From 61485dfe9975f14df7173bfa48c9a352a8969408 Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Thu, 7 Jan 2021 09:11:35 -0800
Subject: [PATCH] fix(rate limits): Configuring rate limits with env vars

---
 config/index.js                   |  1 +
 package.json                      |  5 +++--
 src/middleware/route-ratelimit.js | 16 ++++++----------
 test/v4/rate-limits.js            | 24 ++++++++++++++++++++++++
 4 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/config/index.js b/config/index.js
index 3040b2b..00bb0ca 100644
--- a/config/index.js
+++ b/config/index.js
@@ -1,5 +1,6 @@
 /*
   Common configuration settings.
+  Default settings in this file can be overridden by an environment variable.
 */
 
 const config = {
diff --git a/package.json b/package.json
index 3afd381..0597122 100644
--- a/package.json
+++ b/package.json
@@ -17,12 +17,13 @@
     "test": "npm run lint && npm run test-v4",
     "lint": "standard --env mocha --fix",
     "test-v4": "export NETWORK=mainnet && nyc --reporter=text mocha --timeout 60000 test/v4/",
-    "test:temp": "export NETWORK=mainnet && export TEST=integration && mocha --timeout 25000 test/v4/integration/price.js",
     "test:integration": "mocha test/v4/integration",
     "test:integration:slpdb": "mocha --timeout 25000 -g '#validate2Single' test/v4/integration/slp*.js",
     "coverage": "nyc report --reporter=text-lcov | coveralls",
     "coverage:report": "export NETWORK=mainnet && nyc --reporter=html mocha --timeout 25000 test/v4/",
-    "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs"
+    "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs",
+    "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --timeout 25000 test/v4/integration/price.js",
+    "test:temp2": "mocha test/v4/rate-limits.js"
   },
   "engines": {
     "node": ">=10.15.1"
diff --git a/src/middleware/route-ratelimit.js b/src/middleware/route-ratelimit.js
index 54428d0..a89ee2c 100644
--- a/src/middleware/route-ratelimit.js
+++ b/src/middleware/route-ratelimit.js
@@ -149,15 +149,9 @@ class RateLimits {
 
           // If the request originates from one of the approved wallet apps, then
           // apply paid-access rate limits.
-          if (
-            origin &&
-            (origin.toString().indexOf('fullstack.cash') > -1 ||
-              origin.toString().indexOf('splitbch.com') > -1 ||
-              origin.toString().indexOf('slp-api') > -1)
-          ) {
           // console.log(`origin: ${JSON.stringify(origin, null, 2)}`)
           // console.log(`whitelist: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
-          // if (this.isInWhitelist(origin)) {
+          if (this.isInWhitelist(origin)) {
             pointsToConsume = WHITELIST_RATE_LIMIT
             res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
           }
@@ -280,18 +274,20 @@ class RateLimits {
 
       if (!origin) return false
 
+      // console.log(`WHITELIST_DOMAINS: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
+
       for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
         const thisDomain = WHITELIST_DOMAINS[i]
 
-        if (origin.toString().indexOf(thisDomain)) {
+        if (origin.toString().indexOf(thisDomain) > -1) {
           return true
         }
       }
 
       return retVal
     } catch (err) {
-      wlogger.error('Error in route-ratelimit.js/isInWhitelist()')
-      throw err
+      wlogger.error('Error in route-ratelimit.js/isInWhitelist(). Returning false by default.')
+      return false
     }
   }
 }
diff --git a/test/v4/rate-limits.js b/test/v4/rate-limits.js
index 5dd61ff..6ebaeee 100644
--- a/test/v4/rate-limits.js
+++ b/test/v4/rate-limits.js
@@ -445,6 +445,30 @@ describe('#route-ratelimits & jwt-auth', () => {
       assert.equal(res.locals.pointsToConsume, 50)
     })
   })
+
+  describe('#isInWhitelist', () => {
+    it('should return false when no argument is passed in', () => {
+      const result = rateLimits.isInWhitelist()
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when origin is not in the whitelist', () => {
+      const origin = 'blah.com'
+
+      const result = rateLimits.isInWhitelist(origin)
+
+      assert.equal(result, false)
+    })
+
+    it('should return true when origin is in the whitelist', () => {
+      const origin = 'message.fullstack.cash'
+
+      const result = rateLimits.isInWhitelist(origin)
+
+      assert.equal(result, true)
+    })
+  })
 })
 
 // Generates a Basic authorization header.