first commit

internal/middleware/rate_limitter.go

@@ -0,0 +1,94 @@
+package middleware
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"cardverse/internal/pkg/response"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/time/rate"
+)
+
+// visitor menyimpan limiter token bucket milik satu IP + waktu terakhir dia request
+type visitor struct {
+	limiter  *rate.Limiter
+	lastSeen time.Time
+}
+
+// visitorStore menyimpan limiter per-IP secara thread-safe.
+// Setiap IP punya "kantong token" sendiri, jadi satu IP yang spam tidak
+// mempengaruhi jatah IP lain.
+type visitorStore struct {
+	mu       sync.Mutex
+	visitors map[string]*visitor
+	rps      rate.Limit
+	burst    int
+}
+
+func newVisitorStore(requestsPerSecond float64, burst int) *visitorStore {
+	vs := &visitorStore{
+		visitors: make(map[string]*visitor),
+		rps:      rate.Limit(requestsPerSecond),
+		burst:    burst,
+	}
+	go vs.cleanupLoop()
+	return vs
+}
+
+func (vs *visitorStore) getLimiter(ip string) *rate.Limiter {
+	vs.mu.Lock()
+	defer vs.mu.Unlock()
+
+	v, exists := vs.visitors[ip]
+	if !exists {
+		limiter := rate.NewLimiter(vs.rps, vs.burst)
+		vs.visitors[ip] = &visitor{limiter: limiter, lastSeen: time.Now()}
+		return limiter
+	}
+
+	v.lastSeen = time.Now()
+	return v.limiter
+}
+
+// cleanupLoop membuang data IP yang sudah tidak aktif > 3 menit supaya memori tidak terus membengkak
+func (vs *visitorStore) cleanupLoop() {
+	for {
+		time.Sleep(time.Minute)
+
+		vs.mu.Lock()
+		for ip, v := range vs.visitors {
+			if time.Since(v.lastSeen) > 3*time.Minute {
+				delete(vs.visitors, ip)
+			}
+		}
+		vs.mu.Unlock()
+	}
+}
+
+// RateLimiter membatasi jumlah request per-IP menggunakan algoritma token bucket.
+//
+//   - requestsPerSecond: rata-rata request yang diizinkan per detik (token yang "diisi ulang" per detik)
+//   - burst: jumlah request maksimum yang boleh "meledak" sekaligus (kapasitas kantong token)
+//
+// Contoh: RateLimiter(5, 10) artinya rata-rata 5 request/detik diizinkan,
+// tapi boleh burst sampai 10 request sekaligus selama tokennya masih ada.
+//
+// Response saat limit terlampaui: HTTP 429 Too Many Requests.
+func RateLimiter(requestsPerSecond float64, burst int) gin.HandlerFunc {
+	store := newVisitorStore(requestsPerSecond, burst)
+
+	return func(c *gin.Context) {
+		ip := c.ClientIP()
+		limiter := store.getLimiter(ip)
+
+		if !limiter.Allow() {
+			response.Error(c, http.StatusTooManyRequests, "terlalu banyak request, coba lagi nanti", nil)
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}