lyra
5563999525
Sync GitHub / sync (push) Successful in 8s
Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.
32 lines
961 B
PHP
32 lines
961 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Service;
|
|
|
|
/**
|
|
* Matches request paths against configured public path patterns.
|
|
*
|
|
* Patterns support simple wildcards:
|
|
* - `*` matches any characters within a single path segment (not crossing `/`)
|
|
* - `**` matches any characters including `/` (crosses path segments)
|
|
*
|
|
* Patterns may optionally include a host prefix (e.g. `example.com/public/**`).
|
|
* When no host prefix is given, the pattern matches on any host.
|
|
*/
|
|
interface PublicPathMatcherInterface
|
|
{
|
|
/**
|
|
* Returns true if the given host and path match any configured public pattern.
|
|
*
|
|
* @param string $host The request host (e.g. "code.example.com")
|
|
* @param string $path The request path (e.g. "/public/repo/issues")
|
|
*/
|
|
public function matches(string $host, string $path): bool;
|
|
|
|
/**
|
|
* Returns true if no public paths are configured (feature is disabled).
|
|
*/
|
|
public function isEmpty(): bool;
|
|
}
|