94 lines
2.3 KiB
Go
94 lines
2.3 KiB
Go
|
package middleware
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
"sync"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"cardverse/internal/pkg/response"
|
||
|
|
|
||
|
|
"github.com/gin-gonic/gin"
|
||
|
|
"golang.org/x/time/rate"
|
||
|
|
)
|
||
|
|
|
||
|
|
// visitor menyimpan limiter token bucket milik satu IP + waktu terakhir dia request
|
||
|
|
type visitor struct {
|
||
|
|
limiter *rate.Limiter
|
||
|
|
lastSeen time.Time
|
||
|
|
}
|
||
|
|
|
||
|
|
// visitorStore menyimpan limiter per-IP secara thread-safe.
|
||
|
|
// Setiap IP punya "kantong token" sendiri, jadi satu IP yang spam tidak
|
||
|
|
// mempengaruhi jatah IP lain.
|
||
|
|
type visitorStore struct {
|
||
|
|
mu sync.Mutex
|
||
|
|
visitors map[string]*visitor
|
||
|
|
rps rate.Limit
|
||
|
|
burst int
|
||
|
|
}
|
||
|
|
|
||
|
|
func newVisitorStore(requestsPerSecond float64, burst int) *visitorStore {
|
||
|
|
vs := &visitorStore{
|
||
|
|
visitors: make(map[string]*visitor),
|
||
|
|
rps: rate.Limit(requestsPerSecond),
|
||
|
|
burst: burst,
|
||
|
|
}
|
||
|
|
go vs.cleanupLoop()
|
||
|
|
return vs
|
||
|
|
}
|
||
|
|
|
||
|
|
func (vs *visitorStore) getLimiter(ip string) *rate.Limiter {
|
||
|
|
vs.mu.Lock()
|
||
|
|
defer vs.mu.Unlock()
|
||
|
|
|
||
|
|
v, exists := vs.visitors[ip]
|
||
|
|
if !exists {
|
||
|
|
limiter := rate.NewLimiter(vs.rps, vs.burst)
|
||
|
|
vs.visitors[ip] = &visitor{limiter: limiter, lastSeen: time.Now()}
|
||
|
|
return limiter
|
||
|
|
}
|
||
|
|
|
||
|
|
v.lastSeen = time.Now()
|
||
|
|
return v.limiter
|
||
|
|
}
|
||
|
|
|
||
|
|
// cleanupLoop membuang data IP yang sudah tidak aktif > 3 menit supaya memori tidak terus membengkak
|
||
|
|
func (vs *visitorStore) cleanupLoop() {
|
||
|
|
for {
|
||
|
|
time.Sleep(time.Minute)
|
||
|
|
|
||
|
|
vs.mu.Lock()
|
||
|
|
for ip, v := range vs.visitors {
|
||
|
|
if time.Since(v.lastSeen) > 3*time.Minute {
|
||
|
|
delete(vs.visitors, ip)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
vs.mu.Unlock()
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// RateLimiter membatasi jumlah request per-IP menggunakan algoritma token bucket.
|
||
|
|
//
|
||
|
|
// - requestsPerSecond: rata-rata request yang diizinkan per detik (token yang "diisi ulang" per detik)
|
||
|
|
// - burst: jumlah request maksimum yang boleh "meledak" sekaligus (kapasitas kantong token)
|
||
|
|
//
|
||
|
|
// Contoh: RateLimiter(5, 10) artinya rata-rata 5 request/detik diizinkan,
|
||
|
|
// tapi boleh burst sampai 10 request sekaligus selama tokennya masih ada.
|
||
|
|
//
|
||
|
|
// Response saat limit terlampaui: HTTP 429 Too Many Requests.
|
||
|
|
func RateLimiter(requestsPerSecond float64, burst int) gin.HandlerFunc {
|
||
|
|
store := newVisitorStore(requestsPerSecond, burst)
|
||
|
|
|
||
|
|
return func(c *gin.Context) {
|
||
|
|
ip := c.ClientIP()
|
||
|
|
limiter := store.getLimiter(ip)
|
||
|
|
|
||
|
|
if !limiter.Allow() {
|
||
|
|
response.Error(c, http.StatusTooManyRequests, "terlalu banyak request, coba lagi nanti", nil)
|
||
|
|
c.Abort()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.Next()
|
||
|
|
}
|
||
|
|
}
|