feat: Rate limiter on requests and login attempts.

server/src/loaders/dependencyInjector.ts

@@ -7,6 +7,8 @@ import dbManagerFactory from 'loaders/dbManager';
 import i18n from 'loaders/i18n';
 import repositoriesLoader from 'loaders/systemRepositories';
 import Cache from 'services/Cache';
+import redisLoader from './redisLoader';
+import rateLimiterLoaders from './rateLimiterLoader';
 
 export default ({ mongoConnection, knex }) => {
   try {
@@ -42,6 +44,9 @@ export default ({ mongoConnection, knex }) => {
     Container.set('repositories', repositoriesLoader());
     LoggerInstance.info('[DI] repositories has been injected into container');
 
+    rateLimiterLoaders();
+    LoggerInstance.info('[DI] rate limiter has been injected into container.');
+
     return { agenda: agendaInstance };
   } catch (e) {
     LoggerInstance.error('Error on dependency injector loader: %o', e);

server/src/loaders/express.ts

@@ -8,6 +8,7 @@ import routes from 'api';
 import LoggerMiddleware from 'api/middleware/LoggerMiddleware';
 import AgendashController from 'api/controllers/Agendash';
 import ConvertEmptyStringsToNull from 'api/middleware/ConvertEmptyStringsToNull';
+import RateLimiterMiddleware from 'api/middleware/RateLimiterMiddleware'
 import config from 'config';
 
 export default ({ app }) => {
@@ -41,6 +42,7 @@ export default ({ app }) => {
   app.use(ConvertEmptyStringsToNull);
 
   // Prefix all application routes.
+  app.use(config.api.prefix, RateLimiterMiddleware)
   app.use(config.api.prefix, routes());
 
   // Agendash application load.

server/src/loaders/rateLimiterLoader.ts

@@ -0,0 +1,24 @@
+import RateLimiter from 'services/Authentication/RateLimiter';
+import { Container } from 'typedi';
+import { RateLimiterMemory } from 'rate-limiter-flexible';
+import config from 'config';
+
+export default () => {
+  const rateLimiterRequestsMemory = new RateLimiterMemory({
+    points: config.throttler.requests.points,
+    duration: config.throttler.requests.duration,
+    blockDuration: config.throttler.requests.blockDuration,
+  });
+  const rateLimiterMemoryLogin = new RateLimiterMemory({
+    points: config.throttler.login.points,
+    duration: config.throttler.login.duration,
+    blockDuration: config.throttler.login.blockDuration,
+  });
+
+  const rateLimiterRequest = new RateLimiter(rateLimiterRequestsMemory);
+  const rateLimiterLogin = new RateLimiter(rateLimiterMemoryLogin)
+
+  // Inject the rate limiter of the global requests and login into the container.
+  Container.set('rateLimiter.request', rateLimiterRequest);
+  Container.set('rateLimiter.login', rateLimiterLogin);
+};