From ab4c80b67408b05ee61f412d4c6515355ba75537 Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Sun, 3 Jan 2021 18:20:49 -0800
Subject: [PATCH] Created rate limit isInWhitelist(). Needs tests

---
 config/index.js                   | 12 +++++++++-
 src/middleware/route-ratelimit.js | 37 ++++++++++++++++++++++++++++---
 2 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/config/index.js b/config/index.js
index 542ffb1..3040b2b 100644
--- a/config/index.js
+++ b/config/index.js
@@ -3,9 +3,19 @@
 */
 
 const config = {
+  // This is the same secret used by jwt-bch-api
   apiTokenSecret: process.env.TOKENSECRET
     ? process.env.TOKENSECRET
-    : 'secret-jwt-token'
+    : 'secret-jwt-token',
+
+  // Rate Limits
+  anonRateLimit: process.env.ANON_RATE_LIMIT ? process.env.ANON_RATE_LIMIT : 50,
+  whitelistRateLimit: process.env.WHITELIST_RATE_LIMIT
+    ? process.env.WHITELIST_RATE_LIMIT
+    : 10,
+  whitelistDomains: process.env.WHITELIST_DOMAINS
+    ? process.env.WHITELIST_DOMAINS.split(',')
+    : ['fullstack.cash', 'psfoundation.cash']
 }
 
 module.exports = config
diff --git a/src/middleware/route-ratelimit.js b/src/middleware/route-ratelimit.js
index cce93d0..54428d0 100644
--- a/src/middleware/route-ratelimit.js
+++ b/src/middleware/route-ratelimit.js
@@ -12,12 +12,17 @@
 
 'use strict'
 
+// Public npm libraries.
 const jwt = require('jsonwebtoken')
 
+// local libraries.
 const wlogger = require('../util/winston-logging')
 const config = require('../../config')
 
-const ANON_LIMITS = 50
+const ANON_LIMITS = config.anonRateLimit
+const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
+const WHITELIST_DOMAINS = config.whitelistDomains
+const INTERNAL_RATE_LIMIT = 1
 
 // Redis
 const redisOptions = {
@@ -150,7 +155,10 @@ class RateLimits {
               origin.toString().indexOf('splitbch.com') > -1 ||
               origin.toString().indexOf('slp-api') > -1)
           ) {
-            pointsToConsume = 10
+          // console.log(`origin: ${JSON.stringify(origin, null, 2)}`)
+          // console.log(`whitelist: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
+          // if (this.isInWhitelist(origin)) {
+            pointsToConsume = WHITELIST_RATE_LIMIT
             res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
           }
 
@@ -161,7 +169,7 @@ class RateLimits {
             // Do not comment out this line.
             key.toString().indexOf('172.17.') > -1
           ) {
-            pointsToConsume = 1
+            pointsToConsume = INTERNAL_RATE_LIMIT
             res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
           }
 
@@ -263,6 +271,29 @@ class RateLimits {
       throw err
     }
   }
+
+  // Returns a boolean if the origin of the request matches a domain in the
+  // whitelist.
+  isInWhitelist (origin) {
+    try {
+      const retVal = false // Default value.
+
+      if (!origin) return false
+
+      for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
+        const thisDomain = WHITELIST_DOMAINS[i]
+
+        if (origin.toString().indexOf(thisDomain)) {
+          return true
+        }
+      }
+
+      return retVal
+    } catch (err) {
+      wlogger.error('Error in route-ratelimit.js/isInWhitelist()')
+      throw err
+    }
+  }
 }
 
 module.exports = RateLimits