Merge pull request #303 from Atypical-Consulting/feat/rate-limiting

feat: add rate limiting support

Author: phmatray

docs/configuration.md

@@ -55,6 +55,11 @@ The following skeleton shows **every** configuration option at a glance. Require
       "roles": ["Admin", "User"],             // optional
       "generateLoginEndpoint": true,          // default: true
       "generateRegisterEndpoint": true        // default: true
+    },
+    "rateLimit": {
+      "permitLimit": 100,                     // default: 100
+      "windowSeconds": 60,                    // default: 60
+      "segmentsPerWindow": 6                  // default: 6
     }
   },
   "enums": {
@@ -118,7 +123,8 @@ The `config` object contains project-level settings.
     "cors": { ... },
     "features": { ... },
     "database": { ... },
-    "auth": { ... }
+    "auth": { ... },
+    "rateLimit": { ... }
   }
 }
 ```
@@ -212,6 +218,36 @@ When auth is enabled:
 {: .note }
 > When the `auth` block is absent, all endpoints use `AllowAnonymous()` and no auth infrastructure is generated. This is fully backward-compatible.
 
+### Rate Limiting
+
+The optional `rateLimit` object enables ASP.NET Core's built-in sliding window rate limiter for the generated API.
+
+```json
+{
+  "config": {
+    "rateLimit": {
+      "permitLimit": 100,
+      "windowSeconds": 60,
+      "segmentsPerWindow": 6
+    }
+  }
+}
+```
+
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `permitLimit` | `integer` | `100` | Maximum number of requests allowed within the time window. |
+| `windowSeconds` | `integer` | `60` | Duration of the time window in seconds. |
+| `segmentsPerWindow` | `integer` | `6` | Number of segments the window is divided into for smoother rate limiting. |
+
+When rate limiting is enabled:
+- Requests exceeding the limit receive a `429 Too Many Requests` response
+- The rate limiter middleware is added after CORS and before authentication in the pipeline
+- A named policy `"sliding"` is registered and applied globally
+
+{: .note }
+> When the `rateLimit` block is absent, no rate limiting infrastructure is generated. This is fully backward-compatible.
+
 ## Entities
 
 The `entities` object is a dictionary where each key is an entity name (PascalCase) and each value describes its properties and optional relationships and seed data.
@@ -401,6 +437,11 @@ A full `ninjadog.json` demonstrating all features:
       "audience": "bookstore-api",
       "tokenExpirationMinutes": 120,
       "roles": ["Admin", "Editor"]
+    },
+    "rateLimit": {
+      "permitLimit": 200,
+      "windowSeconds": 60,
+      "segmentsPerWindow": 6
     }
   },
   "enums": {

src/library/Ninjadog.Settings/Config/NinjadogConfiguration.cs

@@ -17,6 +17,7 @@ namespace Ninjadog.Settings.Config;
 /// <param name="DatabaseProvider">The database provider to use (sqlite, postgresql, sqlserver). Default is sqlite.</param>
 /// <param name="Aot">Indicates whether Native AOT publishing support should be enabled in the generated project. Default is false.</param>
 /// <param name="Auth">The optional JWT authentication configuration for the application.</param>
+/// <param name="RateLimit">The optional rate limiting configuration for the application.</param>
 public abstract record NinjadogConfiguration(
     string Name,
     string Version,
@@ -29,4 +30,5 @@ public abstract record NinjadogConfiguration(
     bool Auditing = false,
     string DatabaseProvider = "sqlite",
     bool Aot = false,
-    NinjadogAuthConfiguration? Auth = null);
+    NinjadogAuthConfiguration? Auth = null,
+    NinjadogRateLimitConfiguration? RateLimit = null);

src/library/Ninjadog.Settings/Config/NinjadogLoadedConfiguration.cs

@@ -15,5 +15,6 @@ public sealed record NinjadogLoadedConfiguration(
     bool Auditing = false,
     string DatabaseProvider = "sqlite",
     bool Aot = false,
-    NinjadogAuthConfiguration? Auth = null)
-    : NinjadogConfiguration(Name, Version, Description, RootNamespace, OutputPath, SaveGeneratedFiles, Cors, SoftDelete, Auditing, DatabaseProvider, Aot, Auth);
+    NinjadogAuthConfiguration? Auth = null,
+    NinjadogRateLimitConfiguration? RateLimit = null)
+    : NinjadogConfiguration(Name, Version, Description, RootNamespace, OutputPath, SaveGeneratedFiles, Cors, SoftDelete, Auditing, DatabaseProvider, Aot, Auth, RateLimit);

src/library/Ninjadog.Settings/Config/NinjadogRateLimitConfiguration.cs

@@ -0,0 +1,13 @@
+namespace Ninjadog.Settings.Config;
+
+/// <summary>
+/// Represents the rate limiting configuration for the generated API.
+/// Uses ASP.NET Core's built-in sliding window rate limiter.
+/// </summary>
+/// <param name="PermitLimit">The maximum number of requests permitted in the window.</param>
+/// <param name="WindowSeconds">The time window duration in seconds.</param>
+/// <param name="SegmentsPerWindow">The number of segments the window is divided into.</param>
+public record NinjadogRateLimitConfiguration(
+    int PermitLimit = 100,
+    int WindowSeconds = 60,
+    int SegmentsPerWindow = 6);

src/library/Ninjadog.Settings/NinjadogSettings.cs

@@ -94,6 +94,15 @@ public static NinjadogSettings FromJsonString(string json)
             auth = new NinjadogAuthConfiguration(authProvider, issuer, audience, tokenExpirationMinutes, roles, generateLoginEndpoint, generateRegisterEndpoint);
         }
 
+        NinjadogRateLimitConfiguration? rateLimit = null;
+        if (TryGetOptionalObject(configElement, "rateLimit", out var rateLimitElement))
+        {
+            var permitLimit = GetOptionalInt32(rateLimitElement, "permitLimit") ?? 100;
+            var windowSeconds = GetOptionalInt32(rateLimitElement, "windowSeconds") ?? 60;
+            var segmentsPerWindow = GetOptionalInt32(rateLimitElement, "segmentsPerWindow") ?? 6;
+            rateLimit = new NinjadogRateLimitConfiguration(permitLimit, windowSeconds, segmentsPerWindow);
+        }
+
         var config = new NinjadogLoadedConfiguration(
             Name: name,
             Version: GetRequiredString(configElement, "version"),
@@ -106,7 +115,8 @@ public static NinjadogSettings FromJsonString(string json)
             Auditing: auditing,
             DatabaseProvider: databaseProvider,
             Aot: aot,
-            Auth: auth);
+            Auth: auth,
+            RateLimit: rateLimit);
 
         var entities = new NinjadogLoadedEntities();
 

src/templates/Ninjadog.Templates.CrudWebApi/Template/ProgramTemplate.cs

@@ -15,6 +15,7 @@ public override NinjadogContentFile GenerateOne(NinjadogSettings ninjadogSetting
         var cors = ninjadogSettings.Config.Cors;
         var aot = ninjadogSettings.Config.Aot;
         var auth = ninjadogSettings.Config.Auth;
+        var rateLimit = ninjadogSettings.Config.RateLimit;
         var hasSeedData = ninjadogSettings.Entities.FromKeys().Any(e => e.SeedData is { Count: > 0 });
         const string fileName = "Program.cs";
 
@@ -28,7 +29,7 @@ public override NinjadogContentFile GenerateOne(NinjadogSettings ninjadogSetting
               using {{rootNamespace}};
               using {{rootNamespace}}.Database;
               using {{rootNamespace}}.Middleware;
-              {{GenerateAuthUsing(auth, rootNamespace)}}using Serilog;
+              {{GenerateRateLimitUsing(rateLimit)}}{{GenerateAuthUsing(auth, rootNamespace)}}using Serilog;
 
               Log.Logger = new LoggerConfiguration()
                   .WriteTo.Console()
@@ -53,15 +54,15 @@ public override NinjadogContentFile GenerateOne(NinjadogSettings ninjadogSetting
                               {{GenerateCorsPolicy(cors)}}
                           });
                   });
-              {{GenerateAuthServiceRegistration(auth)}}
+              {{GenerateAuthServiceRegistration(auth)}}{{GenerateRateLimitServiceRegistration(rateLimit)}}
                   services.AddNinjadog(config);
 
                   var app = builder.Build();
 
                   app.UseMiddleware<RequestCorrelationMiddleware>();
                   app.UseSerilogRequestLogging();
                   app.UseCors(myAllowSpecificOrigins);
-              {{GenerateAuthMiddleware(auth)}}    app.UseNinjadog();
+              {{GenerateRateLimitMiddleware(rateLimit)}}{{GenerateAuthMiddleware(auth)}}    app.UseNinjadog();
 
                   await app.Services
                       .GetRequiredService<DatabaseInitializer>()
@@ -176,6 +177,51 @@ await app.Services
               """;
     }
 
+    private static string GenerateRateLimitUsing(NinjadogRateLimitConfiguration? rateLimit)
+    {
+        return rateLimit is null
+            ? string.Empty
+            : """
+              using System.Threading.RateLimiting;
+              using Microsoft.AspNetCore.RateLimiting;
+
+              """;
+    }
+
+    private static string GenerateRateLimitServiceRegistration(NinjadogRateLimitConfiguration? rateLimit)
+    {
+        if (rateLimit is null)
+        {
+            return string.Empty;
+        }
+
+        return $$"""
+
+                  services.AddRateLimiter(options =>
+                  {
+                      options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+                      options.AddSlidingWindowLimiter("sliding", limiter =>
+                      {
+                          limiter.PermitLimit = {{rateLimit.PermitLimit}};
+                          limiter.Window = TimeSpan.FromSeconds({{rateLimit.WindowSeconds}});
+                          limiter.SegmentsPerWindow = {{rateLimit.SegmentsPerWindow}};
+                          limiter.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+                          limiter.QueueLimit = 0;
+                      });
+                  });
+              """;
+    }
+
+    private static string GenerateRateLimitMiddleware(NinjadogRateLimitConfiguration? rateLimit)
+    {
+        return rateLimit is null
+            ? string.Empty
+            : """
+                  app.UseRateLimiter();
+
+              """;
+    }
+
     private static string GenerateSeederCall(bool hasSeedData)
     {
         return !hasSeedData

src/tests/Ninjadog.Tests/Helpers/TestSettings.cs

@@ -140,6 +140,35 @@ public AotSeededEntitiesCollection()
 public sealed record AotSeededSettings()
     : NinjadogSettings(new AotConfiguration(), new AotSeededEntitiesCollection());
 
+public sealed record RateLimitConfiguration()
+    : NinjadogConfiguration(
+        Name: "TestApp",
+        Version: "1.0.0",
+        Description: "Test application",
+        RootNamespace: "TestApp.Api",
+        OutputPath: "output",
+        SaveGeneratedFiles: false,
+        RateLimit: new NinjadogRateLimitConfiguration());
+
+public sealed record RateLimitSettings()
+    : NinjadogSettings(new RateLimitConfiguration(), new TestEntitiesCollection());
+
+public sealed record CustomRateLimitConfiguration()
+    : NinjadogConfiguration(
+        Name: "TestApp",
+        Version: "1.0.0",
+        Description: "Test application",
+        RootNamespace: "TestApp.Api",
+        OutputPath: "output",
+        SaveGeneratedFiles: false,
+        RateLimit: new NinjadogRateLimitConfiguration(
+            PermitLimit: 50,
+            WindowSeconds: 30,
+            SegmentsPerWindow: 3));
+
+public sealed record CustomRateLimitSettings()
+    : NinjadogSettings(new CustomRateLimitConfiguration(), new TestEntitiesCollection());
+
 public sealed record AuthConfiguration()
     : NinjadogConfiguration(
         Name: "TestApp",

src/tests/Ninjadog.Tests/Templates/ProgramTemplateTests.GenerateOne_WithCustomRateLimit_UsesCustomValues.verified.txt

@@ -0,0 +1,80 @@
+//------------------------------------------------------------------------------
+// This code was powered by the Ninjadog Engine
+//
+// Developed by: Atypical Consulting SRL - Philippe Matray
+// Generated on: [SCRUBBED]
+// Version     : [SCRUBBED]
+//
+// This file is part of a custom software solution crafted to meet your
+// specific needs. For optimal performance and compatibility, modifications
+// should be coordinated with Ninjadog support services.
+//------------------------------------------------------------------------------
+
+using TestApp.Api;
+using TestApp.Api.Database;
+using TestApp.Api.Middleware;
+using System.Threading.RateLimiting;
+using Microsoft.AspNetCore.RateLimiting;
+using Serilog;
+
+Log.Logger = new LoggerConfiguration()
+    .WriteTo.Console()
+    .CreateBootstrapLogger();
+
+try
+{
+    const string myAllowSpecificOrigins = "_myAllowSpecificOrigins";
+
+    var builder = WebApplication.CreateBuilder(args);
+    var services = builder.Services;
+    var config = builder.Configuration;
+
+    builder.Host.UseSerilog((context, loggerConfig) =>
+        loggerConfig.ReadFrom.Configuration(context.Configuration));
+
+    services.AddCors(options =>
+    {
+        options.AddPolicy(name: myAllowSpecificOrigins,
+            policy =>
+            {
+                policy.WithOrigins("https://localhost:7270");
+            });
+    });
+
+    services.AddRateLimiter(options =>
+    {
+        options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+        options.AddSlidingWindowLimiter("sliding", limiter =>
+        {
+            limiter.PermitLimit = 50;
+            limiter.Window = TimeSpan.FromSeconds(30);
+            limiter.SegmentsPerWindow = 3;
+            limiter.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+            limiter.QueueLimit = 0;
+        });
+    });
+    services.AddNinjadog(config);
+
+    var app = builder.Build();
+
+    app.UseMiddleware<RequestCorrelationMiddleware>();
+    app.UseSerilogRequestLogging();
+    app.UseCors(myAllowSpecificOrigins);
+    app.UseRateLimiter();
+    app.UseNinjadog();
+
+    await app.Services
+        .GetRequiredService<DatabaseInitializer>()
+        .InitializeAsync()
+        .ConfigureAwait(false);
+
+    app.Run();
+}
+catch (Exception ex)
+{
+    Log.Fatal(ex, "Application terminated unexpectedly");
+}
+finally
+{
+    await Log.CloseAndFlushAsync();
+}