From 3922584879d53929b736685a78c74bf72f85e4c0 Mon Sep 17 00:00:00 2001 From: DariusIII Date: Mon, 4 Jun 2018 15:06:52 +0200 Subject: [PATCH] Add dynamic api throthling --- Changelog | 1 + app/Http/Controllers/Admin/UserController.php | 1 + app/Models/User.php | 6 ++++++ app/Models/UserRole.php | 2 ++ build/nntmux.xml | 4 ++-- .../migrations/2018_01_16_195548_create_users_table.php | 1 + .../2018_01_17_150719_create_user_roles_table.php | 1 + resources/db/patches/mysql/+1~user.sql | 5 +++++ resources/db/patches/mysql/0348~user.sql | 5 +++++ resources/views/themes/admin/role-edit.tpl | 8 ++++++++ routes/api.php | 2 +- 11 files changed, 33 insertions(+), 3 deletions(-) create mode 100644 resources/db/patches/mysql/+1~user.sql create mode 100644 resources/db/patches/mysql/0348~user.sql diff --git a/Changelog b/Changelog index 69c44d2be..789b5762c 100755 --- a/Changelog +++ b/Changelog @@ -1,4 +1,5 @@ 2018-06-04 DariusIII + * Chg: Add dynamic api throthling * Fix: Fix headers that are being sent with getNzb function * Fix: Make queries properly formatted for API V2 * Chg: Remove references to extended info in API V2, API always sends extended information diff --git a/app/Http/Controllers/Admin/UserController.php b/app/Http/Controllers/Admin/UserController.php index 9fb3fcc70..e0d4bcb8a 100644 --- a/app/Http/Controllers/Admin/UserController.php +++ b/app/Http/Controllers/Admin/UserController.php @@ -92,6 +92,7 @@ class UserController extends BasePageController 'password' => '', 'role' => User::ROLE_USER, 'notes' => '', + 'rate_limit' => 60, ]; $title = 'View User'; diff --git a/app/Models/User.php b/app/Models/User.php index 2a0f3f43a..ad08720d0 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -332,6 +332,8 @@ class User extends Authenticatable $userName = trim($userName); $email = trim($email); + $rateLimit = UserRole::query()->where('id', $role)->value('rate_limit'); + if (! self::isValidUsername($userName)) { return self::ERR_SIGNUP_BADUNAME; } @@ -380,6 +382,7 @@ class User extends Authenticatable 'nzbvortex_api_key' => $nzbvortexApiKey, 'cp_url' => $cp_url, 'cp_api' => $cp_api, + 'rate_limit' => $rateLimit, ]; self::query()->where('id', $id)->update($sql); @@ -888,6 +891,8 @@ class User extends Authenticatable return false; } + $rateLimit = UserRole::query()->where('id', $role)->value('rate_limit'); + if (\defined('NN_INSTALLER')) { $storeips = ''; } else { @@ -906,6 +911,7 @@ class User extends Authenticatable 'invitedby' => (int) $invitedBy === 0 ? 'NULL' : $invitedBy, 'userseed' => md5(Utility::generateUuid()), 'notes' => $notes, + 'rate_limit' => $rateLimit, ] )->id; } diff --git a/app/Models/UserRole.php b/app/Models/UserRole.php index 79f4bab5c..d8fcfbb08 100644 --- a/app/Models/UserRole.php +++ b/app/Models/UserRole.php @@ -104,6 +104,7 @@ class UserRole extends Model 'hideads' => $request['hideads'], 'donation' => $request['donation'], 'addyears' => $request['addyears'], + 'rate_limit' => $request['rate_limit'], ] ); } @@ -126,6 +127,7 @@ class UserRole extends Model 'hideads' => $request['hideads'], 'donation' => $request['donation'], 'addyears' => $request['addyears'], + 'rate_limit' => $request['rate_limit'], ] ); } diff --git a/build/nntmux.xml b/build/nntmux.xml index 69a42ebed..2dd465311 100755 --- a/build/nntmux.xml +++ b/build/nntmux.xml @@ -16,8 +16,8 @@ - 347 - 347 + 348 + 348 diff --git a/database/migrations/2018_01_16_195548_create_users_table.php b/database/migrations/2018_01_16_195548_create_users_table.php index c93e9df58..394e2a34f 100644 --- a/database/migrations/2018_01_16_195548_create_users_table.php +++ b/database/migrations/2018_01_16_195548_create_users_table.php @@ -39,6 +39,7 @@ class CreateUsersTable extends Migration { $table->integer('consoleview')->default(1); $table->integer('bookview')->default(1); $table->integer('gameview')->default(1); + $table->integer('rate_limit')->default(60); $table->string('saburl')->nullable(); $table->string('sabapikey')->nullable(); $table->boolean('sabapikeytype')->nullable(); diff --git a/database/migrations/2018_01_17_150719_create_user_roles_table.php b/database/migrations/2018_01_17_150719_create_user_roles_table.php index 3e544db04..0bbb08a9b 100644 --- a/database/migrations/2018_01_17_150719_create_user_roles_table.php +++ b/database/migrations/2018_01_17_150719_create_user_roles_table.php @@ -20,6 +20,7 @@ class CreateUserRolesTable extends Migration { $table->integer('id', true); $table->string('name', 32); $table->integer('apirequests')->unsigned(); + $table->integer('rate_limit')->default(60); $table->integer('downloadrequests')->unsigned(); $table->integer('defaultinvites')->unsigned(); $table->boolean('isdefault')->default(0); diff --git a/resources/db/patches/mysql/+1~user.sql b/resources/db/patches/mysql/+1~user.sql new file mode 100644 index 000000000..70a6882fa --- /dev/null +++ b/resources/db/patches/mysql/+1~user.sql @@ -0,0 +1,5 @@ +# Add rate_limit column to users and user_roles tables, for api rate limiting purposes + +ALTER TABLE users ADD rate_limit INT DEFAULT 60 COMMENT 'Rate limiting, requests per minute'; + +ALTER TABLE user_roles ADD rate_limit INT DEFAULT 60 COMMENT 'Rate limiting, requests per minute'; diff --git a/resources/db/patches/mysql/0348~user.sql b/resources/db/patches/mysql/0348~user.sql new file mode 100644 index 000000000..70a6882fa --- /dev/null +++ b/resources/db/patches/mysql/0348~user.sql @@ -0,0 +1,5 @@ +# Add rate_limit column to users and user_roles tables, for api rate limiting purposes + +ALTER TABLE users ADD rate_limit INT DEFAULT 60 COMMENT 'Rate limiting, requests per minute'; + +ALTER TABLE user_roles ADD rate_limit INT DEFAULT 60 COMMENT 'Rate limiting, requests per minute'; diff --git a/resources/views/themes/admin/role-edit.tpl b/resources/views/themes/admin/role-edit.tpl index 5b0bad801..38c43316f 100644 --- a/resources/views/themes/admin/role-edit.tpl +++ b/resources/views/themes/admin/role-edit.tpl @@ -28,6 +28,14 @@ + + Api rate limit: + + +
Number of api requests allowed per 1 minute
+ + + Download Requests: diff --git a/routes/api.php b/routes/api.php index a5c6a6f55..7a1e5d92a 100644 --- a/routes/api.php +++ b/routes/api.php @@ -26,7 +26,7 @@ Route::prefix('v2')->group(function () { }); }); -Route::prefix('v2')->middleware('auth:api')->group(function () { +Route::prefix('v2')->middleware('auth:api', 'throttle:rate_limit,1')->group(function () { Route::namespace('Api')->group(function () { Route::get('movies', 'ApiV2Controller@movie'); Route::post('movies', 'ApiV2Controller@movie');