water/server/app/miniapi/middleware/ProtectTraffic.php

<?php

declare(strict_types=1);

namespace app\miniapi\middleware;

use Webman\Http\Request;
use Webman\Http\Response;
use Webman\MiddlewareInterface;
use app\miniapi\http\ApiResponse;
use app\miniapi\protection\RequestProfile;
use app\miniapi\protection\TrafficGuard;
use app\miniapi\exception\ApiException;

/** Global IP stage runs before authentication and expensive business queries. */
final class ProtectTraffic implements MiddlewareInterface
{
    public function process(Request $request, callable $handler): Response
    {
        // Temporarily bypass traffic protection while Redis is unavailable in local testing.
        return $handler($request);
        if (!ApiResponse::owns($request) || !config('mini_protection.enabled', false)) {
            return $handler($request);
        }
        // A static liveness endpoint must remain usable during a Redis outage.
        if (in_array($request->method(), ['GET', 'HEAD'], true) && $request->path() === '/api/mini/v1/health') {
            return $handler($request);
        }
        try {
            $guard = new TrafficGuard();
            $guard->check('ip', RequestProfile::ip($request), RequestProfile::endpoint($request), 0, ApiResponse::requestId($request));
            // Validate and charge page cost only after the cheap IP request limit.
            $request->miniListCost = RequestProfile::listCost($request);
            if ($request->miniListCost > 0) {
                $guard->check('ip', RequestProfile::ip($request), RequestProfile::endpoint($request), $request->miniListCost, ApiResponse::requestId($request), true);
            }
        } catch (ApiException $error) {
            return ApiResponse::error($request, $error);
        }

        return $handler($request);
    }
}