[feature] add rate limit middleware (#741)

* feat: add rate limit middleware

* chore: update vendor dir

* chore: update readme with new dependency

* chore: add rate limit infos to swagger.md file

* refactor: add ipv6 mask limiter option

Add IPv6 CIDR /64 mask

* refactor: increase rate limit to 1000

Address https://github.com/superseriousbusiness/gotosocial/pull/741#discussion_r945584800

Co-authored-by: tobi <31960611+tsmethurst@users.noreply.github.com>

2 files changed, 136 insertions, 0 deletions

diff --git a/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/middleware.go b/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/middleware.go
new file mode 100644
index 000000000..23bad417a
--- /dev/null
+++ b/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/middleware.go
@@ -0,0 +1,65 @@
+package gin
+
+import (
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/ulule/limiter/v3"
+)
+
+// Middleware is the middleware for gin.
+type Middleware struct {
+	Limiter        *limiter.Limiter
+	OnError        ErrorHandler
+	OnLimitReached LimitReachedHandler
+	KeyGetter      KeyGetter
+	ExcludedKey    func(string) bool
+}
+
+// NewMiddleware return a new instance of a gin middleware.
+func NewMiddleware(limiter *limiter.Limiter, options ...Option) gin.HandlerFunc {
+	middleware := &Middleware{
+		Limiter:        limiter,
+		OnError:        DefaultErrorHandler,
+		OnLimitReached: DefaultLimitReachedHandler,
+		KeyGetter:      DefaultKeyGetter,
+		ExcludedKey:    nil,
+	}
+
+	for _, option := range options {
+		option.apply(middleware)
+	}
+
+	return func(ctx *gin.Context) {
+		middleware.Handle(ctx)
+	}
+}
+
+// Handle gin request.
+func (middleware *Middleware) Handle(c *gin.Context) {
+	key := middleware.KeyGetter(c)
+	if middleware.ExcludedKey != nil && middleware.ExcludedKey(key) {
+		c.Next()
+		return
+	}
+
+	context, err := middleware.Limiter.Get(c, key)
+	if err != nil {
+		middleware.OnError(c, err)
+		c.Abort()
+		return
+	}
+
+	c.Header("X-RateLimit-Limit", strconv.FormatInt(context.Limit, 10))
+	c.Header("X-RateLimit-Remaining", strconv.FormatInt(context.Remaining, 10))
+	c.Header("X-RateLimit-Reset", strconv.FormatInt(context.Reset, 10))
+
+	if context.Reached {
+		middleware.OnLimitReached(c)
+		c.Abort()
+		return
+	}
+
+	c.Next()
+}
diff --git a/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/options.go b/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/options.go
new file mode 100644
index 000000000..604c6bc68
--- /dev/null
+++ b/vendor/github.com/ulule/limiter/v3/drivers/middleware/gin/options.go
@@ -0,0 +1,71 @@
+package gin
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Option is used to define Middleware configuration.
+type Option interface {
+	apply(*Middleware)
+}
+
+type option func(*Middleware)
+
+func (o option) apply(middleware *Middleware) {
+	o(middleware)
+}
+
+// ErrorHandler is an handler used to inform when an error has occurred.
+type ErrorHandler func(c *gin.Context, err error)
+
+// WithErrorHandler will configure the Middleware to use the given ErrorHandler.
+func WithErrorHandler(handler ErrorHandler) Option {
+	return option(func(middleware *Middleware) {
+		middleware.OnError = handler
+	})
+}
+
+// DefaultErrorHandler is the default ErrorHandler used by a new Middleware.
+func DefaultErrorHandler(c *gin.Context, err error) {
+	panic(err)
+}
+
+// LimitReachedHandler is an handler used to inform when the limit has exceeded.
+type LimitReachedHandler func(c *gin.Context)
+
+// WithLimitReachedHandler will configure the Middleware to use the given LimitReachedHandler.
+func WithLimitReachedHandler(handler LimitReachedHandler) Option {
+	return option(func(middleware *Middleware) {
+		middleware.OnLimitReached = handler
+	})
+}
+
+// DefaultLimitReachedHandler is the default LimitReachedHandler used by a new Middleware.
+func DefaultLimitReachedHandler(c *gin.Context) {
+	c.String(http.StatusTooManyRequests, "Limit exceeded")
+}
+
+// KeyGetter will define the rate limiter key given the gin Context.
+type KeyGetter func(c *gin.Context) string
+
+// WithKeyGetter will configure the Middleware to use the given KeyGetter.
+func WithKeyGetter(handler KeyGetter) Option {
+	return option(func(middleware *Middleware) {
+		middleware.KeyGetter = handler
+	})
+}
+
+// DefaultKeyGetter is the default KeyGetter used by a new Middleware.
+// It returns the Client IP address.
+func DefaultKeyGetter(c *gin.Context) string {
+	return c.ClientIP()
+}
+
+// WithExcludedKey will configure the Middleware to ignore key(s) using the given function.
+func WithExcludedKey(handler func(string) bool) Option {
+	return option(func(middleware *Middleware) {
+		middleware.ExcludedKey = handler
+	})
+}