feat: adds rate limiter middleware

acceptance/compose.yaml

@@ -26,6 +26,7 @@ services:
     - PG_HOST=database
     - SUPER_USER_PASSWORD=sourcescore
     - API_KEY=test-key
+    - RATE_LIMIT_DISABLED=true
     ports:
     - "8080:8080"
   adminer:

api/source-score.yaml

@@ -9,17 +9,17 @@ servers:
     description: Current host
 
 paths:
-  /ping:
-    get:
-      summary: Health check endpoint
-      description: Returns a simple pong response to verify the service is running
-      responses:
-        200:
-          description: Service is healthy
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Pong'
+  # /ping:
+  #   get:
+  #     summary: Health check endpoint
+  #     description: Returns a simple pong response to verify the service is running
+  #     responses:
+  #       200:
+  #         description: Service is healthy
+  #         content:
+  #           application/json:
+  #             schema:
+  #               $ref: '#/components/schemas/Pong'
 
   /api/v1/sources:
     get:
@@ -404,15 +404,15 @@ paths:
 
 components:
   schemas:
-    Pong:
-      type: object
-      required:
-      - pong
-      properties:
-        pong:
-          type: string
-          example: pong
-          description: Simple response string to confirm service health
+    # Pong:
+    #   type: object
+    #   required:
+    #   - pong
+    #   properties:
+    #     pong:
+    #       type: string
+    #       example: pong
+    #       description: Simple response string to confirm service health
 
     SourceInput:
       type: object

cmd/app/main.go

@@ -35,8 +35,8 @@ func main() {
 		}),
 	)
 
-	// initialize the server
-	loggerOpts := api.GinServerOptions{
+	// initialize the logger middleware
+	serverOpts := api.GinServerOptions{
 		Middlewares: []api.MiddlewareFunc{
 			// function to add request headers to log fields
 			func(c *gin.Context) {
@@ -75,23 +75,35 @@ func main() {
 
 	server := gin.Default()
 
+	// Register liveness route
+	pingHandler := handlers.NewPingHandler()
+	server.GET("/ping", pingHandler.GetPing)
+
+	// Register Swagger UI routes
+	swaggerHandler := handlers.NewSwaggerHandler(embed.OpenAPI)
+	server.GET("/swagger", swaggerHandler.ServeUI)
+	server.GET("/swagger/spec", swaggerHandler.ServeSpec)
+
+	// Apply rate limiter middleware (10 requests per second, burst 20)
+	if os.Getenv("RATE_LIMIT_DISABLED") != "true" {
+		slog.Info("Rate limiter enabled")
+		// server.Use(middleware.RateLimiterMiddleware(10, 20))
+		serverOpts.Middlewares = append(serverOpts.Middlewares, api.MiddlewareFunc(middleware.RateLimiterMiddleware(10, 20)))
+	}
+
 	// Secure with API key if the env var is set
 	if key, ok := os.LookupEnv("API_KEY"); ok {
 		slog.Info("API Key found, securing the API")
-		server.Use(middleware.APIKeyMiddleware(key))
+		// server.Use(middleware.APIKeyMiddleware(key))
+		serverOpts.Middlewares = append(serverOpts.Middlewares, api.MiddlewareFunc(middleware.APIKeyMiddleware(key)))
 	}
 
 	api.RegisterHandlersWithOptions(
 		server,
 		apiServer.NewRouter(context.Background(), srcSvc, claimSvc, proofSvc),
-		loggerOpts,
+		serverOpts,
 	)
 
-	// Register Swagger UI routes
-	swaggerHandler := handlers.NewSwaggerHandler(embed.OpenAPI)
-	server.GET("/swagger", swaggerHandler.ServeUI)
-	server.GET("/swagger/spec", swaggerHandler.ServeSpec)
-
 	err := server.Run()
 	if err != nil {
 		log.Fatalf("failed to start the server : %s\n", err.Error())

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/oapi-codegen/runtime v1.3.0
 	github.com/onsi/ginkgo/v2 v2.28.1
 	github.com/onsi/gomega v1.39.1
+	golang.org/x/time v0.15.0
 )
 
 require (

go.sum

@@ -989,6 +989,8 @@ golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=