mirror of
https://github.com/suitenumerique/meet.git
synced 2026-08-06 08:57:46 +00:00
Arnaud Robin
991c9be048
Currently users have no way to reliably test their connection before joining a room. To address this, we plan to build a connection-test page. The testing requires a dedicated LiveKit token, issued without going through the room API, which is tied to registered meetings, lobby rules, and longer-lived access tokens. Introduce a new viewset for all diagnostics-related features. The first route issues a token for diagnostics, even for anonymous users. Each request creates a new dedicated room so users never share the same LiveKit room during tests. Tokens are short-lived (default 10 minutes) to limit reuse, and the endpoint is throttled to prevent abuse. A Celery worker also schedules a callback that deletes the room after a certain delay, in every case.
100 lines
3.4 KiB
Python
100 lines
3.4 KiB
Python
"""Throttling modules for the API."""
|
|
|
|
from django.conf import settings
|
|
|
|
from lasuite.drf.throttling import MonitoredThrottleMixin
|
|
from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
|
|
from sentry_sdk import capture_message
|
|
|
|
|
|
def sentry_monitoring_throttle_failure(message):
|
|
"""Log when a failure occurs to detect rate limiting issues."""
|
|
capture_message(message, "warning")
|
|
|
|
|
|
class MonitoredAnonRateThrottle(MonitoredThrottleMixin, AnonRateThrottle):
|
|
"""Throttle for the monitored scoped rate throttle."""
|
|
|
|
|
|
class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
|
|
"""Throttle for the monitored scoped rate throttle."""
|
|
|
|
|
|
class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
|
|
"""Throttle authenticated user requesting room entry"""
|
|
|
|
scope = "request_entry"
|
|
|
|
def get_cache_key(self, request, view):
|
|
"""Use the authenticated user ID as the throttle cache key."""
|
|
|
|
if request.user and not request.user.is_authenticated:
|
|
return None # Defer to RequestEntryAnonRateThrottle for anonymous users.
|
|
|
|
return super().get_cache_key(request, view)
|
|
|
|
|
|
class RequestEntryAnonRateThrottle(MonitoredAnonRateThrottle):
|
|
"""Throttle Anonymous user requesting room entry"""
|
|
|
|
scope = "request_entry"
|
|
|
|
def get_cache_key(self, request, view):
|
|
"""Use the lobby participant cookie ID as the throttle cache key.
|
|
|
|
Only throttle if a cookie is already set. If no cookie exists yet,
|
|
return None to skip throttling — the cookie will be set on the first
|
|
response, and throttling will apply from the second request onward.
|
|
|
|
Keying on the cookie rather than the IP address prevents penalising
|
|
multiple users behind the same NAT/proxy, and is consistent with how
|
|
LobbyService identifies participants.
|
|
|
|
Note: as per DRF documentation, application-level throttling is not a
|
|
security measure against brute-force or DoS attacks. This throttle exists
|
|
solely to guard against accidental hammering from buggy clients.
|
|
"""
|
|
|
|
if request.user and request.user.is_authenticated:
|
|
return None # Only throttle unauthenticated requests.
|
|
|
|
participant_id = request.COOKIES.get(settings.LOBBY_COOKIE_NAME)
|
|
|
|
if participant_id is None:
|
|
return None # No throttling for cookieless requests
|
|
|
|
return self.cache_format % {
|
|
"scope": self.scope,
|
|
"ident": participant_id,
|
|
}
|
|
|
|
|
|
class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle):
|
|
"""Throttle Anonymous user requesting room generation callback"""
|
|
|
|
scope = "creation_callback"
|
|
|
|
|
|
class RoomKitJoinRateThrottle(MonitoredUserRateThrottle):
|
|
"""Throttle the LiveKit SIP module requesting roomkit joins.
|
|
|
|
The roomkit endpoints are authenticated as a machine user, so all requests
|
|
share a single throttle bucket. This is not a security measure against
|
|
brute-force attacks but a guard against accidental hammering from a buggy
|
|
SIP module.
|
|
"""
|
|
|
|
scope = "roomkit_join"
|
|
|
|
|
|
class ConnectionTestUserRateThrottle(MonitoredUserRateThrottle):
|
|
"""Throttle authenticated users requesting connection test tokens."""
|
|
|
|
scope = "connection_test"
|
|
|
|
|
|
class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle):
|
|
"""Throttle anonymous users requesting connection test tokens."""
|
|
|
|
scope = "connection_test"
|