yangzhaohan
fb2c3a6cae
- Tool 接口 + Registry 注册中心，工具模块化插拔 - system 工具：health / info - database 工具：db_query / db_tables / db_table_info / db_explain（四层 SQL 安全） - docker 工具：docker_ps / docker_logs / docker_inspect（白名单 + 大小限制） - middleware：auth（JWT+APIKey）/ ratelimit（令牌桶）/ audit（slog 结构化） - stdio / SSE 双传输模式，Viper 多环境配置 - Dockerfile 多阶段构建（golang:alpine → scratch），~15MB 镜像 - docker-compose.yml 一键部署 + 安全加固（read_only / no-new-privileges / cap_drop） - go build ./... / go vet ./... / go test ./... 全部通过 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
54 lines
1.1 KiB
Go
54 lines
1.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"sync"
|
|
|
|
"golang.org/x/time/rate"
|
|
)
|
|
|
|
// RateLimiter 基于调用方标识的令牌桶限流。
|
|
type RateLimiter struct {
|
|
limiters map[string]*rate.Limiter
|
|
rate rate.Limit
|
|
burst int
|
|
mu sync.Mutex
|
|
}
|
|
|
|
func NewRateLimiter(r rate.Limit, burst int) *RateLimiter {
|
|
return &RateLimiter{
|
|
limiters: make(map[string]*rate.Limiter),
|
|
rate: r,
|
|
burst: burst,
|
|
}
|
|
}
|
|
|
|
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
subject := "anonymous"
|
|
if sub, ok := r.Context().Value(KeySubject).(string); ok {
|
|
subject = sub
|
|
}
|
|
|
|
limiter := rl.getLimiter(subject)
|
|
if !limiter.Allow() {
|
|
http.Error(w, "rate limit exceeded", http.StatusTooManyRequests)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func (rl *RateLimiter) getLimiter(key string) *rate.Limiter {
|
|
rl.mu.Lock()
|
|
defer rl.mu.Unlock()
|
|
|
|
limiter, ok := rl.limiters[key]
|
|
if !ok {
|
|
limiter = rate.NewLimiter(rl.rate, rl.burst)
|
|
rl.limiters[key] = limiter
|
|
}
|
|
return limiter
|
|
}
|