Logan.LiandCursor
bac72e6945
废除浏览器回跳自助结算，通用 webhook 强制密钥鉴权，Waffo 支持验签与未知事件忽略；重构订单状态机/激活占座/SQLite WAL，并补备份、readyz、限流与前端导出/登录页安全修复。 Co-authored-by: Cursor <cursoragent@cursor.com>
58 lines
1.1 KiB
Go
58 lines
1.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"golang.org/x/time/rate"
|
|
)
|
|
|
|
type visitorEntry struct {
|
|
limiter *rate.Limiter
|
|
last time.Time
|
|
}
|
|
|
|
// RateLimit 按 ClientIP 的令牌桶限流中间件 // Logan.Li
|
|
func RateLimit(rps float64, burst int) gin.HandlerFunc {
|
|
var mu sync.Mutex
|
|
visitors := map[string]*visitorEntry{}
|
|
|
|
go func() {
|
|
ticker := time.NewTicker(5 * time.Minute)
|
|
defer ticker.Stop()
|
|
for range ticker.C {
|
|
mu.Lock()
|
|
cutoff := time.Now().Add(-10 * time.Minute)
|
|
for ip, e := range visitors {
|
|
if e.last.Before(cutoff) {
|
|
delete(visitors, ip)
|
|
}
|
|
}
|
|
mu.Unlock()
|
|
}
|
|
}()
|
|
|
|
return func(c *gin.Context) {
|
|
ip := c.ClientIP()
|
|
mu.Lock()
|
|
e, ok := visitors[ip]
|
|
if !ok {
|
|
e = &visitorEntry{limiter: rate.NewLimiter(rate.Limit(rps), burst)}
|
|
visitors[ip] = e
|
|
}
|
|
e.last = time.Now()
|
|
allow := e.limiter.Allow()
|
|
mu.Unlock()
|
|
if !allow {
|
|
c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{
|
|
"code": 429,
|
|
"message": "请求过于频繁，请稍后再试",
|
|
})
|
|
return
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|