|
| 1 | +/* |
| 2 | + * AMRIT – Accessible Medical Records via Integrated Technology |
| 3 | + * Integrated EHR (Electronic Health Records) Solution |
| 4 | + * |
| 5 | + * Copyright (C) "Piramal Swasthya Management and Research Institute" |
| 6 | + * |
| 7 | + * This file is part of AMRIT. |
| 8 | + * |
| 9 | + * This program is free software: you can redistribute it and/or modify |
| 10 | + * it under the terms of the GNU General Public License as published by |
| 11 | + * the Free Software Foundation, either version 3 of the License, or |
| 12 | + * (at your option) any later version. |
| 13 | + * |
| 14 | + * This program is distributed in the hope that it will be useful, |
| 15 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 16 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 17 | + * GNU General Public License for more details. |
| 18 | + * |
| 19 | + * You should have received a copy of the GNU General Public License |
| 20 | + * along with this program. If not, see https://www.gnu.org/licenses/. |
| 21 | + */ |
| 22 | +package com.iemr.common.service.otp; |
| 23 | + |
| 24 | +import com.iemr.common.exception.OtpRateLimitException; |
| 25 | +import org.springframework.beans.factory.annotation.Value; |
| 26 | +import org.springframework.data.redis.core.StringRedisTemplate; |
| 27 | +import org.springframework.stereotype.Component; |
| 28 | + |
| 29 | +import java.time.LocalDate; |
| 30 | +import java.time.ZoneId; |
| 31 | +import java.util.concurrent.TimeUnit; |
| 32 | + |
| 33 | +/** |
| 34 | + * Rate-limits OTP send/resend requests per mobile number using Redis counters. |
| 35 | + * |
| 36 | + * Limits (configurable via properties): |
| 37 | + * otp.ratelimit.minute-limit – max OTPs per minute (default 3) |
| 38 | + * otp.ratelimit.hour-limit – max OTPs per hour (default 10) |
| 39 | + * otp.ratelimit.day-limit – max OTPs per day (default 20) |
| 40 | + * |
| 41 | + * Redis key pattern: |
| 42 | + * rl:otp:min:{mobNo}:{minuteSlot} TTL 60 s |
| 43 | + * rl:otp:hr:{mobNo}:{hourSlot} TTL 3600 s |
| 44 | + * rl:otp:day:{mobNo}:{yyyyMMdd} TTL 86400 s |
| 45 | + */ |
| 46 | +@Component |
| 47 | +public class OtpRateLimiterService { |
| 48 | + |
| 49 | + private final StringRedisTemplate redis; |
| 50 | + |
| 51 | + @Value("${otp.ratelimit.enabled:true}") |
| 52 | + private boolean enabled; |
| 53 | + |
| 54 | + @Value("${otp.ratelimit.minute-limit:3}") |
| 55 | + private int minuteLimit; |
| 56 | + |
| 57 | + @Value("${otp.ratelimit.hour-limit:10}") |
| 58 | + private int hourLimit; |
| 59 | + |
| 60 | + @Value("${otp.ratelimit.day-limit:20}") |
| 61 | + private int dayLimit; |
| 62 | + |
| 63 | + public OtpRateLimiterService(StringRedisTemplate redis) { |
| 64 | + this.redis = redis; |
| 65 | + } |
| 66 | + |
| 67 | + /** |
| 68 | + * Checks all three rate-limit windows for the given mobile number. |
| 69 | + * Throws {@link OtpRateLimitException} if any limit is exceeded. |
| 70 | + * No-op when otp.ratelimit.enabled=false. |
| 71 | + */ |
| 72 | + public void checkRateLimit(String mobNo) { |
| 73 | + if (!enabled) return; |
| 74 | + String today = LocalDate.now(ZoneId.of("Asia/Kolkata")) |
| 75 | + .toString().replaceAll("-", ""); // yyyyMMdd |
| 76 | + long minuteSlot = System.currentTimeMillis() / 60_000L; |
| 77 | + long hourSlot = System.currentTimeMillis() / 3_600_000L; |
| 78 | + |
| 79 | + String minKey = "rl:otp:min:" + mobNo + ":" + minuteSlot; |
| 80 | + String hourKey = "rl:otp:hr:" + mobNo + ":" + hourSlot; |
| 81 | + String dayKey = "rl:otp:day:" + mobNo + ":" + today; |
| 82 | + |
| 83 | + if (incrementWithExpire(minKey, 60L) > minuteLimit) { |
| 84 | + throw new OtpRateLimitException( |
| 85 | + "OTP request limit exceeded. Maximum " + minuteLimit + " OTPs allowed per minute. Please try again later."); |
| 86 | + } |
| 87 | + if (incrementWithExpire(hourKey, 3600L) > hourLimit) { |
| 88 | + throw new OtpRateLimitException( |
| 89 | + "OTP request limit exceeded. Maximum " + hourLimit + " OTPs allowed per hour. Please try again later."); |
| 90 | + } |
| 91 | + if (incrementWithExpire(dayKey, 86400L) > dayLimit) { |
| 92 | + throw new OtpRateLimitException( |
| 93 | + "OTP request limit exceeded. Maximum " + dayLimit + " OTPs allowed per day. Please try again tomorrow."); |
| 94 | + } |
| 95 | + } |
| 96 | + |
| 97 | + private long incrementWithExpire(String key, long ttlSeconds) { |
| 98 | + Long value = redis.opsForValue().increment(key, 1L); |
| 99 | + if (value != null && value == 1L) { |
| 100 | + redis.expire(key, ttlSeconds, TimeUnit.SECONDS); |
| 101 | + } |
| 102 | + return value == null ? 0L : value; |
| 103 | + } |
| 104 | +} |
0 commit comments