Skip to content
Sign up

flagon-io/g1t

public
0
121 linesCodeBlameRaw
1/**
2 * The front door's rate limits (workers/app.ts), per request before it is
3 * answered. The bindings and their limits are in `RATE_LIMITS`
4 * (packages/contracts/src/rate-limits.ts); docs/RATE-LIMITS.md says why.
5 *
6 * - Git over HTTPS: without credentials, by address; with them, by a hash
7 * of the credential, much higher. A clone is about three requests.
8 * - Pages: every request that reaches the Worker counts against a ceiling
9 * per address. Signed out, by address, with a tighter limit on what is
10 * costly to answer (archives, run pages, logs, search). Signed in, by a
11 * hash of the session cookie, higher: the session is not checked here,
12 * which would cost a call to identity, and the ceiling per address keeps
13 * made-up cookies from getting round the signed-out limit. With an
14 * access token (`Authorization: Bearer`, app/lib/website-token.ts), by a
15 * hash of the token, at the API's limit for a token; the address ceiling
16 * applies as for cookies.
17 *
18 * Static assets never reach the Worker (the assets binding answers them),
19 * and the few files it serves itself are left out here too. Every limit
20 * fails open.
21 */
22import {
23 type RateLimitBinding,
24 checkLimit,
25 clientAddress,
26 secretKey,
27 tooManyRequests,
28} from "@g1t/contracts/rate-limits";
29
30export type FrontDoorLimits = {
31 WEB_ANONYMOUS_LIMIT?: RateLimitBinding;
32 WEB_HEAVY_LIMIT?: RateLimitBinding;
33 WEB_SESSION_LIMIT?: RateLimitBinding;
34 WEB_ADDRESS_LIMIT?: RateLimitBinding;
35 WEB_TOKEN_LIMIT?: RateLimitBinding;
36 GIT_ANONYMOUS_LIMIT?: RateLimitBinding;
37 GIT_SIGNED_LIMIT?: RateLimitBinding;
38};
39
40/** Files the Worker serves that are never limited: build output, fonts, and top-level files such as robots.txt. */
41const UNLIMITED = /^\/(?:assets\/|fonts\/|favicon|[^/]+\.(?:ico|png|svg|txt|xml|webmanifest)$)/;
42
43/** What is costly to answer for a signed-out visitor: a repository's archives, a run's page, logs and artifacts, and search. */
44const HEAVY =
45 /^\/(?:search(?:\.data)?$|[^/]+\/[^/]+\/(?:archive\/|actions\/runs\/[^/]+(?:\.data|\/logs\.zip|\/artifacts\/[^/]+)?$|actions\/jobs\/[^/]+\/log))/;
46
47export function unlimited(pathname: string): boolean {
48 return UNLIMITED.test(pathname);
49}
50
51export function heavy(pathname: string): boolean {
52 return HEAVY.test(pathname);
53}
54
55/** The session cookie's value, or null when signed out. */
56export function sessionCookie(cookie: string | null): string | null {
57 const match = /(?:^|;\s*)g1t_session=([^;]+)/.exec(cookie ?? "");
58 return match?.[1] ?? null;
59}
60
61const GIT_MESSAGE_ANONYMOUS =
62 "Too many git requests from your network. Wait a minute and try again, or use credentials for a higher limit: https://docs.g1t.sh/reference/rate-limits/\n";
63const GIT_MESSAGE_SIGNED = "Too many git requests with these credentials. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/\n";
64const PAGE_MESSAGE = "Too many requests from your network. Wait a minute and try again.\n";
65const TOKEN_PAGE_MESSAGE = "Too many requests with this access token. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/\n";
66
67/**
68 * The 429 for a git request past its limit, or null to go on. Git shows a
69 * plain-text answer's body to the person running it.
70 */
71export async function gitLimited(env: FrontDoorLimits, request: Request): Promise<Response | null> {
72 const credentials = request.headers.get("authorization");
73 if (credentials) {
74 const verdict = await checkLimit(env.GIT_SIGNED_LIMIT, await secretKey("git", credentials));
75 return verdict === "limited" ? tooManyRequests(GIT_MESSAGE_SIGNED) : null;
76 }
77 const verdict = await checkLimit(env.GIT_ANONYMOUS_LIMIT, `ip:${clientAddress(request)}`);
78 return verdict === "limited" ? tooManyRequests(GIT_MESSAGE_ANONYMOUS) : null;
79}
80
81/**
82 * The token in a page request's `Authorization: Bearer` header, or null
83 * (app/lib/website-token.ts). Not checked here either.
84 */
85export function websiteToken(authorization: string | null): string | null {
86 return /^\s*bearer\s+(\S+)\s*$/i.exec(authorization ?? "")?.[1] ?? null;
87}
88
89/** The 429 for a page or data request past its limit, or null to go on. */
90export async function pageLimited(env: FrontDoorLimits, request: Request, pathname: string): Promise<Response | null> {
91 if (unlimited(pathname)) return null;
92 const address = `ip:${clientAddress(request)}`;
93 const token = websiteToken(request.headers.get("authorization"));
94 const session = sessionCookie(request.headers.get("cookie"));
95 const checks: Promise<string>[] = [checkLimit(env.WEB_ADDRESS_LIMIT, address)];
96 if (token) {
97 // A token on the website: per token, as the API counts it.
98 checks.push(secretKey("token", token).then((key) => checkLimit(env.WEB_TOKEN_LIMIT, key)));
99 } else if (session) {
100 checks.push(secretKey("session", session).then((key) => checkLimit(env.WEB_SESSION_LIMIT, key)));
101 } else {
102 checks.push(checkLimit(env.WEB_ANONYMOUS_LIMIT, address));
103 if (heavy(pathname)) checks.push(checkLimit(env.WEB_HEAVY_LIMIT, address));
104 }
105 const verdicts = await Promise.all(checks);
106 if (!verdicts.includes("limited")) return null;
107 if (token && verdicts[1] === "limited") return tooManyRequests(TOKEN_PAGE_MESSAGE);
108 return tooManyRequests(token || session ? PAGE_MESSAGE : `${PAGE_MESSAGE.trimEnd()} Signed-in accounts have a higher limit.\n`);
109}
110
111/**
112 * The 429 for a repository file on the usercontent origin past its limit,
113 * or null to go on. Nothing there is signed in (it never sees the session
114 * cookie), so a file counts as a signed-out page from its address. Avatars
115 * and custom emoji are answered from cache and are not limited.
116 */
117export async function usercontentLimited(env: FrontDoorLimits, request: Request, path: string): Promise<Response | null> {
118 if (path.startsWith("/avatars/") || path.startsWith("/emoji/")) return null;
119 const verdict = await checkLimit(env.WEB_ANONYMOUS_LIMIT, `ip:${clientAddress(request)}`);
120 return verdict === "limited" ? tooManyRequests(PAGE_MESSAGE) : null;
121}