QRLoginRateLimits.php — WooCommerce 10.9.4

woocommerce / src / Admin / API / RateLimits / QRLoginRateLimits.php

woocommerce / src / Admin / API / RateLimits Last commit date

QRLoginRateLimits.php

222 lines

1	<?php
2	/**
3	* Rate limiter for mobile app QR login endpoints.
4	*
5	* @package WooCommerce\Admin\API
6	*/
7
8	declare( strict_types=1 );
9
10	namespace Automattic\WooCommerce\Admin\API\RateLimits;
11
12	use Automattic\WooCommerce\Admin\API\MobileAppQRLogin;
13	use WC_Rate_Limiter;
14
15	defined( 'ABSPATH' ) \|\| exit;
16
17	/**
18	* Counter-based rate limiter for QR login endpoints.
19	*
20	* Uses WooCommerce's `wc_rate_limits` table and an atomic SQL upsert so
21	* concurrent requests cannot bypass a bucket by racing a transient get/set
22	* sequence.
23	*
24	* @internal
25	*/
26	class QRLoginRateLimits extends WC_Rate_Limiter {
27
28	/**
29	* Generation bucket.
30	*/
31	const BUCKET_GENERATION = 'gen';
32
33	/**
34	* Broad exchange-IP bucket.
35	*/
36	const BUCKET_EXCHANGE_IP = 'exc_ip';
37
38	/**
39	* Invalid-token exchange bucket.
40	*/
41	const BUCKET_INVALID_EXCHANGE = 'exc_invalid';
42
43	/**
44	* Invalid-token scan bucket.
45	*/
46	const BUCKET_INVALID_SCAN = 'scn_invalid';
47
48	/**
49	* Valid-token exchange bucket.
50	*/
51	const BUCKET_VALID_EXCHANGE = 'exc_token';
52
53	/**
54	* Status polling bucket.
55	*/
56	const BUCKET_STATUS = 'sta';
57
58	/**
59	* Revoke endpoint bucket.
60	*/
61	const BUCKET_REVOKE = 'rev';
62
63	/**
64	* Scan endpoint bucket.
65	*/
66	const BUCKET_SCAN = 'scn';
67
68	/**
69	* Approval endpoint bucket.
70	*/
71	const BUCKET_APPROVE = 'apr';
72
73	/**
74	* Session-status polling bucket.
75	*/
76	const BUCKET_SESSION_STATUS = 'ss';
77
78	/**
79	* Prefix for QR login rate-limit rows.
80	*/
81	const KEY_PREFIX = 'qr_login_';
82
83	/**
84	* Cache group.
85	*/
86	const CACHE_GROUP = 'wc_qr_login_rate_limit';
87
88	/**
89	* Build the persisted rate-limit action ID.
90	*
91	* @param string $bucket Bucket name.
92	* @param string $identifier Bucket identifier.
93	* @return string
94	*/
95	public static function get_action_id( string $bucket, string $identifier ): string {
96	$normalized_identifier = preg_replace( '/[^A-Za-z0-9:._-]/', '_', trim( $identifier ) );
97	$normalized_identifier = is_string( $normalized_identifier ) && '' !== $normalized_identifier
98	? $normalized_identifier
99	: 'unknown';
100
101	return substr( self::KEY_PREFIX . $bucket . '_' . $normalized_identifier, 0, 190 );
102	}
103
104	/**
105	* Consume one request from a bucket.
106	*
107	* @param string $bucket Bucket name.
108	* @param string $identifier Bucket identifier.
109	* @return bool True if the request is within the bucket limit.
110	*/
111	public static function consume( string $bucket, string $identifier ): bool {
112	global $wpdb;
113
114	$options = self::get_bucket_options( $bucket );
115	if ( null === $options ) {
116	return false;
117	}
118
119	$time = time();
120	$limit = max( 1, (int) $options['limit'] );
121	$rate_limit_expiry = $time + (int) $options['seconds'];
122	$action_id = self::get_action_id( $bucket, $identifier );
123
124	$result = $wpdb->query(
125	$wpdb->prepare(
126	"INSERT INTO {$wpdb->prefix}wc_rate_limits
127	(`rate_limit_key`, `rate_limit_expiry`, `rate_limit_remaining`)
128	VALUES
129	(%s, %d, %d)
130	ON DUPLICATE KEY UPDATE
131	`rate_limit_id` = IF(
132	`rate_limit_expiry` < %d OR `rate_limit_remaining` > 0,
133	LAST_INSERT_ID(`rate_limit_id`),
134	LAST_INSERT_ID(0) + `rate_limit_id`
135	),
136	`rate_limit_remaining` = IF(
137	`rate_limit_expiry` < %d,
138	VALUES(`rate_limit_remaining`),
139	IF(`rate_limit_remaining` > 0, `rate_limit_remaining` - 1, 0)
140	),
141	`rate_limit_expiry` = IF(`rate_limit_expiry` < %d, VALUES(`rate_limit_expiry`), `rate_limit_expiry`);
142	",
143	$action_id,
144	$rate_limit_expiry,
145	$limit - 1,
146	$time,
147	$time,
148	$time
149	)
150	);
151
152	if ( false === $result ) {
153	return false;
154	}
155
156	return (int) $wpdb->get_var( 'SELECT LAST_INSERT_ID()' ) > 0;
157	}
158
159	/**
160	* Get bucket options.
161	*
162	* @param string $bucket Bucket name.
163	* @return array{limit:int, seconds:int}\|null
164	*/
165	private static function get_bucket_options( string $bucket ): ?array {
166	switch ( $bucket ) {
167	case self::BUCKET_GENERATION:
168	return array(
169	'limit' => MobileAppQRLogin::MAX_TOKENS_PER_WINDOW,
170	'seconds' => 15 * MINUTE_IN_SECONDS,
171	);
172	case self::BUCKET_EXCHANGE_IP:
173	return array(
174	'limit' => MobileAppQRLogin::MAX_EXCHANGE_IP_ATTEMPTS,
175	'seconds' => 15 * MINUTE_IN_SECONDS,
176	);
177	case self::BUCKET_INVALID_EXCHANGE:
178	return array(
179	'limit' => MobileAppQRLogin::MAX_INVALID_EXCHANGE_ATTEMPTS,
180	'seconds' => 15 * MINUTE_IN_SECONDS,
181	);
182	case self::BUCKET_INVALID_SCAN:
183	return array(
184	'limit' => MobileAppQRLogin::MAX_INVALID_SCAN_ATTEMPTS,
185	'seconds' => 15 * MINUTE_IN_SECONDS,
186	);
187	case self::BUCKET_VALID_EXCHANGE:
188	return array(
189	'limit' => MobileAppQRLogin::MAX_EXCHANGE_ATTEMPTS,
190	'seconds' => 15 * MINUTE_IN_SECONDS,
191	);
192	case self::BUCKET_STATUS:
193	return array(
194	'limit' => MobileAppQRLogin::MAX_STATUS_CHECKS_PER_WINDOW,
195	'seconds' => 15 * MINUTE_IN_SECONDS,
196	);
197	case self::BUCKET_REVOKE:
198	return array(
199	'limit' => MobileAppQRLogin::MAX_REVOKE_ATTEMPTS,
200	'seconds' => 15 * MINUTE_IN_SECONDS,
201	);
202	case self::BUCKET_SCAN:
203	return array(
204	'limit' => MobileAppQRLogin::MAX_SCAN_PER_WINDOW,
205	'seconds' => 15 * MINUTE_IN_SECONDS,
206	);
207	case self::BUCKET_APPROVE:
208	return array(
209	'limit' => MobileAppQRLogin::MAX_APPROVE_PER_WINDOW,
210	'seconds' => 15 * MINUTE_IN_SECONDS,
211	);
212	case self::BUCKET_SESSION_STATUS:
213	return array(
214	'limit' => MobileAppQRLogin::MAX_SESSION_STATUS_PER_WINDOW,
215	'seconds' => 15 * MINUTE_IN_SECONDS,
216	);
217	}
218
219	return null;
220	}
221	}
222