feat(request): Add RateLimit and RateLimit-Policy headersfeat/noid/ratelimit-header

Signed-off-by: Joas Schilling <coding@schilljs.com>

1 files changed, 27 insertions, 3 deletions

diff --git a/lib/private/AppFramework/Middleware/Security/RateLimitingMiddleware.php b/lib/private/AppFramework/Middleware/Security/RateLimitingMiddleware.php
index 6f84a0c94d0..21b55cd6450 100644
--- a/lib/private/AppFramework/Middleware/Security/RateLimitingMiddleware.php
+++ b/lib/private/AppFramework/Middleware/Security/RateLimitingMiddleware.php
@@ -65,6 +65,10 @@ use ReflectionMethod;
  * @package OC\AppFramework\Middleware\Security
  */
 class RateLimitingMiddleware extends Middleware {
+	protected int $limit;
+	protected int $period;
+	protected int $attempts;
+
 	public function __construct(
 		protected IRequest $request,
 		protected IUserSession $userSession,
@@ -85,7 +89,9 @@ class RateLimitingMiddleware extends Middleware {
 			$rateLimit = $this->readLimitFromAnnotationOrAttribute($controller, $methodName, 'UserRateThrottle', UserRateLimit::class);
 
 			if ($rateLimit !== null) {
-				$this->limiter->registerUserRequest(
+				$this->limit = $rateLimit->getLimit();
+				$this->period = $rateLimit->getPeriod();
+				$this->attempts = $this->limiter->registerUserRequest(
 					$rateLimitIdentifier,
 					$rateLimit->getLimit(),
 					$rateLimit->getPeriod(),
@@ -100,7 +106,9 @@ class RateLimitingMiddleware extends Middleware {
 		$rateLimit = $this->readLimitFromAnnotationOrAttribute($controller, $methodName, 'AnonRateThrottle', AnonRateLimit::class);
 
 		if ($rateLimit !== null) {
-			$this->limiter->registerAnonRequest(
+			$this->limit = $rateLimit->getLimit();
+			$this->period = $rateLimit->getPeriod();
+			$this->attempts = $this->limiter->registerAnonRequest(
 				$rateLimitIdentifier,
 				$rateLimit->getLimit(),
 				$rateLimit->getPeriod(),
@@ -143,6 +151,17 @@ class RateLimitingMiddleware extends Middleware {
 	/**
 	 * {@inheritDoc}
 	 */
+	public function afterController(Controller $controller, string $methodName, Response $response): Response {
+		$response->setHeaders([
+			'RateLimit' => 'limit=' . $this->limit . ', remaining=' . max(0, $this->limit - $this->attempts) . ', reset=' . $this->period,
+			'RateLimit-Policy' => $this->limit . ';w=' . $this->period,
+		]);
+		return $response;
+	}
+
+	/**
+	 * {@inheritDoc}
+	 */
 	public function afterException(Controller $controller, string $methodName, \Exception $exception): Response {
 		if ($exception instanceof RateLimitExceededException) {
 			if (stripos($this->request->getHeader('Accept'), 'html') === false) {
@@ -154,9 +173,14 @@ class RateLimitingMiddleware extends Middleware {
 					[],
 					TemplateResponse::RENDER_AS_GUEST
 				);
-				$response->setStatus($exception->getCode());
 			}
 
+			$response->setStatus($exception->getCode());
+			$response->setHeaders([
+				'RateLimit' => 'limit=' . $this->limit . ', remaining=' . max(0, $this->limit - $this->attempts) . ', reset=' . $this->period,
+				'RateLimit-Policy' => $this->limit . ';w=' . $this->period,
+			]);
+
 			return $response;
 		}