FloodGate.js

// DEMO

const gate = new FloodGate()

socket.on('new_message', (text, cb) => {
  // bail if user is spamming us
  if (gate.bump(socket.ip).isFlooding(socket.ip)) {
    return cb('RATE_LIMITED')
  }

  db.insertMessage(text).then(() => cb())
})

// FLOODGATE

function FloodGate () {
  // map of ipAddress -> [Date]
  this.store = {}

  // rate.count = max amount of messages user can send since rate.seconds ago
  this.rates = [
    {count: 2, seconds: 1},
    {count: 5, seconds: 5},
    {count: 8, seconds: 10}
  ]

  // the amount of timestamps we should track per key
  this.bufferSize = this.rates.reduce((memo, {count}) => Math.max(memo, count), 0)
}

// =========================================================

FloodGate.prototype.isFlooding = function (key) {
  if (!this.store[key]) {
    return false
  }

  return this.rates.find((rate) => {
    const after = new Date(Date.now() - rate.seconds * 1000)
    const timestamps = this.store[key].filter((t) => t > after)
    return timestamps.length >= rate.count
  })
}

// =========================================================

// register a hit
FloodGate.prototype.bump = function(key) {
  if (!this.store[key]) this.store[key] = []
  this.store[key].push(new Date())
  if (this.store[key].length > this.bufferSize) this.store[key].shift()
  return this
}

// =========================================================

module.exports = FloodGate