mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-16 07:33:06 +08:00
用户可高频刷面板接口(usage/dashboard 等重聚合查询)直接打爆数据库:
现有限流器只覆盖登录/注册等公开认证入口,登录后的全部面板端点无任何限流。
三层防护(阈值均可在后台可视化配置,panel_rate_limit_settings):
1. 认证面板接口按「用户 ID」限流,与来源 IP 无关——反向代理/NAT 共享出口
(所有请求源地址坍缩为 127.0.0.1 等)不会互相误伤:
- Global 档(默认 240 rpm/账号):user/auth/payment/admin 全部登录后路由
- Heavy 档(默认 60 rpm/账号):/usage、/usage/dashboard/*、
/user/api-keys/:id/usage/daily 等重 SQL 聚合端点叠加计数
- 管理员默认豁免(可关闭)
2. 无认证公开接口(/api/v1/settings/*,每次请求都查 DB)按安全客户端 IP
限流(默认 300 rpm/IP);回环/私网/链路本地地址(反代内部转发地址)
一律跳过计数,杜绝把整条反代链路合并进同一个桶造成大面积误拦截。
3. 修复既有隐患:auth 入口限流的 IP 取值从 c.ClientIP() 切换到与审计日志/
会话绑定/API Key ACL 同源的安全客户端 IP 解析(尊重后台「信任反代转发
IP」开关快照)。原实现下默认反代部署(未配置 server.trusted_proxies)
所有用户共享同一个登录限流桶,既会全员误拦也可被单人恶意占满形成登录
DoS;开关关闭时行为与原来完全一致。
工程约束:
- 配置热路径走进程内缓存(atomic.Value + singleflight,60s TTL),
限流中间件零 DB 访问;保存后当前节点立即生效
- 面板限流 Redis 故障 fail-open(auth 入口保持原有 fail-close)
- 429 响应携带 Retry-After;错误码 RATE_LIMITED
- 支付 webhook / 公开支付回调有意不挂限流
- 新增 GET/PUT /api/v1/admin/settings/panel-rate-limit;设置页安全 tab
新增「面板接口限流」卡片(zh/en i18n 全量)
测试:rate_limiter/panel_rate_limit/setting_panel_rate_limit 单测全绿;
routes、handler/admin、-tags unit 契约测试通过;前端 vue-tsc/ESLint/
SettingsView spec(26/26,含新增交互用例)/i18n 守卫全部通过。
183 lines
5.2 KiB
Go
183 lines
5.2 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"sync"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type panelRateLimitSettingRepo struct {
|
|
mu sync.Mutex
|
|
values map[string]string
|
|
getValueErr error
|
|
getValueCalls int
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) Get(_ context.Context, key string) (*Setting, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
value, ok := r.values[key]
|
|
if !ok {
|
|
return nil, ErrSettingNotFound
|
|
}
|
|
return &Setting{Key: key, Value: value}, nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) GetValue(_ context.Context, key string) (string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
r.getValueCalls++
|
|
if r.getValueErr != nil {
|
|
return "", r.getValueErr
|
|
}
|
|
value, ok := r.values[key]
|
|
if !ok {
|
|
return "", ErrSettingNotFound
|
|
}
|
|
return value, nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) Set(_ context.Context, key, value string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
if r.values == nil {
|
|
r.values = make(map[string]string)
|
|
}
|
|
r.values[key] = value
|
|
return nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) GetMultiple(_ context.Context, keys []string) (map[string]string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
out := make(map[string]string, len(keys))
|
|
for _, key := range keys {
|
|
if value, ok := r.values[key]; ok {
|
|
out[key] = value
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) SetMultiple(_ context.Context, settings map[string]string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
if r.values == nil {
|
|
r.values = make(map[string]string)
|
|
}
|
|
for key, value := range settings {
|
|
r.values[key] = value
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) GetAll(_ context.Context) (map[string]string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
out := make(map[string]string, len(r.values))
|
|
for key, value := range r.values {
|
|
out[key] = value
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (r *panelRateLimitSettingRepo) Delete(_ context.Context, key string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
delete(r.values, key)
|
|
return nil
|
|
}
|
|
|
|
func newPanelRateLimitTestService(repo SettingRepository) *SettingService {
|
|
return NewSettingService(repo, &config.Config{})
|
|
}
|
|
|
|
func TestGetPanelRateLimitSettingsDefaults(t *testing.T) {
|
|
svc := newPanelRateLimitTestService(&panelRateLimitSettingRepo{})
|
|
|
|
settings, err := svc.GetPanelRateLimitSettings(context.Background())
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultPanelRateLimitSettings(), settings)
|
|
}
|
|
|
|
func TestGetPanelRateLimitSettingsInvalidJSONFallsBack(t *testing.T) {
|
|
repo := &panelRateLimitSettingRepo{values: map[string]string{
|
|
SettingKeyPanelRateLimitSettings: "{not-json",
|
|
}}
|
|
svc := newPanelRateLimitTestService(repo)
|
|
|
|
settings, err := svc.GetPanelRateLimitSettings(context.Background())
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultPanelRateLimitSettings(), settings)
|
|
}
|
|
|
|
func TestGetPanelRateLimitSettingsNormalizesValues(t *testing.T) {
|
|
repo := &panelRateLimitSettingRepo{values: map[string]string{
|
|
SettingKeyPanelRateLimitSettings: `{"enabled":true,"user_rpm":-5,"heavy_rpm":999999999,"exempt_admin":false,"public_ip_rpm":10}`,
|
|
}}
|
|
svc := newPanelRateLimitTestService(repo)
|
|
|
|
settings, err := svc.GetPanelRateLimitSettings(context.Background())
|
|
require.NoError(t, err)
|
|
require.True(t, settings.Enabled)
|
|
require.Equal(t, 0, settings.UserRPM)
|
|
require.Equal(t, panelRateLimitRPMMax, settings.HeavyRPM)
|
|
require.Equal(t, 10, settings.PublicIPRPM)
|
|
require.False(t, settings.ExemptAdmin)
|
|
}
|
|
|
|
func TestSetPanelRateLimitSettingsValidation(t *testing.T) {
|
|
svc := newPanelRateLimitTestService(&panelRateLimitSettingRepo{})
|
|
|
|
require.Error(t, svc.SetPanelRateLimitSettings(context.Background(), nil))
|
|
require.Error(t, svc.SetPanelRateLimitSettings(context.Background(), &PanelRateLimitSettings{UserRPM: -1}))
|
|
require.Error(t, svc.SetPanelRateLimitSettings(context.Background(), &PanelRateLimitSettings{HeavyRPM: panelRateLimitRPMMax + 1}))
|
|
}
|
|
|
|
func TestSetPanelRateLimitSettingsRoundTripAndCacheRefresh(t *testing.T) {
|
|
repo := &panelRateLimitSettingRepo{}
|
|
svc := newPanelRateLimitTestService(repo)
|
|
|
|
// 先填充缓存(默认值)
|
|
cached := svc.GetPanelRateLimitSettingsCached(context.Background())
|
|
require.Equal(t, *DefaultPanelRateLimitSettings(), cached)
|
|
|
|
want := &PanelRateLimitSettings{
|
|
Enabled: true,
|
|
UserRPM: 120,
|
|
HeavyRPM: 30,
|
|
ExemptAdmin: false,
|
|
PublicIPRPM: 60,
|
|
}
|
|
require.NoError(t, svc.SetPanelRateLimitSettings(context.Background(), want))
|
|
|
|
// 写入后无需等待 TTL,缓存立即反映新值
|
|
cached = svc.GetPanelRateLimitSettingsCached(context.Background())
|
|
require.Equal(t, *want, cached)
|
|
|
|
// DB 中持久化的值可直读
|
|
stored, err := svc.GetPanelRateLimitSettings(context.Background())
|
|
require.NoError(t, err)
|
|
require.Equal(t, want, stored)
|
|
}
|
|
|
|
func TestGetPanelRateLimitSettingsCachedAvoidsRepeatedDBReads(t *testing.T) {
|
|
repo := &panelRateLimitSettingRepo{values: map[string]string{
|
|
SettingKeyPanelRateLimitSettings: `{"enabled":true,"user_rpm":100,"heavy_rpm":20,"exempt_admin":true,"public_ip_rpm":50}`,
|
|
}}
|
|
svc := newPanelRateLimitTestService(repo)
|
|
|
|
for i := 0; i < 5; i++ {
|
|
settings := svc.GetPanelRateLimitSettingsCached(context.Background())
|
|
require.Equal(t, 100, settings.UserRPM)
|
|
}
|
|
|
|
repo.mu.Lock()
|
|
calls := repo.getValueCalls
|
|
repo.mu.Unlock()
|
|
require.Equal(t, 1, calls, "TTL 内应只读一次 DB")
|
|
}
|