|
| 1 | +<?php |
| 2 | + |
| 3 | +namespace App\Filters; |
| 4 | + |
| 5 | +use CodeIgniter\Filters\FilterInterface; |
| 6 | +use CodeIgniter\HTTP\IncomingRequest; |
| 7 | +use CodeIgniter\HTTP\RequestInterface; |
| 8 | +use CodeIgniter\HTTP\ResponseInterface; |
| 9 | + |
| 10 | +/** |
| 11 | + * Genel amaçlı, profil tabanlı rate-limit filtresi. |
| 12 | + * |
| 13 | + * Kullanım (route / grup): |
| 14 | + * ['filter' => 'throttle:backend'] // Config\Throttle::$profiles['backend'] |
| 15 | + * ['filter' => 'throttle:api'] |
| 16 | + * |
| 17 | + * Limit aşılınca: |
| 18 | + * - Web isteği → markalı error_429 sayfası, sayaç GERÇEK kalan süreyle (Retry-After) |
| 19 | + * - API / AJAX → JSON { status:429, retry_after:N } |
| 20 | + * Her iki durumda da HTTP 429 + `Retry-After` header'ı set edilir. |
| 21 | + */ |
| 22 | +class ThrottleFilter implements FilterInterface |
| 23 | +{ |
| 24 | + public function before(RequestInterface $request, $arguments = null) |
| 25 | + { |
| 26 | + // CLI / non-HTTP istekleri atla |
| 27 | + if (! $request instanceof IncomingRequest) { |
| 28 | + return; |
| 29 | + } |
| 30 | + |
| 31 | + $config = config('Throttle'); |
| 32 | + $profile = $arguments[0] ?? $config->default; |
| 33 | + [$capacity, $seconds] = $config->profiles[$profile] ?? $config->profiles[$config->default]; |
| 34 | + |
| 35 | + $throttler = service('throttler'); |
| 36 | + $key = $this->buildKey($request, $profile); |
| 37 | + |
| 38 | + if ($throttler->check($key, (int) $capacity, (int) $seconds) === false) { |
| 39 | + return $this->reject($request, $throttler->getTokenTime()); |
| 40 | + } |
| 41 | + } |
| 42 | + |
| 43 | + public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) |
| 44 | + { |
| 45 | + // no-op |
| 46 | + } |
| 47 | + |
| 48 | + /** |
| 49 | + * Bucket anahtarı: profil + IP (+ giriş yapan kullanıcı). |
| 50 | + */ |
| 51 | + protected function buildKey(IncomingRequest $request, string $profile): string |
| 52 | + { |
| 53 | + $id = (function_exists('auth') && auth()->loggedIn()) ? (string) auth()->id() : 'guest'; |
| 54 | + |
| 55 | + return md5('throttle:' . $profile . ':' . $request->getIPAddress() . ':' . $id); |
| 56 | + } |
| 57 | + |
| 58 | + /** |
| 59 | + * 429 yanıtını üret (içerik tipine göre HTML veya JSON). |
| 60 | + */ |
| 61 | + protected function reject(IncomingRequest $request, int $retryAfter): ResponseInterface |
| 62 | + { |
| 63 | + $response = service('response') |
| 64 | + ->setStatusCode(429) |
| 65 | + ->setHeader('Retry-After', (string) $retryAfter); |
| 66 | + |
| 67 | + if ($this->wantsJson($request)) { |
| 68 | + return $response->setJSON([ |
| 69 | + 'status' => 429, |
| 70 | + 'error' => 'Too Many Requests', |
| 71 | + 'retry_after' => $retryAfter, |
| 72 | + ]); |
| 73 | + } |
| 74 | + |
| 75 | + return $response->setBody( |
| 76 | + view('Modules\Backend\Views\errors\html\error_429', ['retryAfter' => $retryAfter]) |
| 77 | + ); |
| 78 | + } |
| 79 | + |
| 80 | + /** |
| 81 | + * İstek JSON mı bekliyor? (AJAX, Accept: application/json veya API path öneki) |
| 82 | + */ |
| 83 | + protected function wantsJson(IncomingRequest $request): bool |
| 84 | + { |
| 85 | + if ($request->isAJAX()) { |
| 86 | + return true; |
| 87 | + } |
| 88 | + |
| 89 | + if (str_contains($request->getHeaderLine('Accept'), 'application/json')) { |
| 90 | + return true; |
| 91 | + } |
| 92 | + |
| 93 | + $path = ltrim($request->getUri()->getPath(), '/'); |
| 94 | + foreach ((array) config('Throttle')->apiPrefixes as $prefix) { |
| 95 | + $prefix = trim((string) $prefix, '/'); |
| 96 | + if ($prefix !== '' && ($path === $prefix || str_starts_with($path, $prefix . '/'))) { |
| 97 | + return true; |
| 98 | + } |
| 99 | + } |
| 100 | + |
| 101 | + return false; |
| 102 | + } |
| 103 | +} |
0 commit comments