Merge pull request #100 from Permissionless-Software-Foundation/ct-unstable

fix(rate limit): Fine tuning rate limits for internal calls

package-lock.json

@@ -8,7 +8,7 @@
       "version": "1.16.0",
       "license": "MIT",
       "dependencies": {
-        "@psf/bch-js": "^4.15.2",
+        "@psf/bch-js": "^4.15.3",
         "apidoc": "^0.26.0",
         "axios": "^0.21.1",
         "bitcore-lib-cash": "^8.23.1",
@@ -458,9 +458,9 @@
       }
     },
     "node_modules/@psf/bch-js": {
-      "version": "4.15.2",
+      "version": "4.15.3",
-      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.15.2.tgz",
+      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.15.3.tgz",
-      "integrity": "sha512-ZJi6JdF2z/WJ02+G3Xs0V8GZUEe8HJuZqH5VEa7aq1dwZpWithq5rirZHNhWj5IfUwv3VQH6nYFObPo6Op6orA==",
+      "integrity": "sha512-J5Jk1Y7oTmTs6kCX83hxY10kp5FZd0KI4bFGiZ8qJX+V1hqFsS57+Byd4qIa/+cK+PEyTifCMnCkfKVXLS8tHw==",
       "dependencies": {
         "@psf/bip21": "^2.0.1",
         "@psf/bip32-utils": "^0.13.1",
@@ -18627,9 +18627,9 @@
       }
     },
     "@psf/bch-js": {
-      "version": "4.15.2",
+      "version": "4.15.3",
-      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.15.2.tgz",
+      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.15.3.tgz",
-      "integrity": "sha512-ZJi6JdF2z/WJ02+G3Xs0V8GZUEe8HJuZqH5VEa7aq1dwZpWithq5rirZHNhWj5IfUwv3VQH6nYFObPo6Op6orA==",
+      "integrity": "sha512-J5Jk1Y7oTmTs6kCX83hxY10kp5FZd0KI4bFGiZ8qJX+V1hqFsS57+Byd4qIa/+cK+PEyTifCMnCkfKVXLS8tHw==",
       "requires": {
         "@psf/bip21": "^2.0.1",
         "@psf/bip32-utils": "^0.13.1",

package.json

@@ -29,7 +29,7 @@
     "node": ">=10.15.1"
   },
   "dependencies": {
-    "@psf/bch-js": "^4.15.2",
+    "@psf/bch-js": "^4.15.3",
     "apidoc": "^0.26.0",
     "axios": "^0.21.1",
     "bitcore-lib-cash": "^8.23.1",

src/middleware/route-ratelimit.js

@@ -129,9 +129,19 @@ class RateLimits {
           const resource = _this.getResource(req.url)
           wlogger.debug(`resource: ${resource}`)
 
+          // Key will be the JWT ID if it exists, otherwise the IP address of the caller.
           let key = userId || req.ip
           res.locals.key = key // Feedback for tests.
 
+          // For internal calls that make a lot of internal calls, like
+          // hydrateUtxoDetails(), the origin of the caller will be passed in
+          // via the POST body.
+          const keyIsLocal = key.includes('172.17.0.1') || key.includes('127.0.0.1')
+          if (req.body && req.body.ip && keyIsLocal) {
+            key = req.body.ip
+          }
+          console.log(`key: ${key}`)
+
           // const pointsToConsume = userId ? 1 : 30
           decoded.resource = resource
           let pointsToConsume = _this.calcPoints(decoded)