rebelweb / mapping_service Goto Github PK

Implement the Rack Attack gem to allow for overall rate limiting of requests. This should be configurable using environment variables and the environment variables should be documented in the README.

The application uses a mongo to cache and reserve responses when duplicate queries are made to the service. We need a way to manage these cached responses. This includes bulk removal, single response removal, searching, etc. We should include endpoints protected by Admin API Keys as well as rake tasks to perform these actions.

An API Key is needed to control access and limit the number of requests per user

• Create Mongo backed model with fields for general and admin permissions
• Create Endpoints to manage API Keys
• Create Rake Task to create the initial admin key

Implement authentication for all API endpoints, using checking of an API Key.

• Create an Authentication Mechanism
• Allow to be disabled/enabled by Environment variable
• Document new Environment Variable in README

There is an open CVE issue for the version of ActiveSupport we currently have implemented. We need to upgrade to resolve this.

The README needs update with new options and information about related services (mongo & redis). The formatting for options needs to be improved as well as the number of options continues to grow.

The API should handle limits from a provider without causing errors. We need to build in error handling when getting bad info from the provider, so the user gets a response from a different provider or gets a friendly error message. Common Errors could be service unavailable or rate limited.

A puma config is needed to optimize the implementation for Grape. Create a puma config and include options for processes, threads, ports, etc. Be sure to update the docker file to use the new config file.

There is a DDOS vulnerability with the version rack we have currently implemented.