ratelimit.go RawHistoryFolder

1// Package registry implements the HTTP adapter for the registry API.
2package registry
3
4import (
5	"encoding/json"
6	"net/http"
7
8	"github.com/bnema/zerowrap"
9
10	"github.com/bnema/gordon/internal/adapters/dto"
11	"github.com/bnema/gordon/internal/adapters/in/http/middleware"
12	"github.com/bnema/gordon/internal/boundaries/out"
13)
14
15// RateLimitMiddleware creates rate limiting middleware for the registry API.
16// It uses the provided RateLimiter interfaces for global and per-IP limits.
17// IP extraction uses shared middleware.GetClientIP for trusted proxy handling.
18func RateLimitMiddleware(
19	globalLimiter out.RateLimiter,
20	ipLimiter out.RateLimiter,
21	trustedProxies []string,
22	log zerowrap.Logger,
23) func(http.Handler) http.Handler {
24	// If either limiter is nil, pass through without rate limiting
25	if globalLimiter == nil || ipLimiter == nil {
26		return func(next http.Handler) http.Handler {
27			return next
28		}
29	}
30
31	// Parse trusted proxy CIDRs once at middleware creation
32	trustedNets := middleware.ParseTrustedProxies(trustedProxies)
33
34	return func(next http.Handler) http.Handler {
35		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
36			ctx := r.Context()
37
38			// Check global rate limit
39			if !globalLimiter.Allow(ctx, "global") {
40				sendRateLimitError(w)
41				return
42			}
43
44			// Check per-IP rate limit
45			ip := middleware.GetClientIP(r, trustedNets)
46			if !ipLimiter.Allow(ctx, "ip:"+ip) {
47				sendRateLimitError(w)
48				return
49			}
50
51			next.ServeHTTP(w, r)
52		})
53	}
54}
55
56// sendRateLimitError sends an HTTP 429 response in Docker Registry API format.
57func sendRateLimitError(w http.ResponseWriter) {
58	w.Header().Set("Content-Type", "application/json")
59	w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
60	w.Header().Set("Retry-After", "1")
61	w.WriteHeader(http.StatusTooManyRequests)
62	_ = json.NewEncoder(w).Encode(dto.RegistryErrorResponse{
63		Errors: []dto.RegistryErrorItem{{
64			Code:    "TOOMANYREQUESTS",
65			Message: "rate limit exceeded",
66		}},
67	})
68}