From a9e40a3d80435431f689b8d19005dd77a8f50224 Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 22 Oct 2016 19:38:47 +0200
Subject: Adding OAuth access scopes, fixing OAuth authorization UI, adding
 rate limiting to the API

---
 app/controllers/api_controller.rb | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'app/controllers/api_controller.rb')

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index e29892cbe..0776f4ce8 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -1,7 +1,10 @@
 class ApiController < ApplicationController
   protect_from_forgery with: :null_session
+
   skip_before_action :verify_authenticity_token
 
+  before_action :set_rate_limit_headers
+
   rescue_from ActiveRecord::RecordInvalid do |e|
     render json: { error: e.to_s }, status: 422
   end
@@ -22,8 +25,27 @@ class ApiController < ApplicationController
     render json: { error: 'Remote SSL certificate could not be verified' }, status: 503
   end
 
+  def doorkeeper_unauthorized_render_options(*)
+    { json: { error: 'Not authorized' } }
+  end
+
+  def doorkeeper_forbidden_render_options(*)
+    { json: { error: 'This action is outside the authorized scopes' } }
+  end
+
   protected
 
+  def set_rate_limit_headers
+    return if request.env['rack.attack.throttle_data'].nil?
+
+    now        = Time.now.utc
+    match_data = request.env['rack.attack.throttle_data']['api']
+
+    response.headers['X-RateLimit-Limit']     = match_data[:limit].to_s
+    response.headers['X-RateLimit-Remaining'] = (match_data[:limit] - match_data[:count]).to_s
+    response.headers['X-RateLimit-Reset']     = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
+  end
+
   def current_resource_owner
     User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
   end
-- 
cgit