Skip to content

feat(router): add rate limiting middleware#1945

Closed
Tresor-Kasenda wants to merge 96 commits intotempestphp:mainfrom
Tresor-Kasenda:feature/rate-limiting-middleware
Closed

feat(router): add rate limiting middleware#1945
Tresor-Kasenda wants to merge 96 commits intotempestphp:mainfrom
Tresor-Kasenda:feature/rate-limiting-middleware

Conversation

@Tresor-Kasenda
Copy link

Add rate limiting support for API routes using the #[RateLimit] attribute.

Features:

  • New #[RateLimit] attribute as RouteDecorator for configuring rate limits
  • Support for rate limiting by IP address, authenticated user, or session
  • Cache-based sliding window algorithm via CacheRateLimiter
  • Standard rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)
  • HTTP 429 TooManyRequests response with Retry-After header
  • TestingRateLimiter for isolated test execution

Usage:
#[Get('/api/resource')]
#[RateLimit(maxAttempts: 60, decaySeconds: 60, by: 'ip')]
public function resource(): Response { ... }

Files added:

  • packages/http/src/Responses/TooManyRequests.php
  • packages/router/src/RateLimit.php
  • packages/router/src/RateLimitMiddleware.php
  • packages/router/src/RateLimiting/RateLimiter.php
  • packages/router/src/RateLimiting/RateLimitResult.php
  • packages/router/src/RateLimiting/CacheRateLimiter.php
  • packages/router/s
    Add rate limiting support for API routes using the #[Ratter
    Features:
  • New #[RateLimit] attribute as RouteDecorator for configuringfor- New #[it- Support for rate limiting by IP address, authenticated user, orddleware

brendt and others added 30 commits December 12, 2025 08:25
Co-authored-by: Brent Roose <brent.roose@gmail.com>
Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
Co-authored-by: Brent Roose <brent.roose@gmail.com>
Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
…1839)

Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
Co-authored-by: Brent Roose <brent.roose@gmail.com>
…pestphp#1781)

Co-authored-by: Brent Roose <brent.roose@gmail.com>
Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
Co-authored-by: Adam Kiss <iam@adamkiss.com>
Co-authored-by: Brent Roose <brent.roose@gmail.com>
Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
innocenzi and others added 22 commits January 20, 2026 18:32
Co-authored-by: Enzo Innocenzi <enzo@innocenzi.dev>
Add rate limiting support for API routes using the #[RateLimit] attribute.

Features:
- New #[RateLimit] attribute as RouteDecorator for configuring rate limits
- Support for rate limiting by IP address, authenticated user, or session
- Cache-based sliding window algorithm via CacheRateLimiter
- Standard rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)
- HTTP 429 TooManyRequests response with Retry-After header
- TestingRateLimiter for isolated test execution

Usage:
  #[Get('/api/resource')]
  #[RateLimit(maxAttempts: 60, decaySeconds: 60, by: 'ip')]
  public function resource(): Response { ... }

Files added:
- packages/http/src/Responses/TooManyRequests.php
- packages/router/src/RateLimit.php
- packages/router/src/RateLimitMiddleware.php
- packages/router/src/RateLimiting/RateLimiter.php
- packages/router/src/RateLimiting/RateLimitResult.php
- packages/router/src/RateLimiting/CacheRateLimiter.php
- packages/router/s
Add rate limiting support for API routes using the #[Ratter
Features:
- New #[RateLimit] attribute as RouteDecorator for configuringfor- New #[it- Support for rate limiting by IP address, authenticated user, orddleware
Copilot AI review requested due to automatic review settings February 6, 2026 11:45
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the framework's minimum PHP version from 8.4 to 8.5 and introduces several structural improvements. The changes include reorganizing the generation package, refactoring exception handling, updating test infrastructure, and standardizing namespacing across helper functions.

Changes:

  • Upgrade minimum PHP version requirement from 8.4 to 8.5 across all packages
  • Reorganize generation package structure by moving classes to Tempest\Generation\Php namespace
  • Refactor exception handling system replacing ExceptionReporter with ExceptionProcessor and introducing ExceptionReporter interface
  • Update test snapshots and fixture namespaces in generation package from Fixtures to Php\Fixtures

Reviewed changes

Copilot reviewed 292 out of 775 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/http/composer.json Updates PHP version requirement to 8.5
packages/http-client/src/Driver/Psr18Driver.php Updates Status enum method from code() to fromCode()
packages/http-client/composer.json Removes router dependency and updates PHP/PHPUnit versions
packages/generation/tests/Php/ClassManipulatorTest.php Updates test namespace and imports for reorganized structure
packages/generation/src/Php/* Reorganizes generation classes into Php namespace
packages/event-bus/src/functions.php Moves functions to namespaced structure
packages/event-bus/src/EventBus.php Adds support for UnitEnum in listen method
packages/discovery/src/DiscoveryLocation.php Changes hash algorithm from crc32 to xxh64
packages/debug/src/functions.php Removes global namespace wrapper
packages/database/src/* Adds UUID support and database context serialization
packages/core/src/Environment.php Adds requiresCaution() method and renames CI case
packages/core/src/Exceptions/* Refactors exception handling system
packages/console/src/completion.* Adds new shell completion scripts
packages/cache/src/* Updates lock API from expiration to duration
packages/auth/src/OAuth/* Adds Twitch OAuth provider support
mago.toml Updates PHP version to 8.5.0
docs/* Documentation updates and corrections
.github/workflows/* Updates CI workflows for PHP 8.5
Comments suppressed due to low confidence (1)

packages/generation/tests/snapshots/ClassManipulatorTest__test_from_file__1.txt:1

  • The entire snapshot file is being deleted without a corresponding new snapshot file being added. This suggests test expectations may have changed but the test itself wasn't updated to reflect the new namespace structure.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Tresor-Kasenda and others added 3 commits February 6, 2026 13:47
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@innocenzi innocenzi closed this Feb 6, 2026
@innocenzi
Copy link
Member

Hey, I'm closing this as this is targeting the wrong branch and it has issues with its history.

Please reopen on 3.x!

@Tresor-Kasenda
Copy link
Author

it's done now
#1947

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants