From 0f733d4cc84281a7e49fd6e2fa314fabed1f11a7 Mon Sep 17 00:00:00 2001
From: Gowtham M <gowtham.m@venbainfotech.com>
Date: Sat, 7 Feb 2026 11:50:01 +0530
Subject: [PATCH] GWM : Api rate limit added

---
 app/Config/Filters.php          |  2 ++
 app/Config/Routes.php           |  8 ++++----
 app/Filters/RateLimitFilter.php | 34 +++++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 4 deletions(-)
 create mode 100644 app/Filters/RateLimitFilter.php

diff --git a/app/Config/Filters.php b/app/Config/Filters.php
index 9f28a05..0042bda 100755
--- a/app/Config/Filters.php
+++ b/app/Config/Filters.php
@@ -19,6 +19,7 @@ use App\Filters\Cors;
 use App\Filters\GlobalPostFileUploadGuard;
 use App\Filters\SecurityInputFilter;
 use App\Filters\AclFilter;
+use App\Filters\RateLimitFilter;
 
 
 
@@ -47,6 +48,7 @@ class Filters extends BaseConfig
         'GlobalPostFileUploadGuard'       => GlobalPostFileUploadGuard::class,
         'SecurityInputFilter'       => SecurityInputFilter::class,
         'AclFilter'       => AclFilter::class,
+        'ratelimit' => RateLimitFilter::class,
         
     ];
 
diff --git a/app/Config/Routes.php b/app/Config/Routes.php
index f61965e..a0eb3e0 100755
--- a/app/Config/Routes.php
+++ b/app/Config/Routes.php
@@ -442,7 +442,7 @@ $routes->cli('cli/check_env', 'MasterController::checkEnv');
 
 
 
-$routes->group("/api", ["filter" => "authJWT"], function ($routes) {
+$routes->group("/api", ["filter" => [ 'ratelimit'  , 'authJWT' ] ], function ($routes) {
     $routes->post("logined", "RestAuthenticationController::logined");
     $routes->post("getId", "RestAuthenticationController::getUserIdFromToken");
 });
@@ -454,7 +454,7 @@ $routes->group("/api", ["filter" => "authJWT"], function ($routes) {
 // $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount");
 // $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium");
  // $routes->post("updateMpin", "RestAuthenticationController::updateMpin");
-$routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSignature' , 'authJWT'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => [ 'GlobalPostFileUploadGuard', 'ratelimit' , 'appSignature' , 'authJWT' ] ], function ($routes) {
 
     $routes->post('logout', 'RestAuthenticationController::logout');
 
@@ -507,7 +507,7 @@ $routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSi
 
 });
 
-$routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => ['ratelimit' , 'appSignature'] ], function ($routes) {
 
     //Employee login api's
     $routes->post("verifyEmployeeNumber", "RestAuthenticationController::verifyEmployeeWithMobileNumber");
@@ -540,7 +540,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route
 
 });
 
-$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['appSignature']]);
+$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['ratelimit','appSignature']]);
 
 $routes->get("getEmployeeActiveOrInactivePolicy", "EmployeeRestController::getEmployeeActiveOrInactivePolicy");
 $routes->get("sendPushNotification", "EmployeeRestController::sendPushNotification");
diff --git a/app/Filters/RateLimitFilter.php b/app/Filters/RateLimitFilter.php
new file mode 100644
index 0000000..31efe81
--- /dev/null
+++ b/app/Filters/RateLimitFilter.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Filters;
+
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+use CodeIgniter\Filters\FilterInterface;
+
+class RateLimitFilter implements FilterInterface
+{
+
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        $throttler = service('throttler');
+
+        // sanitize IP for cache
+        $key = preg_replace('/[^a-zA-Z0-9_]/', '_', $request->getIPAddress());
+
+        if ($throttler->check($key, 25, MINUTE) === false) {
+            return service('response')
+                ->setStatusCode(429)
+                ->setJSON([
+                    'status'  => 'error',
+                    'message' => 'Too many requests. Try again later.'
+                ]);
+        }
+    }
+
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        // nothing
+    }
+}