rate-limit.ts · Source

rate-limit.tsapps/api/src/modules/forms/rate-limit.tsraw ← forms2,651 B← Back to the app
1/**
2 * TASK-0107 §6 — the public-form submit rate limit (5/min per IP per form).
3 *
4 * A REDIS SLIDING-WINDOW counter (`form:rl:{slug}:{ip}`, 60 s) — the same
5 * pattern as the global `RateLimitGuard` (shared `RedisService`), but
6 * per-form: one abusive form cannot starve another (spec §Security). The
7 * IP comes from `req.ip` (Express trusts the proxy chain per
8 * `app.set("trust proxy")` — the same source the global limiter uses).
9 *
10 * Redis down → degrade OPEN (availability over strictness), matching the
11 * global limiter's documented behavior; the honeypot + server validation
12 * still hold.
13 */
14import { Inject, Injectable } from "@nestjs/common";
15import { RedisService } from "../../common/redis.service.js";
16import { logger } from "../../common/logger.js";
17 
18export const FORM_SUBMIT_LIMIT = 5;
19export const FORM_RL_WINDOW_MS = 60_000;
20 
21export interface RateCheck {
22  allowed: boolean;
23  remaining: number;
24  /** Seconds until the window frees a slot (present when `allowed` is false). */
25  retryAfterSeconds: number;
26}
27 
28@Injectable()
29export class FormRateLimiter {
30  constructor(@Inject(RedisService) private readonly redis: RedisService) {}
31 
32  private lastRedisWarn = 0;
33 
34  /**
35   * Charge one submission against `form:rl:{slug}:{ip}`. Call AFTER the
36   * request is known to be a real (non-honeypot) attempt — spec: the
37   * limiter gates the expensive submit path, and a bot tripping the
38   * honeypot is silently dropped WITHOUT consuming a legitimate slot.
39   */
40  async check(slug: string, ip: string): Promise<RateCheck> {
41    const key = `form:rl:${slug}:${ip}`;
42    let count: number;
43    try {
44      const now = Date.now();
45      const pipe = this.redis.getRedis().pipeline();
46      pipe.zremrangebyscore(key, 0, now - FORM_RL_WINDOW_MS);
47      pipe.zadd(key, now, `${now}:${Math.random().toString(36).slice(2)}`);
48      pipe.zcard(key);
49      pipe.pexpire(key, FORM_RL_WINDOW_MS);
50      const results = await pipe.exec();
51      const card = results?.[2]?.[1];
52      count = typeof card === "number" ? card : 1;
53    } catch (err) {
54      if (Date.now() - this.lastRedisWarn > 60_000) {
55        this.lastRedisWarn = Date.now();
56        logger.warn(`form rate limiter degraded (redis unavailable): ${(err as Error).message}`);
57      }
58      return { allowed: true, remaining: FORM_SUBMIT_LIMIT, retryAfterSeconds: 0 };
59    }
60    const remaining = Math.max(0, FORM_SUBMIT_LIMIT - count);
61    const retryAfterSeconds = Math.ceil(FORM_RL_WINDOW_MS / 1000);
62    return {
63      allowed: count <= FORM_SUBMIT_LIMIT,
64      remaining,
65      retryAfterSeconds: count <= FORM_SUBMIT_LIMIT ? 0 : retryAfterSeconds
66    };
67  }
68}
69