增强关键接口幂等与限流保护

apps/backend/src/middleware/rate-limit.test.ts

@@ -0,0 +1,116 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { NextFunction, Request, Response } from "express";
+
+import {
+  createRateLimitMiddleware,
+  resetRateLimitBucketsForTest,
+} from "./rate-limit.js";
+
+test("createRateLimitMiddleware allows requests within the window", () => {
+  resetRateLimitBucketsForTest();
+
+  const limiter = createRateLimitMiddleware({
+    scope: "test:allow",
+    windowMs: 60_000,
+    max: 2,
+  });
+  const req = createMockRequest();
+  const res = createMockResponse();
+  let nextCount = 0;
+  const next: NextFunction = () => {
+    nextCount += 1;
+  };
+
+  limiter(req, res, next);
+  limiter(req, res, next);
+
+  assert.equal(nextCount, 2);
+  assert.equal(res.statusCode, 200);
+});
+
+test("createRateLimitMiddleware blocks requests over the limit", () => {
+  resetRateLimitBucketsForTest();
+
+  const limiter = createRateLimitMiddleware({
+    scope: "test:block",
+    windowMs: 60_000,
+    max: 1,
+  });
+  const req = createMockRequest();
+  const res = createMockResponse();
+  let nextCount = 0;
+  const next: NextFunction = () => {
+    nextCount += 1;
+  };
+
+  limiter(req, res, next);
+  limiter(req, res, next);
+
+  assert.equal(nextCount, 1);
+  assert.equal(res.statusCode, 429);
+  assert.equal(res.headers["Retry-After"], "60");
+  assert.equal(res.body.errorCode, "rate_limited");
+});
+
+test("createRateLimitMiddleware supports custom limit responses", () => {
+  resetRateLimitBucketsForTest();
+
+  const limiter = createRateLimitMiddleware({
+    scope: "test:custom",
+    windowMs: 60_000,
+    max: 1,
+    onLimit: (_req, res) => {
+      res.status(200).json({ code: 429, message: "limited" });
+    },
+  });
+  const req = createMockRequest();
+  const res = createMockResponse();
+
+  limiter(req, res, () => {});
+  limiter(req, res, () => {});
+
+  assert.equal(res.statusCode, 200);
+  assert.deepEqual(res.body, { code: 429, message: "limited" });
+});
+
+function createMockRequest(): Request {
+  return {
+    ip: "127.0.0.1",
+    originalUrl: "/test",
+    headers: {},
+    socket: {
+      remoteAddress: "127.0.0.1",
+    },
+  } as Request;
+}
+
+function createMockResponse(): Response & {
+  statusCode: number;
+  headers: Record<string, string>;
+  body: any;
+} {
+  const res = {
+    statusCode: 200,
+    headers: {} as Record<string, string>,
+    body: null as any,
+    setHeader(name: string, value: string) {
+      this.headers[name] = value;
+      return this;
+    },
+    status(statusCode: number) {
+      this.statusCode = statusCode;
+      return this;
+    },
+    json(body: any) {
+      this.body = body;
+      return this;
+    },
+  };
+
+  return res as Response & {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: any;
+  };
+}

apps/backend/src/middleware/rate-limit.ts

@@ -0,0 +1,122 @@
+import type { NextFunction, Request, Response } from "express";
+
+import { buildErrorPayload, createHttpError } from "../utils/http.js";
+import { logWarn } from "../utils/logger.js";
+
+type RateLimitKeyResolver = (req: Request) => string;
+
+type RateLimitExceededContext = {
+  scope: string;
+  retryAfterSeconds: number;
+};
+
+type RateLimitOptions = {
+  scope: string;
+  windowMs: number;
+  max: number;
+  key?: RateLimitKeyResolver;
+  onLimit?: (req: Request, res: Response, context: RateLimitExceededContext) => void;
+};
+
+type RateLimitBucket = {
+  count: number;
+  resetAt: number;
+};
+
+const buckets = new Map<string, RateLimitBucket>();
+let lastCleanupAt = 0;
+
+export function createRateLimitMiddleware({
+  scope,
+  windowMs,
+  max,
+  key = defaultRateLimitKey,
+  onLimit,
+}: RateLimitOptions) {
+  const normalizedScope = String(scope || "default").trim() || "default";
+  const normalizedWindowMs = Math.max(1000, Number(windowMs || 0));
+  const normalizedMax = Math.max(1, Number(max || 0));
+
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const now = Date.now();
+    cleanupExpiredBuckets(now);
+
+    const bucketKey = `${normalizedScope}:${key(req)}`;
+    const current = buckets.get(bucketKey);
+    const bucket = current && current.resetAt > now
+      ? current
+      : { count: 0, resetAt: now + normalizedWindowMs };
+
+    bucket.count += 1;
+    buckets.set(bucketKey, bucket);
+
+    if (bucket.count <= normalizedMax) {
+      next();
+      return;
+    }
+
+    const retryAfterSeconds = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));
+    res.setHeader("Retry-After", String(retryAfterSeconds));
+
+    logWarn("[rate-limit]", "请求触发限流", {
+      scope: normalizedScope,
+      ip: req.ip,
+      originalUrl: req.originalUrl,
+      retryAfterSeconds,
+    });
+
+    if (onLimit) {
+      onLimit(req, res, {
+        scope: normalizedScope,
+        retryAfterSeconds,
+      });
+      return;
+    }
+
+    const error = createHttpError("请求过于频繁，请稍后再试", {
+      statusCode: 429,
+      errorCode: "rate_limited",
+    });
+    res.status(429).json(buildErrorPayload(error, "请求过于频繁，请稍后再试"));
+  };
+}
+
+export function resetRateLimitBucketsForTest(): void {
+  buckets.clear();
+  lastCleanupAt = 0;
+}
+
+export function getBodyFieldRateLimitKey(fieldName: string): RateLimitKeyResolver {
+  return (req) => [defaultRateLimitKey(req), normalizeKeyPart(req.body?.[fieldName])].join(":");
+}
+
+export function getParamRateLimitKey(paramName: string): RateLimitKeyResolver {
+  return (req) => [defaultRateLimitKey(req), normalizeKeyPart(req.params?.[paramName])].join(":");
+}
+
+function defaultRateLimitKey(req: Request): string {
+  return normalizeKeyPart(
+    req.ip ||
+      String(req.headers["x-forwarded-for"] || "").split(",")[0] ||
+      req.socket.remoteAddress ||
+      "unknown",
+  );
+}
+
+function normalizeKeyPart(value: unknown): string {
+  const normalized = String(value || "").trim().toLowerCase();
+  return normalized || "unknown";
+}
+
+function cleanupExpiredBuckets(now: number): void {
+  if (now - lastCleanupAt < 60_000) {
+    return;
+  }
+
+  lastCleanupAt = now;
+  for (const [key, bucket] of buckets.entries()) {
+    if (bucket.resetAt <= now) {
+      buckets.delete(key);
+    }
+  }
+}