ -36,5 +39,9 @@ public function boot(): void
         Event::listen(function (DiagnosingHealth $event) {
             Nightwatch::dontSample();
         });
+
+        RateLimiter::for('netifyd', function (Request $request) {
+            return Limit::perMinute(config('netifyd.rate-limit'));
+        });
     }
 }

bootstrap/app.php

@@ -3,6 +3,9 @@
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
 use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Exceptions\ThrottleRequestsException;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
 
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
@@ -17,5 +20,17 @@
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions) {
-        //
+        $exceptions->render(function (ThrottleRequestsException $e, Request $request) {
+            $headers = $e->getHeaders();
+
+            if (array_key_exists('Retry-After', $headers)) {
+                $headers['Retry-After'] = random_int(300, 900);
+            }
+
+            return response()->json(
+                ['message' => 'Too many requests, please retry later.'],
+                Response::HTTP_SERVICE_UNAVAILABLE,
+                $headers
+            );
+        });
     })->create();

config/netifyd.php

@@ -8,4 +8,5 @@
     'endpoint' => env('NETIFYD_API_ENDPOINT', 'https://agents.netify.ai'),
     'api-key' => env('NETIFYD_API_KEY'),
     'license-suffix' => env('NETIFYD_LICENSE_SUFFIX'),
+    'rate-limit' => env('NETIFYD_RATE_LIMIT', 180),
 ];

routes/api.php

@@ -10,10 +10,12 @@
 Route::prefix('/netifyd')->group(function () {
     Route::get('/license', [NetifyLicenseController::class, 'community']);
 
-    Route::get('/applications/catalog', [NetifydCatalogController::class, 'applicationsCatalog']);
-    Route::get('/applications/categories', [NetifydCatalogController::class, 'applicationsCategories']);
-    Route::get('/protocols/catalog', [NetifydCatalogController::class, 'protocolsCatalog']);
-    Route::get('/protocols/categories', [NetifydCatalogController::class, 'protocolsCategories']);
+    Route::middleware('throttle:netifyd')->group(function () {
+        Route::get('/applications/catalog', [NetifydCatalogController::class, 'applicationsCatalog']);
+        Route::get('/applications/categories', [NetifydCatalogController::class, 'applicationsCategories']);
+        Route::get('/protocols/catalog', [NetifydCatalogController::class, 'protocolsCatalog']);
+        Route::get('/protocols/categories', [NetifydCatalogController::class, 'protocolsCategories']);
+    });
 
     Route::middleware(ForceBasicAuth::class)->group(function () {
         Route::get('/enterprise/license', [NetifyLicenseController::class, 'enterprise'])

tests/Feature/Http/NetifydThrottleTest.php

@@ -0,0 +1,51 @@
+<?php
+
+use App\Logic\NetifydCatalogRepository;
+use Illuminate\Support\Facades\Config;
+use Mockery\MockInterface;
+
+use function Pest\Laravel\get;
+use function Pest\Laravel\partialMock;
+
+it('returns 503 with a Retry-After header once the netifyd rate limit is exceeded', function () {
+    Config::set('netifyd.rate-limit', 2);
+
+    partialMock(NetifydCatalogRepository::class, function (MockInterface $mock) {
+        $mock->allows('applicationsCatalog')->andReturn([]);
+    });
+
+    get('/api/netifyd/applications/catalog')->assertOk();
+    get('/api/netifyd/applications/catalog')->assertOk();
+
+    get('/api/netifyd/applications/catalog')
+        ->assertServiceUnavailable()
+        ->assertHeader('Retry-After');
+});
+
+it('returns a randomized Retry-After header between 300 and 900 seconds', function () {
+    Config::set('netifyd.rate-limit', 1);
+
+    partialMock(NetifydCatalogRepository::class, function (MockInterface $mock) {
+        $mock->allows('applicationsCatalog')->andReturn([]);
+    });
+
+    get('/api/netifyd/applications/catalog')->assertOk();
+
+    $response = get('/api/netifyd/applications/catalog')->assertServiceUnavailable();
+
+    expect((int) $response->headers->get('Retry-After'))
+        ->toBeGreaterThanOrEqual(300)
+        ->toBeLessThanOrEqual(900);
+});
+
+it('rate limits globally across clients, not per ip', function () {
+    Config::set('netifyd.rate-limit', 1);
+
+    partialMock(NetifydCatalogRepository::class, function (MockInterface $mock) {
+        $mock->allows('applicationsCatalog')->andReturn([]);
+    });
+
+    get('/api/netifyd/applications/catalog', ['X-Forwarded-For' => '203.0.113.10'])->assertOk();
+    get('/api/netifyd/applications/catalog', ['X-Forwarded-For' => '198.51.100.20'])
+        ->assertServiceUnavailable();
+});