ratelimit.go RawHistoryFolder

1// Package registry implements the HTTP adapter for the registry API.
2package registry
3
4import (
5	"encoding/json"
6	"net/http"
7
8	"github.com/bnema/zerowrap"
9
10	"github.com/bnema/gordon/internal/adapters/dto"
11	"github.com/bnema/gordon/internal/adapters/in/http/httphelper"
12	"github.com/bnema/gordon/internal/adapters/in/http/middleware"
13	"github.com/bnema/gordon/internal/boundaries/out"
14)
15
16// RateLimitMiddleware creates rate limiting middleware for the registry API.
17// It uses the provided RateLimiter interfaces for global and per-IP limits.
18// IP extraction uses shared middleware.GetClientIP for trusted proxy handling.
19func RateLimitMiddleware(
20	globalLimiter out.RateLimiter,
21	ipLimiter out.RateLimiter,
22	trustedProxies []string,
23	log zerowrap.Logger,
24) func(http.Handler) http.Handler {
25	// If either limiter is nil, pass through without rate limiting
26	if globalLimiter == nil || ipLimiter == nil {
27		return func(next http.Handler) http.Handler {
28			return next
29		}
30	}
31
32	// Parse trusted proxy CIDRs once at middleware creation
33	trustedNets := httphelper.ParseTrustedProxies(trustedProxies)
34
35	return func(next http.Handler) http.Handler {
36		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
37			ctx := r.Context()
38
39			// Check global rate limit
40			if !globalLimiter.Allow(ctx, "global") {
41				sendRateLimitError(w)
42				return
43			}
44
45			// Check per-IP rate limit
46			ip := middleware.GetClientIP(r, trustedNets)
47			if !ipLimiter.Allow(ctx, "ip:"+ip) {
48				sendRateLimitError(w)
49				return
50			}
51
52			next.ServeHTTP(w, r)
53		})
54	}
55}
56
57// sendRateLimitError sends an HTTP 429 response in Docker Registry API format.
58func sendRateLimitError(w http.ResponseWriter) {
59	w.Header().Set("Content-Type", "application/json")
60	w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
61	w.Header().Set("Retry-After", "1")
62	w.WriteHeader(http.StatusTooManyRequests)
63	_ = json.NewEncoder(w).Encode(dto.RegistryErrorResponse{
64		Errors: []dto.RegistryErrorItem{{
65			Code:    "TOOMANYREQUESTS",
66			Message: "rate limit exceeded",
67		}},
68	})
69}