From 26ed8df73c8048bbdb2628d49d016dae9b972447 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 6 Aug 2024 19:14:49 +0800 Subject: [PATCH] misc: finalized list of license rate limits --- backend/src/ee/services/license/licence-fns.ts | 7 +------ backend/src/ee/services/license/license-types.ts | 8 +++++--- backend/src/ee/services/rate-limit/rate-limit-service.ts | 6 ++---- backend/src/ee/services/rate-limit/rate-limit-types.ts | 1 - backend/src/server/config/rateLimiter.ts | 8 -------- backend/src/server/plugins/inject-rate-limits.ts | 9 ++++----- backend/src/server/routes/v1/identity-router.ts | 4 ++-- backend/src/server/routes/v2/organization-router.ts | 4 ++-- backend/src/server/routes/v2/project-router.ts | 4 ++-- 9 files changed, 18 insertions(+), 33 deletions(-) diff --git a/backend/src/ee/services/license/licence-fns.ts b/backend/src/ee/services/license/licence-fns.ts index ad6a98573..bd40f75cb 100644 --- a/backend/src/ee/services/license/licence-fns.ts +++ b/backend/src/ee/services/license/licence-fns.ts @@ -43,13 +43,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({ externalKms: false, rateLimits: { readLimit: 60, - publicEndpointLimit: 30, writeLimit: 200, - secretsLimit: 40, - authRateLimit: 60, - inviteUserRateLimit: 30, - mfaRateLimit: 20, - creationLimit: 30 + secretsLimit: 40 } }); diff --git a/backend/src/ee/services/license/license-types.ts b/backend/src/ee/services/license/license-types.ts index 262547772..70db8e4d9 100644 --- a/backend/src/ee/services/license/license-types.ts +++ b/backend/src/ee/services/license/license-types.ts @@ -1,7 +1,5 @@ import { TOrgPermission } from "@app/lib/types"; -import { RateLimitConfiguration } from "../rate-limit/rate-limit-types"; - export enum InstanceType { OnPrem = "self-hosted", EnterpriseOnPrem = "enterprise-self-hosted", @@ -60,7 +58,11 @@ export type TFeatureSet = { caCrl: false; instanceUserManagement: false; externalKms: false; - rateLimits: RateLimitConfiguration; + rateLimits: { + readLimit: number; + writeLimit: number; + secretsLimit: number; + }; }; export type TOrgPlansTableDTO = { diff --git a/backend/src/ee/services/rate-limit/rate-limit-service.ts b/backend/src/ee/services/rate-limit/rate-limit-service.ts index b35b02dd4..208fa8428 100644 --- a/backend/src/ee/services/rate-limit/rate-limit-service.ts +++ b/backend/src/ee/services/rate-limit/rate-limit-service.ts @@ -13,8 +13,7 @@ let rateLimitMaxConfiguration: RateLimitConfiguration = { secretsLimit: 60, authRateLimit: 60, inviteUserRateLimit: 30, - mfaRateLimit: 20, - creationLimit: 30 + mfaRateLimit: 20 }; Object.freeze(rateLimitMaxConfiguration); @@ -67,8 +66,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL secretsLimit: rateLimit.secretsRateLimit, authRateLimit: rateLimit.authRateLimit, inviteUserRateLimit: rateLimit.inviteUserRateLimit, - mfaRateLimit: rateLimit.mfaRateLimit, - creationLimit: rateLimit.creationLimit + mfaRateLimit: rateLimit.mfaRateLimit }; logger.info(`syncRateLimitConfiguration: rate limit configuration: %o`, newRateLimitMaxConfiguration); diff --git a/backend/src/ee/services/rate-limit/rate-limit-types.ts b/backend/src/ee/services/rate-limit/rate-limit-types.ts index 7d5859367..5a0b875a4 100644 --- a/backend/src/ee/services/rate-limit/rate-limit-types.ts +++ b/backend/src/ee/services/rate-limit/rate-limit-types.ts @@ -23,5 +23,4 @@ export type RateLimitConfiguration = { authRateLimit: number; inviteUserRateLimit: number; mfaRateLimit: number; - creationLimit: number; }; diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index cfadca9cc..bdbf80371 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -66,14 +66,6 @@ export const mfaRateLimit: RateLimitOptions = { } }; -export const creationLimit: RateLimitOptions = { - // identity, project, org - timeWindow: 60 * 1000, - hook: "preValidation", - max: (req) => req.rateLimits.creationLimit, - keyGenerator: (req) => req.realIp -}; - // Public endpoints to avoid brute force attacks export const publicEndpointLimit: RateLimitOptions = { // Read Shared Secrets diff --git a/backend/src/server/plugins/inject-rate-limits.ts b/backend/src/server/plugins/inject-rate-limits.ts index 49b95c761..1674ea542 100644 --- a/backend/src/server/plugins/inject-rate-limits.ts +++ b/backend/src/server/plugins/inject-rate-limits.ts @@ -27,13 +27,12 @@ export const injectRateLimits = fp(async (server) => { // we're using the null coalescing operator in order to handle outdated licenses req.rateLimits = { readLimit: rateLimits?.readLimit ?? instanceRateLimiterConfig.readLimit, - publicEndpointLimit: rateLimits?.publicEndpointLimit ?? instanceRateLimiterConfig.publicEndpointLimit, writeLimit: rateLimits?.writeLimit ?? instanceRateLimiterConfig.writeLimit, secretsLimit: rateLimits?.secretsLimit ?? instanceRateLimiterConfig.secretsLimit, - authRateLimit: rateLimits?.authRateLimit ?? instanceRateLimiterConfig.authRateLimit, - inviteUserRateLimit: rateLimits?.inviteUserRateLimit ?? instanceRateLimiterConfig.inviteUserRateLimit, - mfaRateLimit: rateLimits?.mfaRateLimit ?? instanceRateLimiterConfig.mfaRateLimit, - creationLimit: rateLimits?.creationLimit ?? instanceRateLimiterConfig.creationLimit + publicEndpointLimit: instanceRateLimiterConfig.publicEndpointLimit, + authRateLimit: instanceRateLimiterConfig.authRateLimit, + inviteUserRateLimit: instanceRateLimiterConfig.inviteUserRateLimit, + mfaRateLimit: instanceRateLimiterConfig.mfaRateLimit }; }); }); diff --git a/backend/src/server/routes/v1/identity-router.ts b/backend/src/server/routes/v1/identity-router.ts index b1cd6cd9d..23aca9625 100644 --- a/backend/src/server/routes/v1/identity-router.ts +++ b/backend/src/server/routes/v1/identity-router.ts @@ -3,7 +3,7 @@ import { z } from "zod"; import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { IDENTITIES } from "@app/lib/api-docs"; -import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -16,7 +16,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => { method: "POST", url: "/", config: { - rateLimit: creationLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v2/organization-router.ts b/backend/src/server/routes/v2/organization-router.ts index 49488776b..e6ea094c3 100644 --- a/backend/src/server/routes/v2/organization-router.ts +++ b/backend/src/server/routes/v2/organization-router.ts @@ -9,7 +9,7 @@ import { UsersSchema } from "@app/db/schemas"; import { ORGANIZATIONS } from "@app/lib/api-docs"; -import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { ActorType, AuthMode } from "@app/services/auth/auth-type"; @@ -307,7 +307,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => { method: "POST", url: "/", config: { - rateLimit: creationLimit + rateLimit: writeLimit }, schema: { body: z.object({ diff --git a/backend/src/server/routes/v2/project-router.ts b/backend/src/server/routes/v2/project-router.ts index 58ae9e293..8cfb2c19b 100644 --- a/backend/src/server/routes/v2/project-router.ts +++ b/backend/src/server/routes/v2/project-router.ts @@ -4,7 +4,7 @@ import { z } from "zod"; import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { PROJECTS } from "@app/lib/api-docs"; -import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -142,7 +142,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { method: "POST", url: "/", config: { - rateLimit: creationLimit + rateLimit: writeLimit }, schema: { description: "Create a new project",