testing new rate limit middleware

config/index.js

@@ -16,7 +16,7 @@ const config = {
     : 10,
   whitelistDomains: process.env.WHITELIST_DOMAINS
     ? process.env.WHITELIST_DOMAINS.split(',')
-    : ['fullstack.cash', 'psfoundation.cash']
+    : ['fullstack.cash', 'psfoundation.cash', '10.0.']
 }
 
 module.exports = config

package.json

@@ -23,7 +23,7 @@
     "coverage:report": "export NETWORK=mainnet && nyc --reporter=html mocha --timeout 25000 test/v4/",
     "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs",
     "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#hydrateUtxosWL' test/v4/integration/",
-    "test:temp2": "mocha test/v4/rate-limits.js"
+    "test:temp2": "mocha test/v4/rate-limit2-unit.js"
   },
   "engines": {
     "node": ">=10.15.1"

src/app.js

@@ -7,6 +7,9 @@ const express = require('express')
 const RateLimits = require('./middleware/route-ratelimit')
 const rateLimits = new RateLimits()
 
+const RateLimits2 = require('./middleware/route-ratelimit2')
+const rateLimits2 = new RateLimits2()
+
 const path = require('path')
 const logger = require('morgan')
 const wlogger = require('./util/winston-logging')
@@ -103,6 +106,8 @@ const USE_RATE_LIMITS = process.env.USE_RATE_LIMITS
   : true
 const auth = new AuthMW()
 
+console.log(`USE_RATE_LIMITS: ${USE_RATE_LIMITS}`)
+
 if (USE_RATE_LIMITS) {
   // Inspect the header for a JWT token.
   app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
@@ -111,6 +116,9 @@ if (USE_RATE_LIMITS) {
   // Handles Anonymous and Basic Authorization schemes used by passport.js
   app.use(`/${v4prefix}/`, auth.mw())
 
+  // Experimental rate limits
+  app.use(`/${v4prefix}/`, rateLimits2.applyRateLimits)
+
   // Rate limit on all v4 routes
   // Establish and enforce rate limits.
   app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)

src/middleware/route-ratelimit2.js

@@ -45,10 +45,10 @@ const rateLimitOptions = {
 }
 
 // Constants
-const ANON_LIMITS = config.anonRateLimit
-const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
+// const ANON_LIMITS = config.anonRateLimit
+// const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
 const WHITELIST_DOMAINS = config.whitelistDomains
-const INTERNAL_RATE_LIMIT = 1
+// const INTERNAL_RATE_LIMIT = 1
 
 class RateLimits {
   constructor () {
@@ -56,7 +56,7 @@ class RateLimits {
 
     this.jwt = jwt
     this.rateLimiter = new RateLimiterRedis(rateLimitOptions)
-    this.config = config
+    _this.config = config
   }
 
   // This is the main middleware funciton of this library. All other functions
@@ -134,15 +134,18 @@ class RateLimits {
 
       // Retrieve the origin.
       const origin = req.get('origin')
+      console.log(`origin: ${origin}`)
 
       // console.log(`WHITELIST_DOMAINS: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
 
       for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
         const thisDomain = WHITELIST_DOMAINS[i]
 
-        if (origin.toString().indexOf(thisDomain) > -1) {
-          return true
-        }
+        // if (origin.toString().indexOf(thisDomain) > -1) {
+        //   return true
+        // }
+
+        if (origin.includes(thisDomain)) return true
       }
 
       return retVal

test/v4/rate-limit2-unit.js

@@ -59,7 +59,7 @@ describe('#rate-routelimit2', () => {
 
   describe('#checkInternalIp', () => {
     it('should return true for a request from localhost', () => {
-      req.ip = '127.0.0.1'
+      req.ip = '::ffff:127.0.0.1'
 
       const result = uut.checkInternalIp(req)
 
@@ -90,4 +90,32 @@ describe('#rate-routelimit2', () => {
       assert.equal(result, false)
     })
   })
+
+  describe('#isInWhitelist', () => {
+    it('should return false when no argument is passed in', () => {
+      const result = uut.isInWhitelist()
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when origin is not in the whitelist', () => {
+      req.origin = 'blah.com'
+
+      const result = uut.isInWhitelist(req)
+
+      assert.equal(result, false)
+
+      // Used to appease linter. Remove these.
+      res.blah = 4
+      next()
+    })
+
+    // it('should return true when origin is in the whitelist', () => {
+    //   req.origin = 'message.fullstack.cash'
+    //
+    //   const result = uut.isInWhitelist(req)
+    //
+    //   assert.equal(result, true)
+    // })
+  })
 })