glenn
/
asteroid
mirror of https://github.com/glenneth1/asteroid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace r-simple-rate monkey-patches with fixed-window-check 

The previous approach overrode simple-rate::tax-rate and rate:left
directly, but Radiance reloads r-simple-rate at startup and clobbers
the overrides.  New approach: define-page-with-limit and
define-api-with-limit now call fixed-window-check directly, bypassing
rate:with-limitation entirely.  The fixed-window logic is self-contained
and immune to module reload ordering.
This commit is contained in:
Glenn Thompson 2026-04-09 08:04:26 +01:00
parent 91686cd0cc
commit 76d331248b
1 changed files with 64 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
limiter.lisp
View File

@ -1,10 +1,10 @@
;;;; limiter.lisp - Rate limiter definitions for the application ;;;; limiter.lisp - Rate limiter definitions for the application
;;;; ;;;;
;;;; Includes monkey-patches for r-simple-rate's sliding-window bug: ;;;; Replaces r-simple-rate's with-limitation with a fixed-window
;;;; upstream tax-rate updates the timestamp on EVERY request, which ;;;; implementation. The upstream tax-rate updates the timestamp on
;;;; prevents the window from ever resetting while polling is active. ;;;; EVERY request, preventing the window from ever resetting while
;;;; Our overrides use a proper fixed window — the timestamp is only ;;;; polling is active. Our define-*-with-limit macros bypass
;;;; updated when the window expires and the counter resets. ;;;; rate:with-limitation entirely and call fixed-window-check instead.
(in-package :asteroid) (in-package :asteroid)
@ -21,55 +21,49 @@
(error (e) (error (e)
(l:warn :rate-limiter "Failed to cleanup rate limits: ~a" e)))) (l:warn :rate-limiter "Failed to cleanup rate limits: ~a" e))))
;;; ——— r-simple-rate fixed-window overrides ——— ;;; ——— Fixed-window rate limiter ———
;;;
;;; r-simple-rate has a sliding-window bug: tax-rate updates the timestamp
;;; on every request, so the window never resets while polling is active.
;;; Rather than monkey-patching (Radiance may reload the module and clobber
;;; our overrides), we implement our own fixed-window logic directly.
(defun simple-rate::tax-rate (limit &key (ip (remote *request*))) (defun fixed-window-check (limit-name max-requests timeout-seconds)
"Fixed-window version of tax-rate. "Check and tax a fixed-window rate limit. Returns T if the request
Only updates the timestamp when the window resets, not on every request. is allowed, or (VALUES NIL seconds-remaining) if rate-limited.
This prevents the sliding-window bug where continuous polling starves LIMIT-NAME is a string key, MAX-REQUESTS and TIMEOUT-SECONDS are integers.
the counter because the reset condition never triggers." Uses the SIMPLE-RATE/TRACKING table for storage."
(let* ((limit (simple-rate::limit limit)) (let* ((ip (remote *request*))
(tracking (dm:get-one 'simple-rate::tracking (tracking (dm:get-one 'simple-rate::tracking
(db:query (:and (:= 'limit (simple-rate::name limit)) (db:query (:and (:= 'limit limit-name)
(:= 'ip ip)))))) (:= 'ip ip)))))
(cond (tracking (now (get-universal-time)))
;; If the window has expired, reset counter AND timestamp (cond
(when (<= (+ (dm:field tracking "time") ;; Existing entry
(simple-rate::timeout limit)) (tracking
(get-universal-time)) (let ((window-end (+ (dm:field tracking "time") timeout-seconds)))
(setf (dm:field tracking "amount") (simple-rate::amount limit)) (when (<= window-end now)
(setf (dm:field tracking "time") (get-universal-time))) ;; Window expired — reset counter and start new window
;; Tax it (do NOT touch timestamp here — fixed window) (setf (dm:field tracking "amount") max-requests)
(setf (dm:field tracking "time") now)
(setf window-end (+ now timeout-seconds)))
;; Check budget
(if (<= (dm:field tracking "amount") 0)
;; Exhausted — report time remaining
(values nil (- window-end now))
;; Allowed — decrement and save
(progn
(decf (dm:field tracking "amount")) (decf (dm:field tracking "amount"))
(dm:save tracking)) (dm:save tracking)
t))))
;; First request ever from this IP for this limit
(t (t
(db:insert 'simple-rate::tracking (db:insert 'simple-rate::tracking
`((limit . ,(simple-rate::name limit)) `((limit . ,limit-name)
(time . ,(get-universal-time)) (time . ,now)
(amount . ,(simple-rate::amount limit)) (amount . ,(1- max-requests))
(ip . ,ip))))))) (ip . ,ip)))
t))))
(defun rate:left (limit &key (ip (remote *request*)))
"Fixed-window version of rate:left.
Returns correct remaining amount even for expired windows, so that
with-limitation does not block on stale tracking entries."
(let* ((limit (simple-rate::limit limit))
(tracking (dm:get-one 'simple-rate::tracking
(db:query (:and (:= 'limit (simple-rate::name limit))
(:= 'ip ip))))))
(if tracking
(let ((window-end (+ (dm:field tracking "time")
(simple-rate::timeout limit)))
(now (get-universal-time)))
(if (<= window-end now)
;; Window expired — report full budget
(values (simple-rate::amount limit) 0)
;; Window still active
(values (dm:field tracking "amount")
(- window-end now))))
;; No tracking entry yet — full budget
(values (simple-rate::amount limit)
(simple-rate::timeout limit)))))
(define-trigger db:connected () (define-trigger db:connected ()
"Clean up any corrupted rate limit entries on startup" "Clean up any corrupted rate limit entries on startup"
@ -99,31 +93,31 @@
(defmacro define-page-with-limit (name uri options &body body) (defmacro define-page-with-limit (name uri options &body body)
"Rate limit for a page route. Defaults to 30 requests per minute." "Rate limit for a page route. Defaults to 30 requests per minute.
Uses fixed-window rate limiting (not r-simple-rate's sliding window)."
(multiple-value-bind (limit timeout group rest) (extract-limit-options options) (multiple-value-bind (limit timeout group rest) (extract-limit-options options)
(let* ((limit-name (string-upcase (format nil "~a-route-limit" (or group name)))) (let* ((limit-name (string-upcase (format nil "~a-route-limit" (or group name))))
(limit-sym (intern limit-name))
(limit (or limit 30)) (limit (or limit 30))
(timeout (or timeout 60))) (timeout (or timeout 60)))
`(eval-when (:compile-toplevel :load-toplevel :execute) `(define-page ,name ,uri ,rest
(rate:define-limit ,limit-sym (time-left :limit ,limit :timeout ,timeout) (multiple-value-bind (allowed time-left)
;; (format t "Route limit '~a' hit. Wait ~a seconds and retry.~%" ,(string name) time-left) (fixed-window-check ,limit-name ,limit ,timeout)
(render-rate-limit-error-page)) (declare (ignorable time-left))
(define-page ,name ,uri ,rest (if allowed
(rate:with-limitation (,limit-sym) (progn ,@body)
,@body)))))) (render-rate-limit-error-page)))))))
(defmacro define-api-with-limit (name args options &body body) (defmacro define-api-with-limit (name args options &body body)
"Rate limit for api routes. Defaults to 60 requests per minute." "Rate limit for api routes. Defaults to 60 requests per minute.
Uses fixed-window rate limiting (not r-simple-rate's sliding window)."
(multiple-value-bind (limit timeout group rest) (extract-limit-options options) (multiple-value-bind (limit timeout group rest) (extract-limit-options options)
(let* ((limit-name (string-upcase (format nil "~a-api-limit" (or group name)))) (let* ((limit-name (string-upcase (format nil "~a-api-limit" (or group name))))
(limit-sym (intern limit-name))
(limit (or limit 60)) (limit (or limit 60))
(timeout (or timeout 60))) (timeout (or timeout 60)))
`(eval-when (:compile-toplevel :load-toplevel :execute) `(define-api ,name ,args ,rest
(rate:define-limit ,limit-sym (time-left :limit ,limit :timeout ,timeout) (multiple-value-bind (allowed time-left)
;; (format t "API Rate limit '~a' hit. Wait ~a seconds and retry.~%" ,(string name) time-left) (fixed-window-check ,limit-name ,limit ,timeout)
(api-limit-error-output)) (declare (ignorable time-left))
(define-api ,name ,args ,rest (if allowed
(rate:with-limitation (,limit-sym) (progn ,@body)
,@body)))))) (api-limit-error-output)))))))