Merge pull request #58 from Permissionless-Software-Foundation/ct-unstable

fix(rate limits): Adding local server back to whitelist

README.md

@@ -1,8 +1,8 @@
 # bch-api
 
-This is a node.js JavaScript REST API server using Express.js. The purpose of this code is to create a REST API server that provides a common interface for working with a Bitcoin Cash full node and various indexers. See [this article](https://troutsblog.com/research/bitcoin-cash/how-to-bch-full-stack-developer) to learn about the 'Cash Stack'. Visit [FullStack.cash](https://fullstack.cash), sign up for a free account, and use this REST API right away with the [bch-js](https://github.com/christroutner/bch-js) JavaScript library.
+This is a node.js JavaScript REST API server using Express.js. The purpose of this code is to create a REST API server that provides a common interface for working with a Bitcoin Cash full node and various indexers. See [this article](https://troutsblog.com/research/bitcoin-cash/how-to-bch-full-stack-developer) to learn about the 'Cash Stack'. Visit [FullStack.cash](https://fullstack.cash), sign up for a free account, and use this REST API right away with the [bch-js](https://github.com/Permissionless-Software-Foundation/bch-js) JavaScript library.
 
-This repository is intended to be paired with [bch-js](https://github.com/christroutner/bch-js), an npm JavaScript library for building Bitcoin Cash apps.
+This repository is intended to be paired with [bch-js](https://github.com/Permissionless-Software-Foundation/bch-js), an npm JavaScript library for building Bitcoin Cash apps.
 
 ![Cash Stack Network Diagram](./generic-network-diagram.png)
 
@@ -29,7 +29,7 @@ Rate limits are 20 requests per minute, but you can increase them to 100 with a
 You can bootstrap your own REST API server by downloading and installing the infrastructure listed on the [CashStrap](https://fullstack.cash/cashstrap) page.
 
 ### Configure bch-js
-The live servers can be used by [bch-js](https://github.com/christroutner/bch-js) by settings the `restURL` config property to one of these servers:
+The live servers can be used by [bch-js](https://github.com/Permissionless-Software-Foundation/bch-js) by settings the `restURL` config property to one of these servers:
 
 - BCHN Mainnet REST API server: https://bchn.fullstack.cash/v3/
 - ABC Mainnet REST API server: https://abc.fullstack.cash/v3/
@@ -48,7 +48,7 @@ This is a standard node.js project. The installation is as follows:
 
 - Clone this repository:
 
-`git clone https://github.com/christroutner/bch-api && cd bch-api`
+`git clone https://github.com/Permissionless-Software-Foundation/bch-api && cd bch-api`
 
 - Install dependencies:
 
@@ -83,5 +83,10 @@ installation.
 Have questions? Need help? Join our community support
 [Telegram channel](https://t.me/bch_js_toolkit)
 
+## IPFS
+Copies of this repository will occasionally be uploaded and hosted on [IPFS](https://ipfs.io):
+
+- v1.15.4: QmSAerFmDJm6KQp2HC8jsRR5MdL5X39hoUsJYvWNDvrD8m
+
 ## License
 [MIT](./LICENSE.md)

src/middleware/auth.js

@@ -22,9 +22,9 @@
 'use strict'
 
 const passport = require('passport')
-// const BasicStrategy = require('passport-http').BasicStrategy
+const BasicStrategy = require('passport-http').BasicStrategy
 const AnonymousStrategy = require('passport-anonymous')
-// const wlogger = require('../util/winston-logging')
+const wlogger = require('../util/winston-logging')
 
 // Used for debugging and iterrogating JS objects.
 const util = require('util')
@@ -33,9 +33,9 @@ util.inspect.defaultOptions = { depth: 1 }
 // let _this
 
 // Set default rate limit value for testing
-// const PRO_PASSES = process.env.PRO_PASS ? process.env.PRO_PASS : 'BITBOX'
+const PRO_PASSES = process.env.PRO_PASSES ? process.env.PRO_PASSES : 'testpassword'
 // Convert the pro-tier password string into an array split by ':'.
-// const PRO_PASS = PRO_PASSES.split(':')
+const PRO_PASS = PRO_PASSES.split(':')
 
 // wlogger.verbose(`PRO_PASS set to: ${PRO_PASS}`)
 
@@ -48,55 +48,57 @@ class AuthMW {
     passport.use(new AnonymousStrategy())
 
     // Initialize passport for 'basic' authentication.
-    //   passport.use(
-    //     new BasicStrategy({ passReqToCallback: true }, function (
-    //       req,
-    //       username,
-    //       password,
-    //       done
-    //     ) {
-    //       // console.log(`req: ${util.inspect(req)}`)
-    //       // console.log(`username: ${username}`)
-    //       // console.log(`password: ${password}`)
-    //
-    //       // Create the req.locals property if it does not yet exist.
-    //       if (!req.locals) {
-    //         req.locals = {
-    //           // default values
-    //           proLimit: false,
-    //           apiLevel: 0
-    //         }
-    //       }
-    //
-    //       // Set pro-tier rate limit to flag to false by default.
-    //       req.locals.proLimit = false
-    //
-    //       // Evaluate the username and password and set the rate limit accordingly.
-    //       // if (username === "BITBOX" && password === PRO_PASS) {
-    //       if (username === 'BITBOX') {
-    //         for (let i = 0; i < PRO_PASS.length; i++) {
-    //           const thisPass = PRO_PASS[i]
-    //
-    //           if (password === thisPass) {
-    //             wlogger.verbose(`${req.url} called by ${password.slice(0, 6)}`)
-    //
-    //             // Success
-    //             req.locals.proLimit = true
-    //             break
-    //           }
-    //         }
-    //       }
-    //
-    //       // console.log(`req.locals: ${util.inspect(req.locals)}`)
-    //
-    //       return done(null, true)
-    //     })
-    //   )
+    passport.use(
+      new BasicStrategy({ passReqToCallback: true }, function (
+        req,
+        username,
+        password,
+        done
+      ) {
+        // console.log(`req: ${util.inspect(req)}`)
+        // console.log(`username: ${username}`)
+        // console.log(`password: ${password}`)
+
+        // Create the req.locals property if it does not yet exist.
+        if (!req.locals) {
+          req.locals = {
+            // default values
+            proLimit: false,
+            apiLevel: 0
+          }
+        }
+
+        // Set pro-tier rate limit to flag to false by default.
+        req.locals.proLimit = false
+
+        // Evaluate the username and password and set the rate limit accordingly.
+        // if (username === "BITBOX" && password === PRO_PASS) {
+        if (username === 'fullstackcash') {
+          for (let i = 0; i < PRO_PASS.length; i++) {
+            const thisPass = PRO_PASS[i]
+
+            if (password === thisPass) {
+              wlogger.verbose(`${req.url} called by ${password.slice(0, 6)}`)
+
+              // Success
+              req.locals.proLimit = true
+              console.log(`User ${req.ip} authenticated using Basic Auth`)
+              break
+            }
+          }
+        }
+
+        // console.log(`req.locals: ${util.inspect(req.locals)}`)
+
+        return done(null, true)
+      })
+    )
   }
 
   // Middleware called by the route.
   mw () {
-    return passport.authenticate(['anonymous'], {
+    console.log('Initializing passport')
+    return passport.authenticate(['basic', 'anonymous'], {
       session: false
     })
   }

src/middleware/route-ratelimit.js

@@ -113,74 +113,80 @@ class RateLimits {
       // Default value is 50 points per request = 20 RPM
       let rateLimit = 50
 
-      // Code here for the rate limiter is adapted from this example:
-      // https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#authorized-and-not-authorized-users
-      try {
-        // The resource being consumed: full node, indexer, SLPDB, etc.
-        const resource = _this.getResource(req.url)
-        wlogger.debug(`resource: ${resource}`)
+      // Only evaluate the JWT token if the user is not using Basic Authentication.
+      if (!req.locals.proLimit) {
+        // Code here for the rate limiter is adapted from this example:
+        // https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#authorized-and-not-authorized-users
+        try {
+          // The resource being consumed: full node, indexer, SLPDB, etc.
+          const resource = _this.getResource(req.url)
+          wlogger.debug(`resource: ${resource}`)
 
-        let key = userId || req.ip
-        res.locals.key = key // Feedback for tests.
+          let key = userId || req.ip
+          res.locals.key = key // Feedback for tests.
 
-        // const pointsToConsume = userId ? 1 : 30
-        decoded.resource = resource
-        let pointsToConsume = _this.calcPoints(decoded)
-        res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-
-        // Retrieve the origin.
-        let origin = req.get('origin')
-
-        // Handle calls coming from the intranet.
-        if (origin === undefined && key.indexOf('10.0.0.5') > -1) {
-          origin = 'slp-api'
-        }
-
-        wlogger.info(`origin: ${origin}`)
-
-        // If the request originates from one of the approved wallet apps, then
-        // apply paid-access rate limits.
-        if (
-          origin &&
-          (origin.toString().indexOf('wallet.fullstack.cash') > -1 ||
-            origin.toString().indexOf('sandbox.fullstack.cash') > -1 ||
-            origin === 'slp-api')
-        ) {
-          pointsToConsume = 10
+          // const pointsToConsume = userId ? 1 : 30
+          decoded.resource = resource
+          let pointsToConsume = _this.calcPoints(decoded)
           res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+
+          // Retrieve the origin.
+          let origin = req.get('origin')
+
+          // Handle calls coming from the intranet.
+          if (origin === undefined && key.indexOf('10.0.0.5') > -1) {
+            origin = 'slp-api'
+          }
+
+          wlogger.info(`origin: ${origin}`)
+
+          // If the request originates from one of the approved wallet apps, then
+          // apply paid-access rate limits.
+          if (
+            origin &&
+            (origin.toString().indexOf('wallet.fullstack.cash') > -1 ||
+              origin.toString().indexOf('sandbox.fullstack.cash') > -1 ||
+              origin === 'slp-api')
+          ) {
+            pointsToConsume = 10
+            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+          }
+
+          // For internal calls, increase rate limits to as fast as possible.
+          if (
+            // Comment out the line below when running bch-js e2e rate limit tests.
+            key.toString().indexOf('::ffff:127.0.0.1') > -1 ||
+
+            // Do not comment out this line.
+            key.toString().indexOf('172.17.') > -1
+          ) {
+            pointsToConsume = 1
+            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+          }
+
+          wlogger.info(
+            `User ${key} consuming ${pointsToConsume} point for resource ${resource}.`
+          )
+
+          rateLimit = Math.floor(1000 / pointsToConsume)
+
+          // Update the key so that rate limits track both the user and the resource.
+          key = `${key}-${resource}`
+
+          await _this.rateLimiter.consume(key, pointsToConsume)
+        } catch (err) {
+          // console.log('err: ', err)
+
+          // Used for returning data for tests.
+          res.locals.rateLimitTriggered = true
+          // console.log('res.locals: ', res.locals)
+
+          // Rate limited was triggered
+          res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+          return res.json({
+            error: `Too many requests. Your limits are currently ${rateLimit} requests per minute. Increase rate limits at https://fullstack.cash`
+          })
         }
-
-        // For internal calls, increase rate limits to as fast as possible.
-        if (
-          key.toString().indexOf('172.17.') > -1 ||
-          key.toString().indexOf('::ffff:127.0.0.1') > -1
-        ) {
-          pointsToConsume = 1
-          res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-        }
-
-        wlogger.info(
-          `User ${key} consuming ${pointsToConsume} point for resource ${resource}.`
-        )
-
-        rateLimit = Math.floor(1000 / pointsToConsume)
-
-        // Update the key so that rate limits track both the user and the resource.
-        key = `${key}-${resource}`
-
-        await _this.rateLimiter.consume(key, pointsToConsume)
-      } catch (err) {
-        // console.log('err: ', err)
-
-        // Used for returning data for tests.
-        res.locals.rateLimitTriggered = true
-        // console.log('res.locals: ', res.locals)
-
-        // Rate limited was triggered
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
-        return res.json({
-          error: `Too many requests. Your limits are currently ${rateLimit} requests per minute. Increase rate limits at https://fullstack.cash`
-        })
       }
     } catch (err) {
       wlogger.error('Error in route-ratelimit.js/newRateLimit(): ', err)

start-dev-example.sh

@@ -26,5 +26,7 @@ export LOCAL_RESTURL=http://127.0.0.1:3000/v3/
 # slp-api alternative SLP validator.
 export SLP_API_URL=http://10.0.0.5:5001/
 
+# Basic Authentication password
+export PRO_PASS=somerandomepassword:someotherrandompassword:aThirdPassword
 
 npm start

test/v3/integration/rate-limits.js

@@ -1,7 +1,6 @@
 /*
-  This integration tests should be run against a live bch-api REST server. It
-  tests to ensure the rate-limits are working as expected. Adjust the values
-  in the tests below to match the rate limit setting in your own installation.
+  These tests have been deprecated. To test bch-api rate limits, run the e2e
+  tests in the bch-js repository.
  */
 
 'use strict'
@@ -17,11 +16,11 @@ util.inspect.defaultOptions = { depth: 1 }
 // const SERVER = `http://192.168.0.36:12400/v3/`
 const SERVER = 'http://localhost:3000/v3/'
 // const SERVER = 'https://api.fullstack.cash/v3/'
+//
+// const TEST_JWT =
+//   'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlODhhY2JmMDIyMWMxMDAxMmFkOTNmZiIsImVtYWlsIjoiY2hyaXMudHJvdXRuZXJAZ21haWwuY29tIiwiYXBpTGV2ZWwiOjQwLCJyYXRlTGltaXQiOjMsImlhdCI6MTYwMDYyODk1MSwiZXhwIjoxNjAzMjIwOTUxfQ.JPXDJQsxJFtCGZjHOd-hRfJuY41Ef_FQ4ET06CtYdNk'
 
-const TEST_JWT =
-  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlODhhY2JmMDIyMWMxMDAxMmFkOTNmZiIsImVtYWlsIjoiY2hyaXMudHJvdXRuZXJAZ21haWwuY29tIiwiYXBpTGV2ZWwiOjQwLCJyYXRlTGltaXQiOjMsImlhdCI6MTYwMDYyODk1MSwiZXhwIjoxNjAzMjIwOTUxfQ.JPXDJQsxJFtCGZjHOd-hRfJuY41Ef_FQ4ET06CtYdNk'
-
-describe('#rate limits', () => {
+describe('#JWT rate limits', () => {
   it('should get control/getNetworkInfo() with no auth', async () => {
     const options = {
       method: 'GET',
@@ -36,25 +35,24 @@ describe('#rate limits', () => {
     assert.hasAnyKeys(result.data, ['version'])
   })
 
-  it('should trigger rate-limit handler if rate limits exceeds 5 request per minute', async () => {
+  it('should trigger rate-limit handler if rate limits exceeds 20 request per minute', async () => {
     try {
-      // Actual rate limit is 60 per minute X 4 nodes = 240 rpm.
       const options = {
         method: 'GET',
         url: `${SERVER}control/getNetworkInfo`
       }
 
       const promises = []
-      for (let i = 0; i < 5; i++) {
+      for (let i = 0; i < 30; i++) {
         const promise = axios(options)
         promises.push(promise)
       }
 
       await Promise.all(promises)
 
-      assert.equal(true, false, 'Unexpected result!')
+      assert.fail('Unexpected result!')
     } catch (err) {
-      // console.log(`err.response: ${util.inspect(err.response)}`)
+      console.log('err: ', err)
 
       assert.equal(err.response.status, 429)
       assert.include(err.response.data.error, 'Too many requests')
@@ -135,32 +133,32 @@ describe('#rate limits', () => {
   //   }
   // })
 
-  it('should unlock pro-tier for a valid JWT token', async () => {
-    try {
-      // Actual rate limit is 60 per minute X 4 nodes = 240 rpm.
-      const options = {
-        method: 'GET',
-        url: `${SERVER}control/`,
-        headers: {
-          Authorization: `Token ${TEST_JWT}`
-        }
-      }
-
-      const promises = []
-      for (let i = 0; i < 60; i++) {
-        const promise = axios(options)
-        promises.push(promise)
-      }
-
-      await Promise.all(promises)
-
-      // assert.equal(true, false, "Unexpected result!")
-      assert.equal(true, true, 'Not throwing an error is a pass!')
-    } catch (err) {
-      console.log(`err.response: ${util.inspect(err.response)}`)
-
-      assert.equal(true, false, 'Unexpected result!')
-    }
-    // Override default timeout for this test.
-  }).timeout(20000)
+  // it('should unlock pro-tier for a valid JWT token', async () => {
+  //   try {
+  //     // Actual rate limit is 60 per minute X 4 nodes = 240 rpm.
+  //     const options = {
+  //       method: 'GET',
+  //       url: `${SERVER}control/`,
+  //       headers: {
+  //         Authorization: `Token ${TEST_JWT}`
+  //       }
+  //     }
+  //
+  //     const promises = []
+  //     for (let i = 0; i < 60; i++) {
+  //       const promise = axios(options)
+  //       promises.push(promise)
+  //     }
+  //
+  //     await Promise.all(promises)
+  //
+  //     // assert.equal(true, false, "Unexpected result!")
+  //     assert.equal(true, true, 'Not throwing an error is a pass!')
+  //   } catch (err) {
+  //     console.log(`err.response: ${util.inspect(err.response)}`)
+  //
+  //     assert.equal(true, false, 'Unexpected result!')
+  //   }
+  //   // Override default timeout for this test.
+  // }).timeout(20000)
 })