Tidy middlewares up: put rate limit middleware after authorization

lib/cartodb/controllers/analyses.js

@@ -26,10 +26,10 @@ AnalysesController.prototype.register = function (app) {
         `${mapconfigBasePath}/analyses/catalog`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS_CATALOG),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS_CATALOG),
         cleanUpQueryParams(),
         createPGClient(),
         getDataFromQuery({ queryTemplate: catalogQueryTpl, key: 'catalog' }),

lib/cartodb/controllers/layergroup.js

@@ -90,11 +90,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/:z/:x/:y@:scale_factor?x.:format`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         cleanUpQueryParams(),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -118,11 +118,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/:z/:x/:y.:format`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         cleanUpQueryParams(),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -147,11 +147,11 @@ LayergroupController.prototype.register = function(app) {
         distinguishLayergroupFromStaticRoute(),
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
         cleanUpQueryParams(),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -175,11 +175,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/:layer/attributes/:fid`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ATTRIBUTES),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ATTRIBUTES),
         cleanUpQueryParams(),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -201,11 +201,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/static/center/:token/:z/:lat/:lng/:width/:height.:format`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
         cleanUpQueryParams(['layer']),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -226,11 +226,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
         cleanUpQueryParams(['layer']),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -254,11 +254,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/dataview/:dataviewName`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW),
         cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -278,11 +278,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/:layer/widget/:dataviewName`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW),
         cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -302,11 +302,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/dataview/:dataviewName/search`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH),
         cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -326,11 +326,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/:layer/widget/:dataviewName/search`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH),
         cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS),
         createMapStoreMapConfigProvider(
             this.mapStore,
@@ -350,11 +350,11 @@ LayergroupController.prototype.register = function(app) {
         `${mapConfigBasePath}/:token/analysis/node/:nodeId`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS),
         layergroupToken(),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS),
         cleanUpQueryParams(),
         analysisNodeStatus(this.analysisStatusBackend),
         sendResponse()

lib/cartodb/controllers/map.js

@@ -101,10 +101,10 @@ MapController.prototype.composeCreateMapMiddleware = function (endpointGroup, us
     return [
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, endpointGroup),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, endpointGroup),
         cleanUpQueryParams(['aggregation']),
         initProfiler(isTemplateInstantiation),
         checkJsonContentType(),

lib/cartodb/controllers/named_maps.js

@@ -56,10 +56,10 @@ NamedMapsController.prototype.register = function(app) {
         `${templateBasePath}/:template_id/:layer/:z/:x/:y.(:format)`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_TILES),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_TILES),
         cleanUpQueryParams(),
         getNamedMapProvider({
             namedMapProviderCache: this.namedMapProviderCache,
@@ -82,10 +82,10 @@ NamedMapsController.prototype.register = function(app) {
         `${mapconfigBasePath}/static/named/:template_id/:width/:height.:format`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC_NAMED),
         credentials(),
         authorize(this.authApi),
         dbConnSetup(this.pgConnection),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC_NAMED),
         cleanUpQueryParams(['layer', 'zoom', 'lon', 'lat', 'bbox']),
         getNamedMapProvider({
             namedMapProviderCache: this.namedMapProviderCache,

lib/cartodb/controllers/named_maps_admin.js

@@ -27,10 +27,10 @@ NamedMapsAdminController.prototype.register = function (app) {
         `${templateBasePath}/`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_CREATE),
         credentials(),
         checkContentType({ action: 'POST', label: 'POST TEMPLATE' }),
         authorizedByAPIKey({ authApi: this.authApi, action: 'create', label: 'POST TEMPLATE' }),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_CREATE),
         createTemplate({ templateMaps: this.templateMaps }),
         sendResponse()
     );
@@ -39,10 +39,10 @@ NamedMapsAdminController.prototype.register = function (app) {
         `${templateBasePath}/:template_id`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_UPDATE),
         credentials(),
         checkContentType({ action: 'PUT', label: 'PUT TEMPLATE' }),
         authorizedByAPIKey({ authApi: this.authApi, action: 'update', label: 'PUT TEMPLATE' }),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_UPDATE),
         updateTemplate({ templateMaps: this.templateMaps }),
         sendResponse()
     );
@@ -51,9 +51,9 @@ NamedMapsAdminController.prototype.register = function (app) {
         `${templateBasePath}/:template_id`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_GET),
         credentials(),
         authorizedByAPIKey({ authApi: this.authApi, action: 'get', label: 'GET TEMPLATE' }),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_GET),
         retrieveTemplate({ templateMaps: this.templateMaps }),
         sendResponse()
     );
@@ -62,9 +62,9 @@ NamedMapsAdminController.prototype.register = function (app) {
         `${templateBasePath}/:template_id`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_DELETE),
         credentials(),
         authorizedByAPIKey({ authApi: this.authApi, action: 'delete', label: 'DELETE TEMPLATE' }),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_DELETE),
         destroyTemplate({ templateMaps: this.templateMaps }),
         sendResponse()
     );
@@ -73,9 +73,9 @@ NamedMapsAdminController.prototype.register = function (app) {
         `${templateBasePath}/`,
         cors(),
         user(),
-        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_LIST),
         credentials(),
         authorizedByAPIKey({ authApi: this.authApi, action: 'list', label: 'GET TEMPLATE LIST' }),
+        rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_LIST),
         listTemplates({ templateMaps: this.templateMaps }),
         sendResponse()
     );