Skip to content

nlhuykhang/ddp-rate-limiter-mixin

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
src
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

ddp-rate-limiter-mixin

A mixin for mdg:validated-method to add rate limitation support to Meteor's methods.

Install

meteor add ddp-rate-limiter
npm install --save ddp-rate-limiter-mixin

Usage

import { ValidatedMethod } from 'meteor/mdg:validated-method';
import { RateLimiterMixin } from 'ddp-rate-limiter-mixin';

// limit the maximum 5 requests in 5 seconds to this method for every clients
const foo = new ValidatedMethod({
  name: 'foo',
  mixins: [RateLimiterMixin],
  rateLimit: {
    numRequests: 5,
    timeInterval: 5000,
  },
  validate: null,
  run() {
    // ...
  }
});

// limit the maximum 5 requests in 5 seconds to this method for user1 only
const boo = new ValidatedMethod({
  name: 'boo',
  mixins: [RateLimiterMixin],
  rateLimit: {
    matcher: {
      userId: 'user1',
    },
    numRequests: 5,
    timeInterval: 5000,
  },
  validate: null,
  run() {
    // ...
  }
});

// limit the maximum 5 requests in 5 seconds to this method for users who are not `Admin`
const bar = new ValidatedMethod({
  name: 'bar',
  mixins: [RateLimiterMixin],
  rateLimit: {
    // this use to match the request, optional
    matcher: {
      // optional, could be a string or a return-boolean function
      userId(userId) {
        return Meteor.users.findOne(userId).type !== 'Admin';
      },
      // optional, could be a string or a return-boolean function
      connectionId(connectionId) {
        return true;
      },
      // optional, could be a string or a return-boolean function
      clientAddress(clientAddress) {
        return true;
      },
    },
    numRequests: 5,
    timeInterval: 5000,
  },
  validate: null,
  run() {
    // ...
  }
});

Rate Limit

This package uses Meteor's DDPRateLimiter behind the scene to support rate limitation for Meteor methods. This comes with a nicer way to define rate limitation.

Using normal DDPRateLimiter way is fine, but it would introduce 'side-effect' to your system. Like sometimes you just do not know where the limitation is set, or what is the maximum requests could be called in a period of time. This package helps solving that by specifying limitation when defining a method.

rateLimit option

You have to specify the rateLimit option to define limitation.

rateLimit.matcher is optional. If specified it is similar to matcher 1st argument of DDPRateLimiter.addRule, except name is always the name of method and type is always method.

rateLimit: {
  // this use to match the request, optional
  matcher: {
    // optional, could be a string or a return-boolean function
    userId(userId) {
      // ...
      return true/false;
    },
    // optional, could be a string or a return-boolean function
    connectionId(connectionId) {
      return true/false;
    },
    // optional, could be a string or a return-boolean function
    clientAddress(clientAddress) {
      return true/false;
    },
  },
  // numRequests is the maximum number of  requests could be made in timeInterval (milliseconds)
  numRequests: 5,
  timeInterval: 5000, // 5000 milliseconds
  // callback is a function to be called after a rule is executed.
  callback: (check, ruleInput) => ()
},

rateLimit callback properties

Overview:

check: {
  allowed: boolean - indicates wether the call is allowed or not
  timeToReset: integer - milliseconds to reset the number for the current interval
  numInvocationsLeft: integer - number of invocations left for the current interval
}

ruleInput: {
  'type': string - either 'method' or 'subscription'
  'name': string - the name of the method or subscription being called
  'userId': string - the user ID attempting the method or subscription
  'connectionId': string - a string representing the user's DDP connection
  'clientAddress': string - the IP address of the user
}

For more info check the following links:

About

A mixin for mdg:validated-method to add rate limitation support to Meteor's methods.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published