From 72ba3c86c784de2d9204e98f34be93c7cb0ea69a Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Sun, 7 Mar 2021 12:42:10 -0800
Subject: [PATCH] testing new rate limit middleware

---
 config/index.js                    |  2 +-
 package.json                       |  2 +-
 src/app.js                         |  8 ++++++++
 src/middleware/route-ratelimit2.js | 17 ++++++++++-------
 test/v4/rate-limit2-unit.js        | 30 +++++++++++++++++++++++++++++-
 5 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/config/index.js b/config/index.js
index 3e1d1a2..1a59546 100644
--- a/config/index.js
+++ b/config/index.js
@@ -16,7 +16,7 @@ const config = {
     : 10,
   whitelistDomains: process.env.WHITELIST_DOMAINS
     ? process.env.WHITELIST_DOMAINS.split(',')
-    : ['fullstack.cash', 'psfoundation.cash']
+    : ['fullstack.cash', 'psfoundation.cash', '10.0.']
 }
 
 module.exports = config
diff --git a/package.json b/package.json
index dda247b..d4c3a45 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "coverage:report": "export NETWORK=mainnet && nyc --reporter=html mocha --timeout 25000 test/v4/",
     "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs",
     "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#hydrateUtxosWL' test/v4/integration/",
-    "test:temp2": "mocha test/v4/rate-limits.js"
+    "test:temp2": "mocha test/v4/rate-limit2-unit.js"
   },
   "engines": {
     "node": ">=10.15.1"
diff --git a/src/app.js b/src/app.js
index 3531fac..58badda 100644
--- a/src/app.js
+++ b/src/app.js
@@ -7,6 +7,9 @@ const express = require('express')
 const RateLimits = require('./middleware/route-ratelimit')
 const rateLimits = new RateLimits()
 
+const RateLimits2 = require('./middleware/route-ratelimit2')
+const rateLimits2 = new RateLimits2()
+
 const path = require('path')
 const logger = require('morgan')
 const wlogger = require('./util/winston-logging')
@@ -103,6 +106,8 @@ const USE_RATE_LIMITS = process.env.USE_RATE_LIMITS
   : true
 const auth = new AuthMW()
 
+console.log(`USE_RATE_LIMITS: ${USE_RATE_LIMITS}`)
+
 if (USE_RATE_LIMITS) {
   // Inspect the header for a JWT token.
   app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
@@ -111,6 +116,9 @@ if (USE_RATE_LIMITS) {
   // Handles Anonymous and Basic Authorization schemes used by passport.js
   app.use(`/${v4prefix}/`, auth.mw())
 
+  // Experimental rate limits
+  app.use(`/${v4prefix}/`, rateLimits2.applyRateLimits)
+
   // Rate limit on all v4 routes
   // Establish and enforce rate limits.
   app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)
diff --git a/src/middleware/route-ratelimit2.js b/src/middleware/route-ratelimit2.js
index 9624b90..920c6a1 100644
--- a/src/middleware/route-ratelimit2.js
+++ b/src/middleware/route-ratelimit2.js
@@ -45,10 +45,10 @@ const rateLimitOptions = {
 }
 
 // Constants
-const ANON_LIMITS = config.anonRateLimit
-const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
+// const ANON_LIMITS = config.anonRateLimit
+// const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
 const WHITELIST_DOMAINS = config.whitelistDomains
-const INTERNAL_RATE_LIMIT = 1
+// const INTERNAL_RATE_LIMIT = 1
 
 class RateLimits {
   constructor () {
@@ -56,7 +56,7 @@ class RateLimits {
 
     this.jwt = jwt
     this.rateLimiter = new RateLimiterRedis(rateLimitOptions)
-    this.config = config
+    _this.config = config
   }
 
   // This is the main middleware funciton of this library. All other functions
@@ -134,15 +134,18 @@ class RateLimits {
 
       // Retrieve the origin.
       const origin = req.get('origin')
+      console.log(`origin: ${origin}`)
 
       // console.log(`WHITELIST_DOMAINS: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
 
       for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
         const thisDomain = WHITELIST_DOMAINS[i]
 
-        if (origin.toString().indexOf(thisDomain) > -1) {
-          return true
-        }
+        // if (origin.toString().indexOf(thisDomain) > -1) {
+        //   return true
+        // }
+
+        if (origin.includes(thisDomain)) return true
       }
 
       return retVal
diff --git a/test/v4/rate-limit2-unit.js b/test/v4/rate-limit2-unit.js
index 2bb7c99..2802bad 100644
--- a/test/v4/rate-limit2-unit.js
+++ b/test/v4/rate-limit2-unit.js
@@ -59,7 +59,7 @@ describe('#rate-routelimit2', () => {
 
   describe('#checkInternalIp', () => {
     it('should return true for a request from localhost', () => {
-      req.ip = '127.0.0.1'
+      req.ip = '::ffff:127.0.0.1'
 
       const result = uut.checkInternalIp(req)
 
@@ -90,4 +90,32 @@ describe('#rate-routelimit2', () => {
       assert.equal(result, false)
     })
   })
+
+  describe('#isInWhitelist', () => {
+    it('should return false when no argument is passed in', () => {
+      const result = uut.isInWhitelist()
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when origin is not in the whitelist', () => {
+      req.origin = 'blah.com'
+
+      const result = uut.isInWhitelist(req)
+
+      assert.equal(result, false)
+
+      // Used to appease linter. Remove these.
+      res.blah = 4
+      next()
+    })
+
+    // it('should return true when origin is in the whitelist', () => {
+    //   req.origin = 'message.fullstack.cash'
+    //
+    //   const result = uut.isInWhitelist(req)
+    //
+    //   assert.equal(result, true)
+    // })
+  })
 })