056753e8cb
Phase 1 (tenant isolation):
- g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers.
- Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a
new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own).
- Fixed latent create_org double-id bug (dict id != store key).
- test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1
groups/users, sees only own org; super_admin sees all.
Phase 2 (hardening):
- Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost
and slow brute force; services/rate_limit.py (in-memory + disk, no external deps).
- Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export.
- CSV export now org-scoped (admin exports only own org).
All 8 backend suites pass.
65 lines
1.6 KiB
Python
65 lines
1.6 KiB
Python
"""Lightweight server-side rate limiter (no external deps).
|
|
|
|
Per-key (user/IP + action) sliding-window counter, persisted to disk so restarts
|
|
don't fully reset abuse protection. In-memory fast path + on-disk snapshot.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
import threading
|
|
import time
|
|
|
|
from ..config import Config
|
|
|
|
_lock = threading.Lock()
|
|
_mem: dict[str, list[float]] = {} # key -> list of recent timestamps
|
|
|
|
|
|
def _key(action: str, ident: str) -> str:
|
|
return f"{action}:{ident}"
|
|
|
|
|
|
def _load():
|
|
p = Config.DATA_DIR / "ratelimit.json"
|
|
try:
|
|
if p.exists():
|
|
with open(p, encoding="utf-8") as fh:
|
|
return json.load(fh)
|
|
except Exception:
|
|
pass
|
|
return {}
|
|
|
|
|
|
def _save():
|
|
try:
|
|
p = Config.DATA_DIR / "ratelimit.json"
|
|
p.parent.mkdir(parents=True, exist_ok=True)
|
|
tmp = p.with_suffix(".json.tmp")
|
|
with open(tmp, "w", encoding="utf-8") as fh:
|
|
json.dump(_mem, fh)
|
|
os.replace(tmp, p)
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
def check(action: str, ident: str, *, limit: int, window: int) -> bool:
|
|
"""Return True if allowed; False if the limit in `window` seconds was exceeded."""
|
|
key = _key(action, ident)
|
|
now = time.time()
|
|
with _lock:
|
|
rec = list(_mem.get(key) or _load().get(key) or [])
|
|
rec = [t for t in rec if now - t < window]
|
|
if len(rec) >= limit:
|
|
_mem[key] = rec
|
|
return False
|
|
rec.append(now)
|
|
_mem[key] = rec
|
|
# opportunistically persist (bounded writes)
|
|
try:
|
|
if int(now) % 5 == 0:
|
|
_save()
|
|
except Exception:
|
|
pass
|
|
return True
|