Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
140 linesCodeBlameRaw
1/**
2 * The front door's rate limits (workers/app.ts), per request before it is
3 * answered. The bindings and their limits are in `RATE_LIMITS`
4 * (packages/contracts/src/rate-limits.ts); CONTRIBUTING.md, "Rate limits",
5 * says how they are kept.
6 *
7 * - Git over HTTPS: without credentials, by address; with them, by a hash
8 * of the credential, much higher. A clone is about three requests.
9 * - Pages: every request that reaches the Worker counts against a ceiling
10 * per address. Signed out, by address, with a tighter limit on what is
11 * costly to answer (archives, run pages, logs, search). Signed in, by a
12 * hash of the session cookie, higher: the session is not checked here,
13 * which would cost a call to identity, and the ceiling per address keeps
14 * made-up cookies from getting round the signed-out limit. With an
15 * access token (`Authorization: Bearer`, app/lib/website-token.ts), by a
16 * hash of the token, at the API's limit for a token; the address ceiling
17 * applies as for cookies.
18 *
19 * Static assets never reach the Worker (the assets binding answers them),
20 * and the few files it serves itself are left out here too. Every limit
21 * fails open.
22 */
23import { type RateLimitBinding, checkLimit, clientAddress, secretKey, tooManyRequests } from "@g1t/contracts/rate-limits";
24
25export type FrontDoorLimits = {
26 WEB_ANONYMOUS_LIMIT?: RateLimitBinding;
27 WEB_HEAVY_LIMIT?: RateLimitBinding;
28 WEB_SESSION_LIMIT?: RateLimitBinding;
29 WEB_ADDRESS_LIMIT?: RateLimitBinding;
30 WEB_TOKEN_LIMIT?: RateLimitBinding;
31 GIT_ANONYMOUS_LIMIT?: RateLimitBinding;
32 GIT_SIGNED_LIMIT?: RateLimitBinding;
33};
34
35/** Files the Worker serves that are never limited: build output, fonts, and top-level files such as robots.txt. */
36const UNLIMITED = /^\/(?:assets\/|fonts\/|favicon|[^/]+\.(?:ico|png|svg|txt|xml|webmanifest)$)/;
37
38/**
39 * What is costly to answer for a signed-out visitor, or must not be flooded:
40 * a repository's archives, a run's page, log downloads and artifacts,
41 * search, and the form that reports a vulnerability to a repository's
42 * maintainers privately, which takes no account. A running job's live log
43 * (`actions/jobs/:job/log`, a small read the page makes about once a
44 * second) counts as a page: with the run's page refreshing beside it, it
45 * would use up this limit in half a minute.
46 */
47const HEAVY =
48 /^\/(?:search(?:\.data)?$|[^/]+\/[^/]+\/(?:archive\/|actions\/runs\/[^/]+(?:\.data|\/logs\.zip|\/artifacts\/[^/]+)?$|actions\/jobs\/[^/]+\/log\.txt$|security\/report(?:\.data)?$))/;
49
50export function unlimited(pathname: string): boolean {
51 return UNLIMITED.test(pathname);
52}
53
54export function heavy(pathname: string): boolean {
55 return HEAVY.test(pathname);
56}
57
58/** The signed token of an archive download link (`archive/<ref>.zip|.tar.gz?token=`), or null. */
59export function archiveLink(pathname: string, url: string): string | null {
60 if (!/^\/[^/]+\/[^/]+\/archive\/.+\.(?:zip|tar\.gz)$/.test(pathname)) return null;
61 try {
62 return new URL(url).searchParams.get("token") || null;
63 } catch {
64 return null;
65 }
66}
67
68/** The session cookie's value, or null when signed out. */
69export function sessionCookie(cookie: string | null): string | null {
70 const match = /(?:^|;\s*)g1t_session=([^;]+)/.exec(cookie ?? "");
71 return match?.[1] ?? null;
72}
73
74const GIT_MESSAGE_ANONYMOUS =
75 "Too many git requests from your network. Wait a minute and try again, or use credentials for a higher limit: https://docs.g1t.sh/reference/rate-limits/\n";
76const GIT_MESSAGE_SIGNED = "Too many git requests with these credentials. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/\n";
77const PAGE_MESSAGE = "Too many requests from your network. Wait a minute and try again.\n";
78const TOKEN_PAGE_MESSAGE = "Too many requests with this access token. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/\n";
79
80/**
81 * The 429 for a git request past its limit, or null to go on. Git shows a
82 * plain-text answer's body to the person running it.
83 */
84export async function gitLimited(env: FrontDoorLimits, request: Request): Promise<Response | null> {
85 const credentials = request.headers.get("authorization");
86 if (credentials) {
87 const verdict = await checkLimit(env.GIT_SIGNED_LIMIT, await secretKey("git", credentials));
88 return verdict === "limited" ? tooManyRequests(GIT_MESSAGE_SIGNED) : null;
89 }
90 const verdict = await checkLimit(env.GIT_ANONYMOUS_LIMIT, `ip:${clientAddress(request)}`);
91 return verdict === "limited" ? tooManyRequests(GIT_MESSAGE_ANONYMOUS) : null;
92}
93
94/**
95 * The token in a page request's `Authorization: Bearer` header, or null
96 * (app/lib/website-token.ts). Not checked here either.
97 */
98export function websiteToken(authorization: string | null): string | null {
99 return /^\s*bearer\s+(\S+)\s*$/i.exec(authorization ?? "")?.[1] ?? null;
100}
101
102/** The 429 for a page or data request past its limit, or null to go on. */
103export async function pageLimited(env: FrontDoorLimits, request: Request, pathname: string): Promise<Response | null> {
104 if (unlimited(pathname)) return null;
105 const address = `ip:${clientAddress(request)}`;
106 const token = websiteToken(request.headers.get("authorization"));
107 const session = sessionCookie(request.headers.get("cookie"));
108 const checks: Promise<string>[] = [checkLimit(env.WEB_ADDRESS_LIMIT, address)];
109 if (token) {
110 // A token on the website: per token, as the API counts it.
111 checks.push(secretKey("token", token).then((key) => checkLimit(env.WEB_TOKEN_LIMIT, key)));
112 } else if (session) {
113 checks.push(secretKey("session", session).then((key) => checkLimit(env.WEB_SESSION_LIMIT, key)));
114 } else if (archiveLink(pathname, request.url)) {
115 // A signed archive link (`GET /repos/{owner}/{repo}/tarball/{ref}` made
116 // it for one commit, for 10 minutes) counts per link, as a token does:
117 // many jobs behind one address fall back to tarballs at once.
118 checks.push(secretKey("archive", archiveLink(pathname, request.url)!).then((key) => checkLimit(env.WEB_TOKEN_LIMIT, key)));
119 } else {
120 checks.push(checkLimit(env.WEB_ANONYMOUS_LIMIT, address));
121 if (heavy(pathname)) checks.push(checkLimit(env.WEB_HEAVY_LIMIT, address));
122 }
123 const verdicts = await Promise.all(checks);
124 if (!verdicts.includes("limited")) return null;
125 if (token && verdicts[1] === "limited") return tooManyRequests(TOKEN_PAGE_MESSAGE);
126 return tooManyRequests(token || session ? PAGE_MESSAGE : `${PAGE_MESSAGE.trimEnd()} Signed-in accounts have a higher limit.\n`);
127}
128
129/**
130 * The 429 for a repository file on the usercontent origin past its limit,
131 * or null to go on. Nothing there is signed in (it never sees the session
132 * cookie), so a file counts as a signed-out page from its address. Avatars,
133 * custom emoji and production images are answered from cache and are not
134 * limited.
135 */
136export async function usercontentLimited(env: FrontDoorLimits, request: Request, path: string): Promise<Response | null> {
137 if (path.startsWith("/avatars/") || path.startsWith("/emoji/") || path.startsWith("/production-images/")) return null;
138 const verdict = await checkLimit(env.WEB_ANONYMOUS_LIMIT, `ip:${clientAddress(request)}`);
139 return verdict === "limited" ? tooManyRequests(PAGE_MESSAGE) : null;
140}