feat: allow disabling ratelimits (for developement purposes)

pastebin-fi · Jun 28, 2023 · 3459e7a · 3459e7a
1 parent 0620719
commit 3459e7a
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 4 deletions.
diff --git a/src/config.ts b/src/config.ts
@@ -19,6 +19,7 @@ export default {
     secret: process.env.SECRET || "keyboard cat",
     abuseipdb_key: process.env.ABUSEIPDB_KEY || "",
     data_dir: process.env.DATA_DIR || "./data",
+    skipRatelimiters: process.env.SKIPRATELIMITERS == "true",
     getMailer: async () => {
         const dkim =
             process.env.DKIM_ENABLED === "true"

diff --git a/src/ratelimiters/pastes.ts b/src/ratelimiters/pastes.ts
@@ -1,12 +1,14 @@
+import config from "../config"
 import rateLimit from "express-rate-limit"
 
 // Limit each IP to 20 new paste requests per `window` (here, 30 mins)
 export const newPasteRateLimiter = rateLimit({
+    skip: () => config.skipRatelimiters,
     windowMs: 30 * 60 * 1000,
     max: 20,
     message: {
         title: "IP-osoitetta on rajoitettu",
-        message: "Liian monta liitettä on luotu IP-osoitteestasi. Kokeile myöhemmin uudelleen."
+        message: "Liian monta liitettä on luotu IP-osoitteestasi. Kokeile myöhemmin uudelleen.",
     },
     standardHeaders: true,
     legacyHeaders: false,

diff --git a/src/ratelimiters/users.ts b/src/ratelimiters/users.ts
@@ -1,19 +1,21 @@
+import config from "../config"
 import rateLimit from "express-rate-limit"
 
 // Limit each IP to 5 create account requests per `window` (here, per day)
 // -> keep in mind that account creations can be unsuccesful but they should
 //    not because frontend tells if cannot be created
 export const createAccountLimiter = rateLimit({
+    skip: () => config.skipRatelimiters,
     windowMs: 60 * 60 * 1000 * 24, // 1 day
     max: 5,
-    message:
-        "Tästä IP-osoitteesta on luotu liian monta käyttäjää aikarajan sisään. Yritäthän myöhemmin uudelleen.",
+    message: "Tästä IP-osoitteesta on luotu liian monta käyttäjää aikarajan sisään. Yritäthän myöhemmin uudelleen.",
     standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
     legacyHeaders: false, // Disable the `X-RateLimit-*` headers
 })
 
 // Limit each IP to 20 login requests per 30 mins
 export const loginAccountLimiter = rateLimit({
+    skip: () => config.skipRatelimiters,
     windowMs: 30 * 60 * 1000,
     max: 20,
     message:

diff --git a/src/routes/user.ts b/src/routes/user.ts
@@ -123,7 +123,7 @@ class Users extends Routes {
         if (identity) return this.sendErrorResponse(res, 403, userErrors.userAlreadyLoggedIn)
 
         const registeredAt = parseInt(req.cookies?.["registered_at"])
-        if (registeredAt !== 0 && registeredAt - 3600 * 24)
+        if (!config.skipRatelimiters && registeredAt !== 0 && registeredAt - 3600 * 24)
             return this.sendErrorResponse(res, 401, userErrors.registrationFailedRatelimit)
 
         const body = await req.body