From 1da23d6b33421daf88a1a15a6821d6304940691a Mon Sep 17 00:00:00 2001 From: CaIon Date: Thu, 6 Aug 2026 18:04:20 +0800 Subject: [PATCH] feat(rate-limit): add user critical rate limit middleware for access token and aff transfer routes --- middleware/rate-limit.go | 11 +++++++++++ router/api-router.go | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/middleware/rate-limit.go b/middleware/rate-limit.go index 350ee8ec..be1820ff 100644 --- a/middleware/rate-limit.go +++ b/middleware/rate-limit.go @@ -178,6 +178,17 @@ func CriticalRateLimit() func(c *gin.Context) { return defNext } +func UserCriticalRateLimit(scope string) func(c *gin.Context) { + if !common.CriticalRateLimitEnable { + return defNext + } + return userRateLimitFactory( + common.CriticalRateLimitNum, + common.CriticalRateLimitDuration, + "UC:"+scope, + ) +} + func DownloadRateLimit() func(c *gin.Context) { return rateLimitFactory(common.DownloadRateLimitNum, common.DownloadRateLimitDuration, "DW") } diff --git a/router/api-router.go b/router/api-router.go index 2b0bfd6c..31c595e0 100644 --- a/router/api-router.go +++ b/router/api-router.go @@ -90,7 +90,7 @@ func SetApiRouter(router *gin.Engine) { selfRoute.GET("/models", controller.GetUserModels) selfRoute.PUT("/self", middleware.CriticalRateLimit(), middleware.DisableCache(), controller.UpdateSelf) selfRoute.DELETE("/self", controller.DeleteSelf) - selfRoute.GET("/token", middleware.CriticalRateLimit(), middleware.DisableCache(), controller.GenerateAccessToken) + selfRoute.GET("/token", middleware.CriticalRateLimit(), middleware.UserCriticalRateLimit("access-token"), middleware.DisableCache(), controller.GenerateAccessToken) selfRoute.GET("/passkey", controller.PasskeyStatus) selfRoute.POST("/passkey/register/begin", middleware.DisableCache(), controller.PasskeyRegisterBegin) selfRoute.POST("/passkey/register/finish", middleware.DisableCache(), controller.PasskeyRegisterFinish) @@ -110,7 +110,7 @@ func SetApiRouter(router *gin.Engine) { selfRoute.POST("/waffo/pay", middleware.CriticalRateLimit(), controller.RequestWaffoPay) selfRoute.POST("/waffo-pancake/amount", controller.RequestWaffoPancakeAmount) selfRoute.POST("/waffo-pancake/pay", middleware.CriticalRateLimit(), controller.RequestWaffoPancakePay) - selfRoute.POST("/aff_transfer", controller.TransferAffQuota) + selfRoute.POST("/aff_transfer", middleware.UserCriticalRateLimit("aff-transfer"), controller.TransferAffQuota) selfRoute.PUT("/setting", controller.UpdateUserSetting) // 2FA routes