Jennie Robinson Faber
3f42307c64
Parallel Playwright runs (6 workers, all from 127.0.0.1) burned through the 100 req/min generalLimiter budget within the first ~30s, causing every API call (including /api/dev/test-login and /api/dev/member-login) to return 429 for the rest of the window. Auth helper waitForURL then timed out at 45s with no redirect ever firing — surfacing as 8 cascading test failures across auth.spec.js, board.spec.js, and admin-members.spec.js. The bypass mirrors the existing gate used by /api/dev/* endpoints: the env var is opt-in and only set in development (.env) or by Playwright's webServer config. Production never sets it, so rate limiting remains active.
70 lines
2 KiB
JavaScript
70 lines
2 KiB
JavaScript
import { RateLimiterMemory } from 'rate-limiter-flexible'
|
|
|
|
// Strict rate limit for auth endpoints
|
|
const authLimiter = new RateLimiterMemory({
|
|
points: 5, // 5 requests
|
|
duration: 300, // per 5 minutes
|
|
keyPrefix: 'rl_auth'
|
|
})
|
|
|
|
// Moderate rate limit for payment endpoints
|
|
const paymentLimiter = new RateLimiterMemory({
|
|
points: 10,
|
|
duration: 60,
|
|
keyPrefix: 'rl_payment'
|
|
})
|
|
|
|
// Light rate limit for upload endpoints
|
|
const uploadLimiter = new RateLimiterMemory({
|
|
points: 10,
|
|
duration: 60,
|
|
keyPrefix: 'rl_upload'
|
|
})
|
|
|
|
// General API rate limit
|
|
const generalLimiter = new RateLimiterMemory({
|
|
points: 100,
|
|
duration: 60,
|
|
keyPrefix: 'rl_general'
|
|
})
|
|
|
|
function getClientIp(event) {
|
|
return getHeader(event, 'x-forwarded-for')?.split(',')[0]?.trim()
|
|
|| getHeader(event, 'x-real-ip')
|
|
|| event.node.req.socket.remoteAddress
|
|
|| 'unknown'
|
|
}
|
|
|
|
const AUTH_PATHS = new Set(['/api/auth/login', '/api/auth/verify'])
|
|
const PAYMENT_PREFIXES = ['/api/helcim/']
|
|
const UPLOAD_PATHS = new Set(['/api/upload/image'])
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const path = getRequestURL(event).pathname
|
|
if (!path.startsWith('/api/')) return
|
|
|
|
// Bypass rate limiting in test/dev opt-in mode so parallel E2E runs from a
|
|
// single IP (127.0.0.1) do not exhaust the per-IP budget. Mirrors the gate
|
|
// used by /api/dev/* endpoints — only set in development and by Playwright.
|
|
if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') return
|
|
|
|
const ip = getClientIp(event)
|
|
|
|
try {
|
|
if (AUTH_PATHS.has(path)) {
|
|
await authLimiter.consume(ip)
|
|
} else if (PAYMENT_PREFIXES.some(p => path.startsWith(p))) {
|
|
await paymentLimiter.consume(ip)
|
|
} else if (UPLOAD_PATHS.has(path)) {
|
|
await uploadLimiter.consume(ip)
|
|
} else {
|
|
await generalLimiter.consume(ip)
|
|
}
|
|
} catch (rateLimiterRes) {
|
|
setHeader(event, 'Retry-After', Math.ceil(rateLimiterRes.msBeforeNext / 1000))
|
|
throw createError({
|
|
statusCode: 429,
|
|
statusMessage: 'Too many requests. Please try again later.'
|
|
})
|
|
}
|
|
})
|