feat(form-issue): add rate-limit (#7633)

feat: add rate-limit
opengovsg · Aug 31, 2024 · db54160 · db54160
1 parent 77ba2ca
commit db54160
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/src/app/config/schema.ts b/src/app/config/schema.ts
@@ -356,6 +356,12 @@ export const optionalVarsSchema: Schema<IOptionalVarsSchema> = {
       default: 60,
       env: 'SEND_AUTH_OTP_RATE_LIMIT',
     },
+    publicFormIssueFeedback: {
+      doc: 'Per-minute, per-IP, per form request limit for public form issue feedback endpoints',
+      format: 'int',
+      default: 3,
+      env: 'PUBLIC_FORM_ISSUE_FEEDBACK_RATE_LIMIT',
+    },
     downloadPaymentReceipt: {
       doc: 'Per-minute, per-IP request limit to download the payment receipt from Stripe',
       format: 'int',

diff --git a/src/app/routes/api/v3/forms/public-forms.issue.routes.ts b/src/app/routes/api/v3/forms/public-forms.issue.routes.ts
@@ -1,6 +1,8 @@
 import { Router } from 'express'
 
+import { rateLimitConfig } from '../../../../config/config'
 import * as IssueController from '../../../../modules/issue/issue.controller'
+import { limitRate } from '../../../../utils/limit-rate'
 
 export const PublicFormsIssueRouter = Router()
 
@@ -19,5 +21,6 @@ export const PublicFormsIssueRouter = Router()
  * @returns 500 if database error occurs
  */
 PublicFormsIssueRouter.route('/:formId([a-fA-F0-9]{24})/issue').post(
+  limitRate({ max: rateLimitConfig.publicFormIssueFeedback }),
   IssueController.handleSubmitFormIssue,
 )
diff --git a/src/types/config.ts b/src/types/config.ts
@@ -59,6 +59,7 @@ export type MailConfig = {
 export type RateLimitConfig = {
   submissions: number
   sendAuthOtp: number
+  publicFormIssueFeedback: number
   downloadPaymentReceipt: number
   downloadFormWhitelist: number
   uploadFormWhitelist: number
@@ -190,6 +191,7 @@ export interface IOptionalVarsSchema {
   rateLimit: {
     submissions: number
     sendAuthOtp: number
+    publicFormIssueFeedback: number
     downloadPaymentReceipt: number
     downloadFormWhitelist: number
     uploadFormWhitelist: number