From 403edaef6c4720aa6770885fea9e0a1b2fc7de5c Mon Sep 17 00:00:00 2001
From: DIYgod <i@diygod.me>
Date: Fri, 12 Jul 2024 23:32:06 +0800
Subject: [PATCH] feat: rate limiter for twitter login

---
 lib/routes/twitter/api/mobile-api/login.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/routes/twitter/api/mobile-api/login.ts b/lib/routes/twitter/api/mobile-api/login.ts
index c9d19a60e..bc25f0997 100644
--- a/lib/routes/twitter/api/mobile-api/login.ts
+++ b/lib/routes/twitter/api/mobile-api/login.ts
@@ -8,6 +8,7 @@ import { v5 as uuidv5 } from 'uuid';
 import { authenticator } from 'otplib';
 import logger from '@/utils/logger';
 import cache from '@/utils/cache';
+import { RateLimiterRedis, RateLimiterQueue } from 'rate-limiter-flexible';
 
 const NAMESPACE = 'd41d092b-b007-48f7-9129-e9538d2d8fe9';
 
@@ -25,11 +26,24 @@ const headers = {
     Authorization: bearerToken,
 };
 
+const loginLimiter = new RateLimiterRedis({
+    points: 1,
+    duration: 20,
+    execEvenly: true,
+    storeClient: cache.clients.redisClient,
+});
+
+const loginLimiterQueue = new RateLimiterQueue(loginLimiter, {
+    maxQueueSize: 100,
+});
+
 async function login({ username, password, authenticationSecret }) {
     return (await cache.tryGet(
         `twitter:authentication:${username}`,
         async () => {
             try {
+                await loginLimiterQueue.removeTokens(1);
+
                 logger.debug('Twitter login start.');
                 const android_id = uuidv5(username, NAMESPACE);
                 headers['X-Twitter-Client-DeviceID'] = android_id;