Merge branch 'dev' of bitbucket.org:jubilian/nhance-enrollment into dev

app/Config/Filters.php

@@ -19,6 +19,7 @@ use App\Filters\Cors;
 use App\Filters\GlobalPostFileUploadGuard;
 use App\Filters\SecurityInputFilter;
 use App\Filters\AclFilter;
+use App\Filters\RateLimitFilter;
 
 
 
@@ -47,6 +48,7 @@ class Filters extends BaseConfig
         'GlobalPostFileUploadGuard'       => GlobalPostFileUploadGuard::class,
         'SecurityInputFilter'       => SecurityInputFilter::class,
         'AclFilter'       => AclFilter::class,
+        'ratelimit' => RateLimitFilter::class,
         
     ];
 

app/Config/Routes.php

@@ -442,7 +442,7 @@ $routes->cli('cli/check_env', 'MasterController::checkEnv');
 
 
 
-$routes->group("/api", ["filter" => "authJWT"], function ($routes) {
+$routes->group("/api", ["filter" => [ 'ratelimit'  , 'authJWT' ] ], function ($routes) {
     $routes->post("logined", "RestAuthenticationController::logined");
     $routes->post("getId", "RestAuthenticationController::getUserIdFromToken");
 });
@@ -454,7 +454,7 @@ $routes->group("/api", ["filter" => "authJWT"], function ($routes) {
 // $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount");
 // $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium");
  // $routes->post("updateMpin", "RestAuthenticationController::updateMpin");
-$routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSignature' , 'authJWT'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => [ 'GlobalPostFileUploadGuard', 'ratelimit' , 'appSignature' , 'authJWT' ] ], function ($routes) {
 
     $routes->post('logout', 'RestAuthenticationController::logout');
 
@@ -507,7 +507,7 @@ $routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSi
 
 });
 
-$routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => ['ratelimit' , 'appSignature'] ], function ($routes) {
 
     //Employee login api's
     $routes->post("verifyEmployeeNumber", "RestAuthenticationController::verifyEmployeeWithMobileNumber");
@@ -540,7 +540,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route
 
 });
 
-$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['appSignature']]);
+$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['ratelimit','appSignature']]);
 
 $routes->get("getEmployeeActiveOrInactivePolicy", "EmployeeRestController::getEmployeeActiveOrInactivePolicy");
 $routes->get("sendPushNotification", "EmployeeRestController::sendPushNotification");

app/Filters/RateLimitFilter.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Filters;
+
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+use CodeIgniter\Filters\FilterInterface;
+
+class RateLimitFilter implements FilterInterface
+{
+
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        $throttler = service('throttler');
+
+        // sanitize IP for cache
+        $key = preg_replace('/[^a-zA-Z0-9_]/', '_', $request->getIPAddress());
+
+        if ($throttler->check($key, 25, MINUTE) === false) {
+            return service('response')
+                ->setStatusCode(429)
+                ->setJSON([
+                    'status'  => 'error',
+                    'message' => 'Too many requests. Try again later.'
+                ]);
+        }
+    }
+
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        // nothing
+    }
+}