bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(hub): rate limit public code browsing

Browse source
This commit is contained in:
冰朔 2026-08-06 14:20:06 +08:00
commit f87cd30dab
3 changed files with 108 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

47
server-tools/jd-app-hub/test/server.test.js
View file

@ -92,6 +92,53 @@ test("JD hub preserves nested code-channel paths and queries without duplicating
assert.deepEqual(await root.json(), { path: "/" });
});
test("JD hub rate limits code-channel traffic by verified proxy client address", async (t) => {
const upstream = http.createServer((_request, response) => {
response.writeHead(200);
response.end("ok");
});
upstream.listen(0, "127.0.0.1");
t.after(() => upstream.close());
await new Promise((resolve) => upstream.once("listening", resolve));
const server = createApp({
codeChannelPort: upstream.address().port,
codeRateLimitMax: 2
}).listen(0, "127.0.0.1");
t.after(() => server.close());
await new Promise((resolve) => server.once("listening", resolve));
const endpoint = `http://127.0.0.1:${server.address().port}/code/api/v1/version`;
const headers = { "x-real-ip": "203.0.113.10" };
assert.equal((await fetch(endpoint, { headers })).status, 200);
assert.equal((await fetch(endpoint, { headers })).status, 200);
const limited = await fetch(endpoint, { headers });
assert.equal(limited.status, 429);
assert.deepEqual(await limited.json(), { ok: false, error: "code_channel_rate_limited" });
assert.equal((await fetch(endpoint, { headers: { "x-real-ip": "203.0.113.11" } })).status, 200);
});
test("JD hub gives historical source browsing a lower independent ceiling", async (t) => {
const upstream = http.createServer((_request, response) => {
response.writeHead(200);
response.end("ok");
});
upstream.listen(0, "127.0.0.1");
t.after(() => upstream.close());
await new Promise((resolve) => upstream.once("listening", resolve));
const server = createApp({
codeChannelPort: upstream.address().port,
codeRateLimitMax: 10,
codeBrowseRateLimitMax: 1
}).listen(0, "127.0.0.1");
t.after(() => server.close());
await new Promise((resolve) => server.once("listening", resolve));
const endpoint = `http://127.0.0.1:${server.address().port}/code/bingshuo/repo/src/commit/deadbeef/file`;
const headers = { "x-forwarded-for": "198.51.100.2, 203.0.113.20" };
assert.equal((await fetch(endpoint, { headers })).status, 200);
assert.equal((await fetch(endpoint, { headers })).status, 429);
});
test("JD hub exposes only a categorized candidate failure", async (t) => {
const upstream = http.createServer((_request, response) => {
response.writeHead(200, { "content-type": "application/json" });