chore(history): squash 67 commit(s) from 2026-09-25
- feat(accounts): persist device links with opaque hashed tokens, list and revoke endpoints - feat(frontend): app shell, routing and landing page with the chat-command hero - feat(frontend): Cyrillic-first fonts (Unbounded, Onest, JetBrains Mono); add i18next and motion - docs: free mod, bilingual site, one-click download, theme editor, public profiles, rich landing in plans - feat(accounts): internal gRPC AuthenticateDevice guarded by internal key - feat(frontend): ru/en i18n with typed per-feature dictionaries and language switch - feat(accounts): GET /me profile endpoint - feat(gateway): scaffold crate with config validation and health check - feat(gateway): reverse proxy to accounts and configs services - feat(gateway): resolve identity once from access JWT or device token via gRPC - feat(gateway): per-route and global rate limits with Retry-After - feat(gateway): CORS for the site origin; docs for gateway and internal contract - feat(configs): scaffold service with schema, config validation and health check - feat(configs): four config slots per account with list, get and save - feat(configs): permanent share codes with regenerate and public load-by-code - feat(accounts): GetPublicProfiles gRPC for showcase author info - style(accounts,common): apply rustfmt to existing sources - feat(configs): public showcase with publish, browse, detail and copy-to-slot - feat(backend): public profile endpoint and showcase author filter - fix(gateway): silence clippy collapsible-if and needless-ref warnings - docs(backend): configs-service implemented; Подсистема 1 backend complete - feat(mod): add Optimize module skeleton with OptimizeState holder - feat(mod): gate glass blur behind Optimize no_glass knob - feat(mod): cut MotionBlur and DoF sample counts behind lite_post knob - feat(mod): trim procedural sky noise behind lite_sky knob - feat(mod): drop fade gradients and digit rolls behind lean_hud knob - docs(todo): mark Optimize module phase 9.2 complete - refactor(mod): drop dead Renderer2D compatibility shims - refactor(mod): prune unreachable Renderer2D overload towers - refactor(mod): remove unused Renderer2D overloads and imports - docs(todo): mark Renderer2D giant-splitting done (2179 to 1597) - refactor(mod): extract shader id constants from LoVisualRenderPipelines - docs(todo): record registry wave 2026-09-25 (Renderer2D, pipelines) - refactor(mod): move Renderer2D instance state into base class - refactor(mod): extract Renderer2DRounded drawing family - refactor(mod): extract Renderer2DPath connector and chamfer family - refactor(mod): extract Renderer2DShapes circle line and texture primitives - refactor(mod): extract Renderer2DGlass and Renderer2DItem families - refactor(mod): prune Renderer2D imports after facade split - docs(todo): record Renderer2D facade inheritance split (1597 to 475) - docs: easter eggs — .env honeypot, konami troll mode, devtools banner, IDDQD config, breakable 404 block, 418 teapot - feat(mod): introduce surface style system core (SurfaceStyle, StyleSpec, StyleConfig, SurfaceRenderer) - refactor(mod): delegate HudRenderUtil liquid glass draws to SurfaceRenderer (dedupe glass constants) - refactor(mod): route bespoke glass call sites through SurfaceRenderer.plateSpec - feat(mod): add Auto option to HUD bg effects via shared HudBgStyles resolution - feat(mod): flat fallback for no-glass optimize mode and persist global HUD config - feat(mod): default HUD bg effects to Auto so the global surface style drives widgets - feat(mod): add global cycle-style hotkey with surface style notification - feat(mod): add surface style swatch strip under the global style picker - feat(gateway): reject ambiguous paths and answer .env probes with a honeypot - fix(gateway): charge failed credentials against the rate limit, allow stale ones on /auth - feat(frontend): ClickGui theme pipeline generated from the mod, live site theming - feat(frontend): landing v2 hero — voxel/particle backdrop, live ClickGui, theme strip - docs(todo): drop the FPS A/B measurement from phase 9.3, close phase 9 - feat(gateway): answer /coffee with a 418 teapot - feat(frontend): land the rest of landing v2 — HUD, module wall, showcase, FAQ, footer - feat(frontend): one-click download from GitHub releases, changelog page, release CI - feat(frontend): theme editor with live ClickGui preview, mod-compatible export and share links - fix(frontend): landing HUD playground now shows real mod widgets (fps, coordinates, module list, keybinds, ping) - style(frontend): apply ClickGui glass effect to landing HUD playground widgets - fix(frontend): prevent color field row overflow in theme editor grid - fix(frontend): never attach stale bearer token to /auth/* requests - fix(configs): unpublish/publish can no longer bypass moderation - refactor(accounts): shrink auth/handlers.rs under the 250-line cap - fix(accounts): tolerate concurrent refresh without killing every session - fix(gateway): minor hardening from the backend review - feat(configs): IDDQD easter egg config
This commit is contained in:
parent
72bc4c7148
commit
7f4b532f99
257 changed files with 13085 additions and 6582 deletions
85
backend/gateway/src/rate_limit/rules.rs
Normal file
85
backend/gateway/src/rate_limit/rules.rs
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
use axum::http::Method;
|
||||
use governor::Quota;
|
||||
use std::num::NonZeroU32;
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum KeyBy {
|
||||
Ip,
|
||||
Account,
|
||||
}
|
||||
|
||||
pub struct Rule {
|
||||
pub method: Method,
|
||||
/// Exact path, or a prefix when it ends with '*'.
|
||||
pub pattern: &'static str,
|
||||
pub quota: Quota,
|
||||
pub key_by: KeyBy,
|
||||
}
|
||||
|
||||
impl Rule {
|
||||
pub fn matches(&self, method: &Method, path: &str) -> bool {
|
||||
if self.method != *method {
|
||||
return false;
|
||||
}
|
||||
match self.pattern.strip_suffix('*') {
|
||||
Some(prefix) => path.starts_with(prefix),
|
||||
None => path == self.pattern,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn n(v: u32) -> NonZeroU32 {
|
||||
NonZeroU32::new(v).expect("rate-limit constants are non-zero")
|
||||
}
|
||||
|
||||
fn rule(method: Method, pattern: &'static str, quota: Quota, key_by: KeyBy) -> Rule {
|
||||
Rule {
|
||||
method,
|
||||
pattern,
|
||||
quota,
|
||||
key_by,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn rules() -> Vec<Rule> {
|
||||
use KeyBy::*;
|
||||
vec![
|
||||
rule(Method::POST, "/auth/login", Quota::per_minute(n(5)), Ip),
|
||||
rule(Method::POST, "/auth/register", Quota::per_hour(n(3)), Ip),
|
||||
rule(Method::POST, "/auth/refresh", Quota::per_minute(n(30)), Ip),
|
||||
rule(Method::POST, "/device/code", Quota::per_minute(n(10)), Ip),
|
||||
// The mod polls every 2–3 s for up to 10 min: 10/min would break linking.
|
||||
rule(Method::POST, "/device/token", Quota::per_minute(n(30)), Ip),
|
||||
rule(Method::PUT, "/configs/*", Quota::per_minute(n(20)), Account),
|
||||
rule(
|
||||
Method::GET,
|
||||
"/configs/shared/*",
|
||||
Quota::per_minute(n(30)),
|
||||
Ip,
|
||||
),
|
||||
rule(Method::POST, "/avatars", Quota::per_hour(n(5)), Account),
|
||||
rule(Method::GET, "/showcase*", Quota::per_minute(n(60)), Ip),
|
||||
]
|
||||
}
|
||||
|
||||
pub fn global_quota() -> Quota {
|
||||
Quota::per_minute(n(300))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn exact_and_prefix_matching() {
|
||||
let all = rules();
|
||||
let find = |m: Method, p: &str| all.iter().position(|r| r.matches(&m, p));
|
||||
assert_eq!(find(Method::POST, "/auth/login"), Some(0));
|
||||
assert_eq!(find(Method::GET, "/auth/login"), None);
|
||||
assert_eq!(find(Method::POST, "/auth/login/x"), None);
|
||||
assert!(find(Method::PUT, "/configs/3").is_some());
|
||||
assert!(find(Method::GET, "/configs/shared/ABCD").is_some());
|
||||
assert!(find(Method::GET, "/showcase").is_some());
|
||||
assert!(find(Method::GET, "/showcase/11111111-1111-1111-1111-111111111111").is_some());
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue