Initial curated CertScope source from fe2bbe3ca5c98bf64be26a09c6c58ee805a7f87e

lib/inspect/admission.ts

@@ -0,0 +1,51 @@
+export const MAX_IN_FLIGHT_INSPECTIONS = 4;
+export const RATE_LIMIT_WINDOW_MS = 60_000;
+export const RATE_LIMIT_MAX_REQUESTS = 30;
+const MAX_TRACKED_CLIENTS = 1_024;
+
+let inFlight = 0;
+const requestWindows = new Map<string, number[]>();
+
+export function tryAcquireInspection() {
+  if (inFlight >= MAX_IN_FLIGHT_INSPECTIONS) return null;
+
+  inFlight += 1;
+  let released = false;
+
+  return () => {
+    if (released) return;
+    released = true;
+    inFlight = Math.max(0, inFlight - 1);
+  };
+}
+
+export function clientKeyFromHeaders(headers: { get(name: string): string | null }) {
+  if (process.env.CERTSCOPE_TRUST_PROXY !== "true") return "direct";
+  const forwarded = headers.get("x-forwarded-for") ?? headers.get("x-real-ip") ?? "unknown";
+  const client = forwarded.split(",", 1)[0]?.trim().slice(0, 128) || "unknown";
+  return "proxy:" + client;
+}
+
+export function checkRateLimit(key: string, now = Date.now()) {
+  const windowStart = now - RATE_LIMIT_WINDOW_MS;
+  const previous = requestWindows.get(key) ?? [];
+  const recent = previous.filter((timestamp) => timestamp > windowStart);
+  if (recent.length >= RATE_LIMIT_MAX_REQUESTS) {
+    const retryAfterMs = Math.max(1_000, (recent[0] ?? now) + RATE_LIMIT_WINDOW_MS - now);
+    requestWindows.set(key, recent);
+    return { allowed: false, retryAfterSeconds: Math.ceil(retryAfterMs / 1_000) };
+  }
+  recent.push(now);
+  requestWindows.set(key, recent);
+  if (requestWindows.size > MAX_TRACKED_CLIENTS) {
+    for (const [client, timestamps] of requestWindows) {
+      if (!timestamps.some((timestamp) => timestamp > windowStart)) requestWindows.delete(client);
+      if (requestWindows.size <= MAX_TRACKED_CLIENTS) break;
+    }
+    if (requestWindows.size > MAX_TRACKED_CLIENTS) {
+      const oldestClient = requestWindows.keys().next().value;
+      if (typeof oldestClient === "string" && oldestClient !== key) requestWindows.delete(oldestClient);
+    }
+  }
+  return { allowed: true, retryAfterSeconds: 0 };
+}