Managers

Libraries/Esiur/Security/RateLimiting/NamedRateControlManager.cs

@@ -0,0 +1,53 @@
+using Esiur.Security.Management;
+using Esiur.Security.Permissions;
+using System;
+
+namespace Esiur.Security.RateLimiting;
+
+/// <summary>
+/// Bridges the existing named RateControl policy registry into the unified
+/// resource-manager pipeline.
+/// </summary>
+internal sealed class NamedRateControlManager : IRateControlManager
+{
+    public Ruling Applicable(ResourceManagerContext context)
+    {
+        if (context.Action != ActionType.Execute &&
+            context.Action != ActionType.SetProperty)
+            return Ruling.DontCare;
+
+        var policyName = context.Member?.RatePolicyName;
+        if (string.IsNullOrWhiteSpace(policyName))
+            return Ruling.DontCare;
+
+        if (context.Connection is null || context.Session is null || context.Member is null)
+        {
+            context.DenialReason = $"Rate policy `{policyName}` requires an authenticated connection.";
+            return Ruling.Denied;
+        }
+
+        var policy = context.Warehouse.TryGetRatePolicy(policyName);
+        if (policy is null)
+        {
+            context.DenialReason = $"Rate policy `{policyName}` is not registered.";
+            return Ruling.Denied;
+        }
+
+        var rateContext = new RateControlContext(
+            context.Warehouse,
+            context.Connection,
+            context.Session,
+            context.Resource,
+            context.Member,
+            context.Action);
+
+        var ruling = policy.Applicable(rateContext);
+        if (rateContext.Delay > context.Delay)
+            context.Delay = rateContext.Delay;
+
+        if (ruling == Ruling.Denied && string.IsNullOrWhiteSpace(context.DenialReason))
+            context.DenialReason = $"Rate policy `{policyName}` denied `{context.Member.Fullname}`.";
+
+        return ruling;
+    }
+}