shaw
fead4c7ec3
用户可高频刷面板接口（usage/dashboard 等重聚合查询）直接打爆数据库：
现有限流器只覆盖登录/注册等公开认证入口，登录后的全部面板端点无任何限流。
三层防护（阈值均可在后台可视化配置，panel_rate_limit_settings）：
1. 认证面板接口按「用户 ID」限流，与来源 IP 无关——反向代理/NAT 共享出口
（所有请求源地址坍缩为 127.0.0.1 等）不会互相误伤：
- Global 档（默认 240 rpm/账号）：user/auth/payment/admin 全部登录后路由
- Heavy 档（默认 60 rpm/账号）：/usage、/usage/dashboard/*、
/user/api-keys/:id/usage/daily 等重 SQL 聚合端点叠加计数
- 管理员默认豁免（可关闭）
2. 无认证公开接口（/api/v1/settings/*，每次请求都查 DB）按安全客户端 IP
限流（默认 300 rpm/IP）；回环/私网/链路本地地址（反代内部转发地址）
一律跳过计数，杜绝把整条反代链路合并进同一个桶造成大面积误拦截。
3. 修复既有隐患：auth 入口限流的 IP 取值从 c.ClientIP() 切换到与审计日志/
会话绑定/API Key ACL 同源的安全客户端 IP 解析（尊重后台「信任反代转发
IP」开关快照）。原实现下默认反代部署（未配置 server.trusted_proxies）
所有用户共享同一个登录限流桶，既会全员误拦也可被单人恶意占满形成登录
DoS；开关关闭时行为与原来完全一致。
工程约束：
- 配置热路径走进程内缓存（atomic.Value + singleflight，60s TTL），
限流中间件零 DB 访问；保存后当前节点立即生效
- 面板限流 Redis 故障 fail-open（auth 入口保持原有 fail-close）
- 429 响应携带 Retry-After；错误码 RATE_LIMITED
- 支付 webhook / 公开支付回调有意不挂限流
- 新增 GET/PUT /api/v1/admin/settings/panel-rate-limit；设置页安全 tab
新增「面板接口限流」卡片（zh/en i18n 全量）
测试：rate_limiter/panel_rate_limit/setting_panel_rate_limit 单测全绿；
routes、handler/admin、-tags unit 契约测试通过；前端 vue-tsc/ESLint/
SettingsView spec（26/26，含新增交互用例）/i18n 守卫全部通过。
316 lines
11 KiB
Go
316 lines
11 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/Wei-Shaw/sub2api/internal/middleware"
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// panelRateLimitStubRepo 内存版 SettingRepository，仅覆盖本测试用到的方法。
|
|
type panelRateLimitStubRepo struct {
|
|
mu sync.Mutex
|
|
values map[string]string
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) Get(_ context.Context, key string) (*service.Setting, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
value, ok := r.values[key]
|
|
if !ok {
|
|
return nil, service.ErrSettingNotFound
|
|
}
|
|
return &service.Setting{Key: key, Value: value}, nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) GetValue(_ context.Context, key string) (string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
value, ok := r.values[key]
|
|
if !ok {
|
|
return "", service.ErrSettingNotFound
|
|
}
|
|
return value, nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) Set(_ context.Context, key, value string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
if r.values == nil {
|
|
r.values = make(map[string]string)
|
|
}
|
|
r.values[key] = value
|
|
return nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) GetMultiple(_ context.Context, keys []string) (map[string]string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
out := make(map[string]string, len(keys))
|
|
for _, key := range keys {
|
|
if value, ok := r.values[key]; ok {
|
|
out[key] = value
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) SetMultiple(_ context.Context, settings map[string]string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
if r.values == nil {
|
|
r.values = make(map[string]string)
|
|
}
|
|
for key, value := range settings {
|
|
r.values[key] = value
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) GetAll(_ context.Context) (map[string]string, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
out := make(map[string]string, len(r.values))
|
|
for key, value := range r.values {
|
|
out[key] = value
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func (r *panelRateLimitStubRepo) Delete(_ context.Context, key string) error {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
delete(r.values, key)
|
|
return nil
|
|
}
|
|
|
|
// fakePanelAllower 内存计数版限流原语。
|
|
type fakePanelAllower struct {
|
|
mu sync.Mutex
|
|
counts map[string]int64
|
|
err error
|
|
}
|
|
|
|
func (f *fakePanelAllower) Allow(_ context.Context, key string, limit int, window time.Duration) (middleware.AllowResult, error) {
|
|
f.mu.Lock()
|
|
defer f.mu.Unlock()
|
|
if f.err != nil {
|
|
return middleware.AllowResult{}, f.err
|
|
}
|
|
if f.counts == nil {
|
|
f.counts = make(map[string]int64)
|
|
}
|
|
f.counts[key]++
|
|
count := f.counts[key]
|
|
result := middleware.AllowResult{Allowed: count <= int64(limit), Count: count}
|
|
if !result.Allowed {
|
|
result.RetryAfter = window
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func newPanelRateLimitTestService(t *testing.T, settingsJSON string) *service.SettingService {
|
|
t.Helper()
|
|
repo := &panelRateLimitStubRepo{}
|
|
if settingsJSON != "" {
|
|
repo.values = map[string]string{"panel_rate_limit_settings": settingsJSON}
|
|
}
|
|
return service.NewSettingService(repo, &config.Config{})
|
|
}
|
|
|
|
type panelTestIdentity struct {
|
|
userID int64
|
|
role string
|
|
}
|
|
|
|
func newPanelTestRouter(limiter gin.HandlerFunc, identity *panelTestIdentity) *gin.Engine {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
if identity != nil {
|
|
router.Use(func(c *gin.Context) {
|
|
c.Set(string(ContextKeyUser), AuthSubject{UserID: identity.userID})
|
|
c.Set(string(ContextKeyUserRole), identity.role)
|
|
c.Next()
|
|
})
|
|
}
|
|
router.Use(limiter)
|
|
router.GET("/test", func(c *gin.Context) {
|
|
c.JSON(http.StatusOK, gin.H{"ok": true})
|
|
})
|
|
return router
|
|
}
|
|
|
|
func performPanelRequest(router *gin.Engine, remoteAddr string) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
|
req.RemoteAddr = remoteAddr
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestPanelRateLimiterGlobalPerUser(t *testing.T) {
|
|
allower := &fakePanelAllower{}
|
|
p := &PanelRateLimiter{
|
|
limiter: allower,
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":2,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":0}`),
|
|
}
|
|
|
|
userA := newPanelTestRouter(p.Global(), &panelTestIdentity{userID: 1, role: service.RoleUser})
|
|
userB := newPanelTestRouter(p.Global(), &panelTestIdentity{userID: 2, role: service.RoleUser})
|
|
|
|
require.Equal(t, http.StatusOK, performPanelRequest(userA, "127.0.0.1:1000").Code)
|
|
require.Equal(t, http.StatusOK, performPanelRequest(userA, "127.0.0.1:1000").Code)
|
|
// 用户 A 超限
|
|
third := performPanelRequest(userA, "127.0.0.1:1000")
|
|
require.Equal(t, http.StatusTooManyRequests, third.Code)
|
|
require.NotEmpty(t, third.Header().Get("Retry-After"))
|
|
require.Contains(t, third.Body.String(), "RATE_LIMITED")
|
|
// 用户 B 不受影响（同一来源 IP 也互不干扰）
|
|
require.Equal(t, http.StatusOK, performPanelRequest(userB, "127.0.0.1:1000").Code)
|
|
|
|
allower.mu.Lock()
|
|
defer allower.mu.Unlock()
|
|
require.Contains(t, allower.counts, "panel:global:user:1")
|
|
require.Contains(t, allower.counts, "panel:global:user:2")
|
|
}
|
|
|
|
func TestPanelRateLimiterHeavyUsesHeavyRPM(t *testing.T) {
|
|
allower := &fakePanelAllower{}
|
|
p := &PanelRateLimiter{
|
|
limiter: allower,
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":100,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":0}`),
|
|
}
|
|
|
|
router := newPanelTestRouter(p.Heavy(), &panelTestIdentity{userID: 7, role: service.RoleUser})
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "127.0.0.1:1000").Code)
|
|
require.Equal(t, http.StatusTooManyRequests, performPanelRequest(router, "127.0.0.1:1000").Code)
|
|
|
|
allower.mu.Lock()
|
|
defer allower.mu.Unlock()
|
|
require.Contains(t, allower.counts, "panel:heavy:user:7")
|
|
}
|
|
|
|
func TestPanelRateLimiterAdminExemption(t *testing.T) {
|
|
// 豁免开启：管理员不计数
|
|
p := &PanelRateLimiter{
|
|
limiter: &fakePanelAllower{},
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":1,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":0}`),
|
|
}
|
|
admin := newPanelTestRouter(p.Global(), &panelTestIdentity{userID: 9, role: service.RoleAdmin})
|
|
for i := 0; i < 5; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(admin, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
// 豁免关闭：管理员一样受限
|
|
p2 := &PanelRateLimiter{
|
|
limiter: &fakePanelAllower{},
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":1,"heavy_rpm":1,"exempt_admin":false,"public_ip_rpm":0}`),
|
|
}
|
|
admin2 := newPanelTestRouter(p2.Global(), &panelTestIdentity{userID: 9, role: service.RoleAdmin})
|
|
require.Equal(t, http.StatusOK, performPanelRequest(admin2, "127.0.0.1:1000").Code)
|
|
require.Equal(t, http.StatusTooManyRequests, performPanelRequest(admin2, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
func TestPanelRateLimiterDisabledOrMissingSubject(t *testing.T) {
|
|
// 总开关关闭
|
|
p := &PanelRateLimiter{
|
|
limiter: &fakePanelAllower{},
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":false,"user_rpm":1,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":1}`),
|
|
}
|
|
router := newPanelTestRouter(p.Global(), &panelTestIdentity{userID: 3, role: service.RoleUser})
|
|
for i := 0; i < 3; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
// 无认证主体：放行（防御分支）
|
|
p2 := &PanelRateLimiter{
|
|
limiter: &fakePanelAllower{},
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":1,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":0}`),
|
|
}
|
|
anonymous := newPanelTestRouter(p2.Global(), nil)
|
|
for i := 0; i < 3; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(anonymous, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
// nil 限流器（测试环境注入 nil）：直接放行
|
|
var nilLimiter *PanelRateLimiter
|
|
nilRouter := newPanelTestRouter(nilLimiter.Global(), &panelTestIdentity{userID: 3, role: service.RoleUser})
|
|
require.Equal(t, http.StatusOK, performPanelRequest(nilRouter, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
func TestPanelRateLimiterFailOpenOnRedisError(t *testing.T) {
|
|
p := &PanelRateLimiter{
|
|
limiter: &fakePanelAllower{err: errors.New("redis down")},
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":1,"heavy_rpm":1,"exempt_admin":true,"public_ip_rpm":1}`),
|
|
}
|
|
router := newPanelTestRouter(p.Global(), &panelTestIdentity{userID: 5, role: service.RoleUser})
|
|
for i := 0; i < 3; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "127.0.0.1:1000").Code)
|
|
}
|
|
|
|
publicRouter := newPanelTestRouter(p.PublicIP(), nil)
|
|
for i := 0; i < 3; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(publicRouter, "203.0.113.9:1000").Code)
|
|
}
|
|
}
|
|
|
|
func TestPanelRateLimiterPublicIP(t *testing.T) {
|
|
allower := &fakePanelAllower{}
|
|
p := &PanelRateLimiter{
|
|
limiter: allower,
|
|
settingService: newPanelRateLimitTestService(t, `{"enabled":true,"user_rpm":0,"heavy_rpm":0,"exempt_admin":true,"public_ip_rpm":1}`),
|
|
}
|
|
router := newPanelTestRouter(p.PublicIP(), nil)
|
|
|
|
// 公网 IP：第二次被限
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "203.0.113.9:1000").Code)
|
|
require.Equal(t, http.StatusTooManyRequests, performPanelRequest(router, "203.0.113.9:1000").Code)
|
|
// 其他公网 IP 独立计数
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "198.51.100.7:1000").Code)
|
|
|
|
// 回环/内网地址（反代内部转发地址）：跳过计数，绝不误拦
|
|
for i := 0; i < 5; i++ {
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "127.0.0.1:1000").Code)
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "10.0.0.8:1000").Code)
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "172.17.0.1:1000").Code)
|
|
require.Equal(t, http.StatusOK, performPanelRequest(router, "192.168.1.30:1000").Code)
|
|
}
|
|
|
|
allower.mu.Lock()
|
|
defer allower.mu.Unlock()
|
|
require.Contains(t, allower.counts, "panel:public:ip:203.0.113.9")
|
|
require.Contains(t, allower.counts, "panel:public:ip:198.51.100.7")
|
|
for key := range allower.counts {
|
|
require.NotContains(t, key, "127.0.0.1")
|
|
require.NotContains(t, key, "10.0.0.8")
|
|
require.NotContains(t, key, "172.17.0.1")
|
|
require.NotContains(t, key, "192.168.1.30")
|
|
}
|
|
}
|
|
|
|
func TestIsPubliclyRoutableClientIP(t *testing.T) {
|
|
require.True(t, isPubliclyRoutableClientIP("203.0.113.9"))
|
|
require.True(t, isPubliclyRoutableClientIP("2001:db8::1"))
|
|
require.False(t, isPubliclyRoutableClientIP("127.0.0.1"))
|
|
require.False(t, isPubliclyRoutableClientIP("::1"))
|
|
require.False(t, isPubliclyRoutableClientIP("10.1.2.3"))
|
|
require.False(t, isPubliclyRoutableClientIP("172.16.0.1"))
|
|
require.False(t, isPubliclyRoutableClientIP("192.168.0.1"))
|
|
require.False(t, isPubliclyRoutableClientIP("169.254.1.1"))
|
|
require.False(t, isPubliclyRoutableClientIP("fe80::1"))
|
|
require.False(t, isPubliclyRoutableClientIP("fc00::1"))
|
|
require.False(t, isPubliclyRoutableClientIP("0.0.0.0"))
|
|
require.False(t, isPubliclyRoutableClientIP(""))
|
|
require.False(t, isPubliclyRoutableClientIP("not-an-ip"))
|
|
}
|