BE-007: Implement Rate Limiting

Due too much open request by unidentified users that access FE/BE module,
although request actually are not allowed, but somehow it junk notification and database services.
Result to overflow database insert and telegram call API.

Possibility Issue:
- Overflow database
- Timeout or too many request telegram notification API

Resolution:
- Implement laravel rate limiting features

References:
- https://laravel.com/docs/10.x/rate-limiting

Signed-off-by: Dicky Herlambang (花） <herlambangdicky5@gmail.com>

app/Providers/RouteServiceProvider.php

@@ -24,9 +24,7 @@ class RouteServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        RateLimiter::for('api', function (Request $request) {
-            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
-        });
+        $this->configureRateLimiting();
 
         $this->routes(function () {
             Route::middleware('api')
@@ -37,4 +35,14 @@ public function boot(): void
                 ->group(base_path('routes/web.php'));
         });
     }
+
+     /**
+     * Configure the rate limiters for the application.
+     */
+    protected function configureRateLimiting(): void
+    {
+        RateLimiter::for('api', function (Request $request) {
+            return Limit::perMinute(5)->by($request->ip());
+        });
+    }
 }

routes/api.php

@@ -36,7 +36,7 @@
     Route::post('revoke', [AuthController::class, 'revoke']);
 });
 
-Route::middleware('auth:api')->prefix('v1/core')->group(function() {
+Route::middleware(['auth:api'],['throttle:api'])->prefix('v1/core')->group(function() {
     // API v1 Backend PDF Core Processing Route
     Route::post('compress', [compressController::class, 'compress']);
     Route::post('convert', [convertController::class, 'convert']);
@@ -46,14 +46,14 @@
     Route::post('watermark', [watermarkController::class, 'watermark']);
 });
 
-Route::middleware('auth:api')->prefix('v1/file')->group(function() {
+Route::middleware(['auth:api'],['throttle:api'])->prefix('v1/file')->group(function() {
     // API v1 Backend File Management Route
     Route::post('upload', [uploadController::class, 'upload']);
     Route::post('remove', [uploadController::class, 'remove']);
     Route::post('thumbnail', [thumbnailController::class, 'getThumbnail']);
 });
 
-Route::middleware('auth:api')->prefix('v1/logs')->group(function() {
+Route::middleware(['auth:api'],['throttle:api'])->prefix('v1/logs')->group(function() {
     // API v1 Backend Logging Route
     Route::get('limit', [limitLogController::class, 'getLimit']);
     Route::post('proc/single', [processLogController::class, 'getLogs']);