feat: introdotti limiti API distinti per autenticati e non autenticati con chiavi dedicate

Author: lucasalva87

api/index.php

@@ -40,12 +40,7 @@ function serverError()
 
 // Rate limiting per API (se abilitato)
 if (($config['rate_limiting']['enabled'] ?? false)) {
-    [$ok, $retry] = \Security\LaravelRateLimiter::enforce('api', $config, [
-        'key_parts' => [
-            'resource' => get('resource'),
-            'token' => get('token'),
-        ],
-    ]);
+    [$ok] = \Security\LaravelRateLimiter::enforce('api', $config);
     if (!$ok) {
         http_response_code(429);
         exit('Too Many Requests');

config.example.php

@@ -78,9 +78,12 @@
 $rate_limiting = [
     'enabled' => false,
     'store_path' => __DIR__.'/files/cache/ratelimiter',
-    'strategy' => 'user', // 'user' | 'ip' | 'ip_user'
+    // Limiti distinti per autenticati e non autenticati
     'limits' => [
-        'api' => ['max' => 60, 'decay' => 60],
+        'api' => [
+            'authenticated' => ['max' => 300, 'decay' => 60],
+            'unauthenticated' => ['max' => 60, 'decay' => 300],
+        ],
     ],
     'whitelist_ips' => [],
     'blacklist_ips' => [],

src/Security/LaravelRateLimiter.php

@@ -77,17 +77,14 @@ class_exists('Illuminate\\Filesystem\\Filesystem')
     }
 
     /**
-     * Costruisce chiave, limiti e percorso store.
+     * Costruisce chiave, limiti e percorso store (schema authenticated/unauthenticated).
      */
     private static function buildKeyAndLimits(string $area, array $cfg, string $ip, array $opts): array
     {
-        $limits = (array)($cfg['limits'][$area] ?? []);
-        $max   = (int)($limits['max'] ?? 60);
-        $decay = (int)($limits['decay'] ?? 60);
 
-        // Strategia chiave: 'user' | 'ip' | 'ip_user'
-        $strategy = (string)($cfg['strategy'] ?? 'user');
+        $__unused = $opts; unset($__unused);
 
+        // Determina utente autenticato (se presente)
         $userId = null;
         if (class_exists('Auth')) {
             try {
@@ -100,25 +97,19 @@ private static function buildKeyAndLimits(string $area, array $cfg, string $ip,
             }
         }
 
-        $idParts = [$area, $strategy];
-        if ($strategy === 'user') {
-            $idParts[] = $userId ?: ('ip:'.$ip);
-        } elseif ($strategy === 'ip') {
-            $idParts[] = 'ip:'.$ip;
-        } else { // ip_user
-            $idParts[] = 'u:'.($userId ?? 0);
-            $idParts[] = 'ip:'.$ip;
+        $limitsArea = (array)($cfg['limits'][$area] ?? []);
+
+        // Limiti distinti per authenticated/unauthenticated
+        if ($userId) {
+            $max   = (int)($limitsArea['authenticated']['max'] ?? 300);
+            $decay = (int)($limitsArea['authenticated']['decay'] ?? 60);
+            $key   = 'osm:rate:'.$area.':user:'.$userId;
+        } else {
+            $max   = (int)($limitsArea['unauthenticated']['max'] ?? 60);
+            $decay = (int)($limitsArea['unauthenticated']['decay'] ?? 300);
+            $key   = 'osm:rate:'.$area.':ip:'.$ip;
         }
 
-        // Ulteriori parti opzionali di chiave (per granularità)
-        foreach ((array)($opts['key_parts'] ?? []) as $k => $v) {
-            if (!empty($v)) {
-                $idParts[] = $k.':'.$v;
-            }
-        }
-
-        $key = 'osm:rate:'.sha1(implode('|', $idParts));
-
         $storePath = (string)($cfg['store_path'] ?? (function_exists('base_dir') ? base_dir().'/files/cache/ratelimiter' : __DIR__.'/../../files/cache/ratelimiter'));
 
         return [$key, $max, $decay, $storePath];