src/EventSubscriber/ApiRateLimitSubscriber.php line 35

Open in your IDE?
  1. <?php
  2. //----------------------------------------------------------------------
  3. // src/EventSubscriber/ApiRateLimitSubscriber.php
  4. //----------------------------------------------------------------------
  6. namespace App\EventSubscriber;
  8. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  9. use Symfony\Component\HttpKernel\Event\RequestEvent;
  10. use Symfony\Component\HttpKernel\KernelEvents;
  11. use Symfony\Component\RateLimiter\RateLimiterFactory;
  12. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  13. use App\Entity\APIRest\AccessAPI;
  14. use App\Services\APIRest\Tools\APIResponseTools;
  15. use App\Services\LogTools;
  16. use App\Utils\APIError;
  18. class ApiRateLimitSubscriber implements EventSubscriberInterface
  19. {
  20.     public function __construct(
  21.         private RateLimiterFactory $apiByIpLimiter,
  22.         private RateLimiterFactory $apiByUserLimiter,
  23.         private TokenStorageInterface $tokenStorage,
  24.         private APIResponseTools $apiResponseTools,
  25.         private LogTools $logTools,
  26.     ) {}
  28.     public static function getSubscribedEvents(): array
  29.     {
  30.         return [
  31.             KernelEvents::REQUEST => ['onKernelRequest', -10],
  32.         ];
  33.     }
  35.     public function onKernelRequest(RequestEvent $event): void
  36.     {
  38.         if (!$event->isMainRequest()) 
  39.         {
  40.             return;
  41.         }
  43.         $request = $event->getRequest();
  44.         $route = $request->attributes->get('_route', '');
  46.         // Only apply to API REST routes
  47.         if (!str_starts_with($route, 'icod_api_rest_')) 
  48.         {
  49.             return;
  50.         }
  52.         // Exclude login and lost password routes
  53.         if (in_array($route, ['icod_api_rest_authentication_login', 'icod_api_rest_lost_password'])) 
  54.         {
  55.             return;
  56.         }
  58.         $ip = $request->getClientIp() ?? 'unknown';
  61.         // Rate limit by IP
  62.         $ipLimiter = $this->apiByIpLimiter->create($ip);
  63.         $ipLimit = $ipLimiter->consume(1);
  64.         if (!$ipLimit->isAccepted()) 
  65.         {
  66.             $token = $this->tokenStorage->getToken();
  67.             $accessApi = null;
  68.             if ($token !== null && ($tokenUser = $token->getUser()) instanceof AccessAPI)
  69.             {
  70.                 $accessApi = $tokenUser;
  71.             }
  73.             $maxRequests = method_exists($ipLimit, 'getLimit') ? $ipLimit->getLimit() : '';
  75.             $this->logTools->apiRestRateLimitLog([
  76.                 'scope'        => 'IP',
  77.                 'ip'           => $ip,
  78.                 'accessApi'    => $accessApi,
  79.                 'route'        => $route,
  80.                 'max_requests' => $maxRequests,
  81.             ]);
  83.             $apiError = new APIError(APIError::RATE_LIMIT_EXCEEDED);
  84.             $event->setResponse($this->apiResponseTools->tooManyRequestsResponse($apiError));
  85.             return;
  86.         }
  88.         // Rate limit by authenticated user
  89.         $token = $this->tokenStorage->getToken();
  90.         if ($token !== null && ($user = $token->getUser()) instanceof AccessAPI) 
  91.         {
  92.             $userLimiter = $this->apiByUserLimiter->create('user_' . $user->getId());
  93.             $userLimit = $userLimiter->consume(1);
  94.             if (!$userLimit->isAccepted()) 
  95.             {
  96.                 $maxRequests = method_exists($userLimit, 'getLimit') ? $userLimit->getLimit() : '';
  98.                 $this->logTools->apiRestRateLimitLog([
  99.                     'scope'        => 'USER',
  100.                     'ip'           => $ip,
  101.                     'accessApi'    => $user,
  102.                     'route'        => $route,
  103.                     'max_requests' => $maxRequests,
  104.                 ]);
  106.                 $apiError = new APIError(APIError::RATE_LIMIT_EXCEEDED);
  107.                 $event->setResponse($this->apiResponseTools->tooManyRequestsResponse($apiError));
  108.                 return;
  109.             }
  110.         }
  111.     }
  112. }