feat: add rate limiter

fiqrikm18 · fiqrikm18 · commit a920d07af1d5 · 2026-06-17T10:43:00.000+07:00
diff --git a/.env.example b/.env.example
@@ -1,9 +1,13 @@
 APP_NAME=Todo Modulith API
 
-DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/todo_db
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@127.0.0.1:5432/todo_db
+
+REDIS_URL=redis://:password@127.0.0.1:6379/0
 
 SECRET_KEY=your-super-secret-production-key-here
 
 ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=30
 REFRESH_TOKEN_EXPIRE_MINUTES=10080
+
+RATE_LIMIT="100/minute" 
diff --git a/alembic/env.py b/alembic/env.py
@@ -7,7 +7,6 @@
 from sqlalchemy.ext.asyncio import async_engine_from_config
 
 from alembic import context
-from src.core.config.setting import settings
 from src.core.authorization.infrastructure.models.casbin_rule_model import (
     CasbinRuleModel,  # noqa: F401
 )
@@ -23,13 +22,16 @@
 from src.core.authorization.infrastructure.models.user_has_role_model import (
     UserHasRoleModel,  # noqa: F401
 )
+from src.core.config.setting import get_settings
 from src.modules.todo.infrastructure.models.todo_model import TodoModel  # noqa: F401
 from src.modules.user.infrastructure.models.refresh_token_model import (
     RefreshTokenModel,  # noqa: F401
 )
 from src.modules.user.infrastructure.models.user_model import UserModel  # noqa: F401
 from src.shared.database.model import Base
 
+settings = get_settings()
+
 print(
     "🔍 ALEMBIC DEBUG: Tables found in metadata ->", list(Base.metadata.tables.keys())
 )
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -5,7 +5,7 @@ description = ""
 authors = [
     {name = "fiqri khoirul m",email = "fiqrikm18@gmail.com"}
 ]
-requires-python = ">=3.14"
+requires-python = ">=3.14,<4.0"
 dependencies = [
     "fastapi (>=0.137.1,<0.138.0)",
     "uvicorn[standard] (>=0.49.0,<0.50.0)",
@@ -17,7 +17,9 @@ dependencies = [
     "python-jose[cryptography] (>=3.5.0,<4.0.0)",
     "python-multipart (>=0.0.32,<0.0.33)",
     "greenlet (>=3.5.1,<4.0.0)",
-    "casbin (>=1.43.0,<2.0.0)"
+    "casbin (>=1.43.0,<2.0.0)",
+    "fastapi-limiter (==0.1.6)",
+    "redis (>=8.0.0,<9.0.0)"
 ]
 
 [tool.poetry]
diff --git a/src/core/authorization/dependencies.py b/src/core/authorization/dependencies.py
@@ -10,8 +10,8 @@
 from src.core.authorization.infrastructure.services.casbin_authorization_service import (
     CasbinAuthorizationService,
 )
-from src.core.database.session import get_db
-from src.core.di import get_current_user
+from src.core.database.postgres.session import get_db
+from src.core.dependency.auth import get_current_user
 
 
 def get_authorization_service(
diff --git a/src/core/config/setting.py b/src/core/config/setting.py
@@ -1,16 +1,22 @@
+from functools import lru_cache
+
 from pydantic_settings import BaseSettings
 
 
 class Settings(BaseSettings):
     APP_NAME: str = "Todo Modulith API"
     DATABASE_URL: str = "postgresql+asyncpg://user:password@localhost:5432/todo_db"
+    REDIS_URL: str = "redis://:eYVX7EwVmmxKPCDmwMtyKVge8oLd2t81@127.0.0.1:6379/0"
     SECRET_KEY: str = "super-secret-key-change-in-production"
     ALGORITHM: str = "HS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
     REFRESH_TOKEN_EXPIRE_MINUTES: int = 10080
+    RATE_LIMIT: str = "100/minute"
 
     class Config:
         env_file = ".env"
 
 
-settings = Settings()
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()
diff --git a/src/core/database/postgres/session.py b/src/core/database/postgres/session.py
@@ -3,10 +3,12 @@
 from fastapi import Depends
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
-from src.core.config.setting import settings
+from src.core.config.setting import get_settings
 from src.shared.database.unit_of_work import SQLAlchemyUnitOfWork
 from src.shared.unit_of_work import UnitOfWork
 
+settings = get_settings()
+
 engine = create_async_engine(settings.DATABASE_URL, echo=False, future=True)
 AsyncSessionLocal = async_sessionmaker(
     engine, class_=AsyncSession, expire_on_commit=False, autoflush=False
diff --git a/src/core/database/redis/client.py b/src/core/database/redis/client.py
@@ -0,0 +1,17 @@
+# src/core/rate_limiter.py
+import redis.asyncio as redis
+
+from src.core.config.setting import get_settings
+
+redis_client: redis.Redis | None = None
+
+settings = get_settings()
+
+
+async def get_redis_client() -> redis.Redis:
+    global redis_client
+    if redis_client is None:
+        redis_client = redis.from_url(
+            settings.REDIS_URL, encoding="utf-8", decode_responses=True
+        )
+    return redis_client
diff --git a/src/core/dependency/auth.py b/src/core/dependency/auth.py
@@ -4,7 +4,7 @@
 from fastapi.security import OAuth2PasswordBearer
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.core.database.session import get_db
+from src.core.database.postgres.session import get_db
 from src.modules.user.infrastructure.repositories.user_repository import (
     SQLAlchemyUserRepository,
 )
@@ -15,10 +15,6 @@
 )
 
 
-def get_db_session(db: AsyncSession = Depends(get_db)) -> AsyncSession:
-    return db
-
-
 async def get_current_user(
     request: Request,
     token: str = Depends(oauth2_scheme),
diff --git a/src/core/dependency/database.py b/src/core/dependency/database.py
@@ -0,0 +1,8 @@
+from fastapi import Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.core.database.postgres.session import get_db
+
+
+def get_db_session(db: AsyncSession = Depends(get_db)) -> AsyncSession:
+    return db
diff --git a/src/core/dependency/rate_limit.py b/src/core/dependency/rate_limit.py
@@ -0,0 +1,59 @@
+from fastapi import Request
+from fastapi_limiter import FastAPILimiter
+from fastapi_limiter.depends import RateLimiter
+
+from src.core.config.setting import get_settings
+from src.core.database.redis.client import get_redis_client
+
+EXEMPT_PATHS = frozenset(
+    {
+        "/health",
+        "/docs",
+        "/docs/",
+        "/redoc",
+        "/redoc/",
+        "/openapi.json",
+    }
+)
+
+
+settings = get_settings()
+
+
+async def custom_identifier(request: Request) -> str:
+    """Smart identifier: User ID > Proxy IP > Direct IP"""
+    user_id = getattr(request.state, "user_id", None)
+    if user_id:
+        return f"user:{user_id}"
+
+    forwarded = request.headers.get("X-Forwarded-For")
+    if forwarded:
+        return f"ip:{forwarded.split(',')[0].strip()}"
+
+    if request.client and request.client.host:
+        return f"ip:{request.client.host}"
+
+    return "unknown"
+
+
+async def init_rate_limiter():
+    r = await get_redis_client()
+    await FastAPILimiter.init(r, identifier=custom_identifier)
+
+
+async def close_rate_limiter():
+    redis_client = await get_redis_client()
+    await redis_client.aclose()
+
+
+async def apply_global_rate_limit(request: Request):
+    if request.url.path in EXEMPT_PATHS:
+        return
+
+    limit_str = settings.GLOBAL_RATE_LIMIT
+    times_str, period = limit_str.split("/")
+    times = int(times_str)
+    seconds = 60 if "minute" in period else 1
+
+    limiter = RateLimiter(times=times, seconds=seconds)
+    await limiter(request)
diff --git a/src/core/lifespan.py b/src/core/lifespan.py
@@ -2,13 +2,15 @@
 
 from fastapi import FastAPI
 
-from src.core.database.session import engine
+from src.core.database.postgres.session import engine
+from src.core.dependency.rate_limit import close_rate_limiter, init_rate_limiter
 
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Startup: Create database tables (Use Alembic in real production)
+    await init_rate_limiter()
+
     yield
 
-    # Shutdown: Dispose engine
+    await close_rate_limiter()
     await engine.dispose()
diff --git a/src/core/routers/admin.py b/src/core/routers/admin.py
@@ -0,0 +1,7 @@
+from fastapi import APIRouter, FastAPI
+
+router = APIRouter(prefix="/api/admin")
+
+
+def register_router(app: FastAPI):
+    app.include_router(router)
diff --git a/src/core/security/jwt.py b/src/core/security/jwt.py
@@ -2,9 +2,11 @@
 
 from jose import JWTError, jwt
 
-from src.core.config.setting import settings
+from src.core.config.setting import get_settings
 from src.shared.exceptions.credential_exception import InvalidCredentialsError
 
+settings = get_settings
+
 
 class JWTService:
     @staticmethod
diff --git a/src/main.py b/src/main.py
@@ -1,9 +1,13 @@
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 
+import src.core.routers.admin as admin_router
 import src.core.routers.api.v1 as v1_router
 from src.core import lifespan
 from src.core.bootstrap.middleware import register_middleware
-from src.core.config.setting import settings
+from src.core.config.setting import get_settings
+from src.core.dependency.rate_limit import apply_global_rate_limit
+
+settings = get_settings()
 
 app = FastAPI(
     title=settings.APP_NAME,
@@ -16,10 +20,12 @@
         "deepLinking": True,
         "tryItOutEnabled": True,
     },
+    dependencies=[Depends(apply_global_rate_limit)],
 )
 
 register_middleware(app=app)
 v1_router.register_router(app=app)
+admin_router.register_router(app=app)
 
 
 @app.get("/health", tags=["Health Check"])
diff --git a/src/modules/todo/presentation/dependency.py b/src/modules/todo/presentation/dependency.py
@@ -1,9 +1,9 @@
 from fastapi import Depends
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.core.database.session import get_db, get_unit_of_work
-from src.modules.todo.application.delete_todo.handler import DeleteTodoHandler
+from src.core.database.postgres.session import get_db, get_unit_of_work
 from src.modules.todo.application.create_todo.handler import CreateTodoHandler
+from src.modules.todo.application.delete_todo.handler import DeleteTodoHandler
 from src.modules.todo.application.list_todo.handler import GetTodosQueryHandler
 from src.modules.todo.application.update_todo.handler import UpdateTodoHandler
 from src.modules.todo.domain.repositories.todo_repository import TodoRepository
diff --git a/src/modules/user/application/login_user/handler.py b/src/modules/user/application/login_user/handler.py
@@ -1,7 +1,7 @@
 import hashlib
 from datetime import datetime, timedelta, timezone
 
-from src.core.config.setting import settings
+from src.core.config.setting import get_settings
 from src.core.security.jwt import JWTService
 from src.core.security.password import PasswordSerrvice
 from src.modules.user.application.login_user.command import LoginUserCommand
@@ -14,6 +14,8 @@
 from src.shared.exceptions.credential_exception import InvalidCredentialsError
 from src.shared.unit_of_work import UnitOfWork
 
+settings = get_settings()
+
 
 class LoginUserCommandHandler:
     def __init__(
diff --git a/src/modules/user/application/refresh_token/handler.py b/src/modules/user/application/refresh_token/handler.py
@@ -1,7 +1,7 @@
 import hashlib
 from datetime import datetime, timedelta, timezone
 
-from src.core.config.setting import settings
+from src.core.config.setting import get_settings
 from src.core.security.jwt import JWTService
 from src.modules.user.application.refresh_token.command import RefreshTokenCommand
 from src.modules.user.domain.entities.refresh_token import RefreshToken
@@ -11,6 +11,8 @@
 from src.shared.exceptions.credential_exception import InvalidRefreshTokenError
 from src.shared.unit_of_work import UnitOfWork
 
+settings = get_settings()
+
 
 class RefreshTokenCommandHandler:
     def __init__(
diff --git a/src/modules/user/infrastructure/service/auth_service.py b/src/modules/user/infrastructure/service/auth_service.py
diff --git a/src/modules/user/presentation/dependency.py b/src/modules/user/presentation/dependency.py
diff --git a/tests/core/test_refresh_token_settings.py b/tests/core/test_refresh_token_settings.py
diff --git a/tests/user/test_login_flow.py b/tests/user/test_login_flow.py

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,6 @@`
`7`	`7`	`from sqlalchemy.ext.asyncio import async_engine_from_config`
`8`	`8`
`9`	`9`	`from alembic import context`
`10`		`-from src.core.config.setting import settings`
`11`	`10`	`from src.core.authorization.infrastructure.models.casbin_rule_model import (`
`12`	`11`	`CasbinRuleModel, # noqa: F401`
`13`	`12`	`)`
`@@ -23,13 +22,16 @@`
`23`	`22`	`from src.core.authorization.infrastructure.models.user_has_role_model import (`
`24`	`23`	`UserHasRoleModel, # noqa: F401`
`25`	`24`	`)`
	`25`	`+from src.core.config.setting import get_settings`
`26`	`26`	`from src.modules.todo.infrastructure.models.todo_model import TodoModel # noqa: F401`
`27`	`27`	`from src.modules.user.infrastructure.models.refresh_token_model import (`
`28`	`28`	`RefreshTokenModel, # noqa: F401`
`29`	`29`	`)`
`30`	`30`	`from src.modules.user.infrastructure.models.user_model import UserModel # noqa: F401`
`31`	`31`	`from src.shared.database.model import Base`
`32`	`32`
	`33`	`+settings = get_settings()`
	`34`	`+`
`33`	`35`	`print(`
`34`	`36`	`"🔍 ALEMBIC DEBUG: Tables found in metadata ->", list(Base.metadata.tables.keys())`
`35`	`37`	`)`
Original file line number	Diff line number	Diff line change
`@@ -10,8 +10,8 @@`
`10`	`10`	`from src.core.authorization.infrastructure.services.casbin_authorization_service import (`
`11`	`11`	`CasbinAuthorizationService,`
`12`	`12`	`)`
`13`		`-from src.core.database.session import get_db`
`14`		`-from src.core.di import get_current_user`
	`13`	`+from src.core.database.postgres.session import get_db`
	`14`	`+from src.core.dependency.auth import get_current_user`
`15`	`15`
`16`	`16`
`17`	`17`	`def get_authorization_service(`