From 20fea1e25f6f232abb3dabdfbb7269513ce039f8 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Thu, 13 Jun 2024 18:37:29 +0800
Subject: [PATCH] misc: added flag to disable rate limit updates via API

---
 .env.example                                          | 2 ++
 backend/src/lib/config/env.ts                         | 3 ++-
 backend/src/services/rate-limit/rate-limit-service.ts | 9 +++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 67110d69a..6670a0a3a 100644
--- a/.env.example
+++ b/.env.example
@@ -67,3 +67,5 @@ CLIENT_SECRET_GITLAB_LOGIN=
 CAPTCHA_SECRET=
 
 NEXT_PUBLIC_CAPTCHA_SITE_KEY=
+
+ALLOW_RATELIMIT_UPDATES=
diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 80a2111fc..7c02ebdbf 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -123,7 +123,8 @@ const envSchema = z
       .optional(),
     INFISICAL_CLOUD: zodStrBool.default("false"),
     MAINTENANCE_MODE: zodStrBool.default("false"),
-    CAPTCHA_SECRET: zpStr(z.string().optional())
+    CAPTCHA_SECRET: zpStr(z.string().optional()),
+    ALLOW_RATELIMIT_UPDATES: zodStrBool.default("false")
   })
   .transform((data) => ({
     ...data,
diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts
index ec69b1e95..a697f1afd 100644
--- a/backend/src/services/rate-limit/rate-limit-service.ts
+++ b/backend/src/services/rate-limit/rate-limit-service.ts
@@ -1,5 +1,7 @@
 import { CronJob } from "cron";
 
+import { getConfig } from "@app/lib/config/env";
+import { ForbiddenRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { rateLimitMaxConfiguration } from "@app/server/config/rateLimiter";
 
@@ -22,6 +24,13 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto
   };
 
   const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise<TRateLimit> => {
+    const appCfg = getConfig();
+    if (!appCfg.ALLOW_RATELIMIT_UPDATES) {
+      throw new ForbiddenRequestError({
+        name: "Rate limit Updates Disabled",
+        message: "Changes to rate limits are disabled"
+      });
+    }
     return rateLimitDAL.updateById("00000000-0000-0000-0000-000000000000", updates);
   };