Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions, JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter) - DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD), Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG) - Security: SSRF guard, MIME validation, rate limits, API-key auth, bcrypt admin login, security headers - Admin panel: dashboard, tools/categories/guides CRUD, SEO audit, analytics, job inspector with retry, system health, feature flags - Docker deployment (nginx + web/api FPM pools + scalable workers), PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker
2026-08-23 07:10:30 +00:00
commit beaf0e1f37
217 changed files with 19619 additions and 0 deletions
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Cache-backed sliding-window rate limiting for processing endpoints
+ * (API, upload, download). Buckets: per-IP and per-session. Legit users
+ * never hit these limits; abusive automation gets a clean 429.
+ */
+final class RateLimit implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! $request instanceof \CodeIgniter\HTTP\IncomingRequest) {
+            return null;
+        }
+
+        $site = config('Site');
+
+        $ipBucket   = 'rl_ip_' . md5($request->getIPAddress() . '|' . date('YmdH'));
+        $sessionKey = service('analytics')->sessionHash();
+        $sessBucket = 'rl_ses_' . substr($sessionKey, 0, 16) . '|' . date('YmdH');
+
+        $cache = cache();
+
+        $ipCount = (int) ($cache->get($ipBucket) ?? 0);
+        $seCount = (int) ($cache->get($sessBucket) ?? 0);
+
+        // API tokens carry their own generous quota and bypass the IP window
+        $isApi = str_starts_with(uri_string(), 'api/v1') && $request->getHeaderLine('Authorization') !== '';
+
+        if (! $isApi && $ipCount >= $site->maxJobsPerHourIp * 3) {
+            return $this->tooMany();
+        }
+        if ($seCount >= $site->maxJobsPerHourSession * 3) {
+            return $this->tooMany();
+        }
+
+        $cache->save($ipBucket, $ipCount + 1, 3700);
+        $cache->save($sessBucket, $seCount + 1, 3700);
+
+        return null;
+    }
+
+    private function tooMany(): ResponseInterface
+    {
+        return response()
+            ->setStatusCode(429)
+            ->setBody(view('errors/rate_limited'));
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}