feat: security rate limiter with strict limits on POST MCDA analysis run (#12)

* feat: rate limiter in middleware

* fix: page load and blockage after test

* feat: hard security for POST job run analysis

Author: rebecamurillo

.env.example

@@ -3,3 +3,18 @@ DATABASE_URL="mysql://username:password@localhost:3306/database_name"
 AUTH_SECRET="V5pDnymbX1zrXc7BTVsbWAL1wQCJYzfT"
 # URL of the external MCDA analysis service — required for POST /api/v1/job-runs (returns 500 if unset)
 JOB_RUN_IMPACT_ASSESS_ROUTE=
+JOB_RUN_IMPACT_API_KEY=X-Internal-API-Key
+
+ODP_ADMIN_HOST_PRIVATE="http://localhost:8000"
+ODP_ADMIN_HOST_PUBLIC="http://localhost:8000"
+USER_CREATION_API_KEY="dev_env_api_key"
+SIGNUP_LAB_EDITOR_ROLE_ID=2
+SIGNUP_AUTO_ACTIVATE=true
+
+# General rate limiting for all endpoints
+RATE_LIMIT_MAX_REQUESTS_PER_MINUTE=50
+RATE_LIMIT_BLOCK_DURATION_MINUTES=1
+
+# Job run specific rate limiting (stricter for compute-intensive operations)
+JOB_RUN_RATE_LIMIT_MAX_REQUESTS_PER_MINUTE=3
+JOB_RUN_RATE_LIMIT_BLOCK_DURATION_MINUTES=5

src/bff/controllers/rate-limiter.controller.test.ts

@@ -0,0 +1,278 @@
+import { describe, it, expect, vi } from "vitest";
+import { RateLimiterController } from "./rate-limiter.controller";
+import type { IRateLimiter } from "../../lib/utils/rateLimiter";
+
+const createRedirect = () => {
+  return vi.fn((path: string) =>
+    new Response(null, {
+      status: 302,
+      headers: { Location: path },
+    }),
+  );
+};
+
+describe("RateLimiterController", () => {
+  it("returns null for excluded static paths", () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 60 })),
+    };
+    const controller = new RateLimiterController(limiter);
+    const redirect = createRedirect();
+
+    const response = controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/assets/app.js"),
+      pathname: "/assets/app.js",
+      search: "",
+      redirect,
+    });
+
+    expect(response).toBeNull();
+    expect(limiter.check).not.toHaveBeenCalled();
+    expect(redirect).not.toHaveBeenCalled();
+  });
+
+  it("returns null when request is allowed", () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: true })),
+    };
+    const controller = new RateLimiterController(limiter);
+    const redirect = createRedirect();
+
+    const response = controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/dashboard", {
+        headers: {
+          "x-forwarded-for": "203.0.113.10",
+        },
+      }),
+      pathname: "/dashboard",
+      search: "",
+      redirect,
+    });
+
+    expect(response).toBeNull();
+    expect(limiter.check).toHaveBeenCalledWith("203.0.113.10");
+  });
+
+  it("returns JSON 429 response for blocked API requests", async () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 120 })),
+    };
+    const controller = new RateLimiterController(limiter);
+    const redirect = createRedirect();
+
+    const response = controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/api/v1/labs", {
+        headers: {
+          "x-forwarded-for": "198.51.100.24",
+        },
+      }),
+      pathname: "/api/v1/labs",
+      search: "",
+      redirect,
+    });
+
+    expect(response).not.toBeNull();
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get("Content-Type")).toContain("application/json");
+    expect(response?.headers.get("Retry-After")).toBe("120");
+    await expect(response?.json()).resolves.toEqual({
+      error: "Service currently unavailable",
+    });
+    expect(redirect).not.toHaveBeenCalled();
+  });
+
+  it("redirects blocked page requests to rate-limited page with original path", () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 300 })),
+    };
+    const controller = new RateLimiterController(limiter);
+    const redirect = createRedirect();
+
+    const response = controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/tools/resources?tab=all"),
+      pathname: "/tools/resources",
+      search: "?tab=all",
+      redirect,
+    });
+
+    expect(response).not.toBeNull();
+    expect(response?.status).toBe(302);
+    expect(redirect).toHaveBeenCalledWith(
+      "/rate-limited?from=%2Ftools%2Fresources%3Ftab%3Dall",
+    );
+    expect(response?.headers.get("Retry-After")).toBe("300");
+  });
+
+  it("uses x-real-ip when x-forwarded-for is missing", () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: true })),
+    };
+    const controller = new RateLimiterController(limiter);
+
+    controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/some-page", {
+        headers: {
+          "x-real-ip": "192.0.2.55",
+        },
+      }),
+      pathname: "/some-page",
+      search: "",
+      redirect: createRedirect(),
+    });
+
+    expect(limiter.check).toHaveBeenCalledWith("192.0.2.55");
+  });
+
+  it("returns null for internal SSR requests (X-Internal-Request header)", () => {
+    const limiter: IRateLimiter = {
+      check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 60 })),
+    };
+    const controller = new RateLimiterController(limiter);
+    const redirect = createRedirect();
+
+    const response = controller.enforceRateLimit({
+      request: new Request("http://localhost:4321/api/v1/labs", {
+        headers: {
+          "X-Internal-Request": "true",
+          "x-forwarded-for": "203.0.113.10",
+        },
+      }),
+      pathname: "/api/v1/labs",
+      search: "",
+      redirect,
+    });
+
+    expect(response).toBeNull();
+    expect(limiter.check).not.toHaveBeenCalled();
+    expect(redirect).not.toHaveBeenCalled();
+  });
+
+  describe("Job run specific rate limiting", () => {
+    it("uses strict rate limiter for POST /api/v1/job-runs", () => {
+      const generalLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: true })),
+      };
+      const jobRunLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 300 })),
+      };
+      const controller = new RateLimiterController(
+        generalLimiter,
+        jobRunLimiter,
+      );
+      const redirect = createRedirect();
+
+      const response = controller.enforceRateLimit({
+        request: new Request("http://localhost:4321/api/v1/job-runs", {
+          method: "POST",
+          headers: {
+            "x-forwarded-for": "198.51.100.1",
+          },
+        }),
+        pathname: "/api/v1/job-runs",
+        search: "",
+        redirect,
+      });
+
+      expect(jobRunLimiter.check).toHaveBeenCalledWith("198.51.100.1");
+      expect(generalLimiter.check).not.toHaveBeenCalled();
+      expect(response).not.toBeNull();
+      expect(response?.status).toBe(429);
+    });
+
+    it("uses general rate limiter for GET /api/v1/job-runs", () => {
+      const generalLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: true })),
+      };
+      const jobRunLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 300 })),
+      };
+      const controller = new RateLimiterController(
+        generalLimiter,
+        jobRunLimiter,
+      );
+      const redirect = createRedirect();
+
+      const response = controller.enforceRateLimit({
+        request: new Request("http://localhost:4321/api/v1/job-runs", {
+          method: "GET",
+          headers: {
+            "x-forwarded-for": "198.51.100.1",
+          },
+        }),
+        pathname: "/api/v1/job-runs",
+        search: "",
+        redirect,
+      });
+
+      expect(generalLimiter.check).toHaveBeenCalledWith("198.51.100.1");
+      expect(jobRunLimiter.check).not.toHaveBeenCalled();
+      expect(response).toBeNull();
+    });
+
+    it("uses general rate limiter for POST to other endpoints", () => {
+      const generalLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: true })),
+      };
+      const jobRunLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 300 })),
+      };
+      const controller = new RateLimiterController(
+        generalLimiter,
+        jobRunLimiter,
+      );
+      const redirect = createRedirect();
+
+      const response = controller.enforceRateLimit({
+        request: new Request("http://localhost:4321/api/v1/labs", {
+          method: "POST",
+          headers: {
+            "x-forwarded-for": "198.51.100.1",
+          },
+        }),
+        pathname: "/api/v1/labs",
+        search: "",
+        redirect,
+      });
+
+      expect(generalLimiter.check).toHaveBeenCalledWith("198.51.100.1");
+      expect(jobRunLimiter.check).not.toHaveBeenCalled();
+      expect(response).toBeNull();
+    });
+
+    it("returns 429 with correct retry-after header for blocked job run requests", async () => {
+      const generalLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: true })),
+      };
+      const jobRunLimiter: IRateLimiter = {
+        check: vi.fn(() => ({ allowed: false, retryAfterSeconds: 300 })),
+      };
+      const controller = new RateLimiterController(
+        generalLimiter,
+        jobRunLimiter,
+      );
+      const redirect = createRedirect();
+
+      const response = controller.enforceRateLimit({
+        request: new Request("http://localhost:4321/api/v1/job-runs", {
+          method: "POST",
+          headers: {
+            "x-forwarded-for": "198.51.100.1",
+          },
+        }),
+        pathname: "/api/v1/job-runs",
+        search: "",
+        redirect,
+      });
+
+      expect(response).not.toBeNull();
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get("Content-Type")).toContain(
+        "application/json",
+      );
+      expect(response?.headers.get("Retry-After")).toBe("300");
+      await expect(response?.json()).resolves.toEqual({
+        error: "Service currently unavailable",
+      });
+    });
+  });
+});