webapp 2.0.0

A web application completely written in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

use axum::{
    body::Body,
    http::{Method, Request, StatusCode},
    middleware::Next,
    response::Response,
};
use std::{
    collections::HashMap,
    net::IpAddr,
    sync::Mutex,
    time::{Duration, Instant},
};

const MAX_REQUESTS: usize = 20;
const WINDOW: Duration = Duration::from_secs(60);

static CLIENTS: Mutex<Option<HashMap<IpAddr, Vec<Instant>>>> = Mutex::new(None);

fn is_allowed(ip: IpAddr) -> bool {
    let mut guard = CLIENTS.lock().unwrap_or_else(|e| e.into_inner());
    let map = guard.get_or_insert_with(HashMap::new);
    let now = Instant::now();
    // Evict IPs with no recent requests to prevent unbounded growth
    map.retain(|_, v| {
        v.retain(|t| now.duration_since(*t) < WINDOW);
        !v.is_empty()
    });
    let timestamps = map.entry(ip).or_default();
    if timestamps.len() >= MAX_REQUESTS {
        false
    } else {
        timestamps.push(now);
        true
    }
}

fn extract_ip(req: &Request<Body>) -> IpAddr {
    req.headers()
        .get("x-forwarded-for")
        .and_then(|v| v.to_str().ok())
        .and_then(|s| s.split(',').next())
        .and_then(|s| s.trim().parse::<IpAddr>().ok())
        .unwrap_or(IpAddr::from([127, 0, 0, 1]))
}

pub async fn check(req: Request<Body>, next: Next) -> Result<Response, StatusCode> {
    if req.method() != Method::POST {
        return Ok(next.run(req).await);
    }

    if is_allowed(extract_ip(&req)) {
        Ok(next.run(req).await)
    } else {
        Err(StatusCode::TOO_MANY_REQUESTS)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use axum::{Router, middleware, routing::get, routing::post};
    use tower::ServiceExt;

    fn app() -> Router {
        Router::new()
            .route("/test", post(|| async { "ok" }))
            .route("/get", get(|| async { "ok" }))
            .layer(middleware::from_fn(check))
    }

    #[tokio::test]
    async fn get_requests_bypass_rate_limit() {
        let resp = app()
            .oneshot(Request::get("/get").body(Body::empty()).unwrap())
            .await
            .unwrap();
        assert_eq!(resp.status(), StatusCode::OK);
    }

    #[tokio::test]
    async fn post_requests_are_rate_limited() {
        // Use a unique IP to avoid interference from other tests
        let ip = "10.99.99.99";
        for i in 0..MAX_REQUESTS {
            let resp = app()
                .oneshot(
                    Request::post("/test")
                        .header("x-forwarded-for", ip)
                        .body(Body::empty())
                        .unwrap(),
                )
                .await
                .unwrap();
            assert_eq!(resp.status(), StatusCode::OK, "request {i} should succeed");
        }

        // Next request should be rate limited
        let resp = app()
            .oneshot(
                Request::post("/test")
                    .header("x-forwarded-for", ip)
                    .body(Body::empty())
                    .unwrap(),
            )
            .await
            .unwrap();
        assert_eq!(resp.status(), StatusCode::TOO_MANY_REQUESTS);
    }

    #[test]
    fn extract_ip_from_forwarded_header() {
        let req = Request::post("/test")
            .header("x-forwarded-for", "192.168.1.1, 10.0.0.1")
            .body(Body::empty())
            .unwrap();
        assert_eq!(extract_ip(&req), IpAddr::from([192, 168, 1, 1]));
    }

    #[test]
    fn extract_ip_default_without_header() {
        let req = Request::post("/test").body(Body::empty()).unwrap();
        assert_eq!(extract_ip(&req), IpAddr::from([127, 0, 0, 1]));
    }

    #[test]
    fn is_allowed_enforces_limit() {
        let ip = IpAddr::from([10, 88, 88, 88]);
        for _ in 0..MAX_REQUESTS {
            assert!(is_allowed(ip));
        }
        assert!(!is_allowed(ip));
    }
}