<?php

// Deals with rate-limitting requests to the server to prevent abuses

// TODO: rate limit 404 errors

/*
 * Returns -1 in case of errors or no conf present (fake "no over limit").
 * Returns 0 if the user is over limit.
 * Returns >0 when the @ip is under limit (the return value represents how
 * many requests are still allowed.
 */
function rg_rate_limit($db)
{
	rg_log_enter('rate_limit');

	$ret = -1;
	do {
		$period = rg_state_get_uint($db, 'rate_limit_period');
		if (($period === FALSE) || ($period == 0))
			break;

		$limit = rg_state_get_uint($db, 'rate_limit_max');
		if (($limit === FALSE) || ($limit == 0))
			break;

		$now = time();

		$ip = rg_ip();
		$eip = str_replace(':', '_', $ip); // escape IPv6
		$row = rg_cache_get('ratelimit::' . $eip);
		if ($row !== FALSE)
			rg_log_debug('from cache: row=' . rg_array2string($row));
		if (($row === FALSE) || ($row['start'] + $period < $now)) {
			$params = array('t' => $now - $period, 'ip' => $ip);
			$sql = 'SELECT MIN(itime) AS start, COUNT(1) AS count'
				. ' FROM conns'
				. ' WHERE itime >= @@t@@'
				. ' AND ip = @@ip@@';
			$res = rg_sql_query_params($db, $sql, $params);
			if ($res === FALSE)
				break;
			$row = rg_sql_fetch_array($res);
			if ($row['count'] == 0)
				$row = array('start' => $now, 'count' => 0);
			rg_sql_free_result($res);
			rg_log_debug('from db: row=' . rg_array2string($row));
		}

		$row['count']++;
		if ($row['count'] > $limit) {
			rg_log('IP is over limit (' . $limit . ')');
			$ret = 0;
			break;
		}

		rg_cache_set('ratelimit::' . $eip, $row, RG_SOCKET_NO_WAIT);

		rg_log_debug('IP is not over limit (count=' . $row['count'] . '/' . $limit . ')');
		$ret = $limit - $row['count'];
	} while (0);

	rg_log_exit();
	return $ret;
}