lyra
5563999525
Sync GitHub / sync (push) Successful in 8s
Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.
30 lines
1.0 KiB
YAML
30 lines
1.0 KiB
YAML
framework:
|
|
rate_limiter:
|
|
burst:
|
|
policy: 'sliding_window'
|
|
limit: '%env(int:BURST_COUNT)%'
|
|
interval: '%env(int:BURST_TIME)% seconds'
|
|
cache_pool: 'rateLimitCache'
|
|
upper:
|
|
policy: 'sliding_window'
|
|
limit: '%env(int:UPPER_COUNT)%'
|
|
interval: '%env(int:UPPER_TIME)% seconds'
|
|
cache_pool: 'rateLimitCache'
|
|
login_limiter:
|
|
policy: compound
|
|
limiters: [burst, upper]
|
|
|
|
public_burst:
|
|
policy: 'sliding_window'
|
|
limit: '%env(int:PUBLIC_BURST_COUNT)%'
|
|
interval: '%env(int:PUBLIC_BURST_TIME)% seconds'
|
|
cache_pool: 'publicRateLimitCache'
|
|
public_upper:
|
|
policy: 'sliding_window'
|
|
limit: '%env(int:PUBLIC_UPPER_COUNT)%'
|
|
interval: '%env(int:PUBLIC_UPPER_TIME)% seconds'
|
|
cache_pool: 'publicRateLimitCache'
|
|
public_limiter:
|
|
policy: compound
|
|
limiters: [public_burst, public_upper]
|