Monorepo Cleanup (#362)

* add dependency review workflow

* setup rate limit to faucet server

* upgrade ejs version

.github/workflows/ci-dependency-review.yaml

@@ -0,0 +1,14 @@
+name: "Dependency Review"
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@v3
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@v3

package.json

@@ -58,7 +58,7 @@
     "typescript": "^4.9.3"
   },
   "resolutions": {
-    "ejs": "^3.0.0",
+    "ejs": "^3.1.8",
     "gluegun": "^5.0.0",
     "mocha": "^10.0.0",
     "node-fetch": "^2.6.7",

packages/apps/faucet-server/package.json

@@ -13,12 +13,13 @@
   "license": "ISC",
   "dependencies": {
     "@human-protocol/core": "workspace:*",
-    "@types/express": "^4.17.14",
     "@skaleproject/pow-ethers": "^0.2.4",
+    "@types/express": "^4.17.14",
     "axios": "^1.3.4",
     "body-parser": "^1.20.0",
     "cors": "^2.8.5",
     "express": "^4.18.1",
+    "express-rate-limit": "^6.7.0",
     "node-cache": "^5.1.2",
     "web3": "^1.8.0"
   }

packages/apps/faucet-server/src/index.ts

@@ -4,6 +4,7 @@ dotenv.config({ path: `.env.${process.env.NODE_ENV}` });
 import bodyParser from 'body-parser';
 import cors from 'cors';
 import express, { Request, Response } from 'express';
+import RateLimit from 'express-rate-limit';
 import NodeCache from 'node-cache';
 import path from 'path';
 import Web3 from 'web3';
@@ -25,6 +26,14 @@ app.use(bodyParser.urlencoded({ extended: false }));
 app.use(express.static(path.join(__dirname, '..', 'client', 'build')));
 const port = process.env.APP_PORT;
 
+// set up rate limiter: maximum of five requests per second
+app.use(
+  RateLimit({
+    windowMs: 1 * 1000, // 1 second
+    max: 5,
+  })
+);
+
 // init cache
 const blockList = new NodeCache();
 

yarn.lock

@@ -9030,10 +9030,10 @@ eip1193-provider@1.0.1:
   dependencies:
     "@json-rpc-tools/provider" "^1.5.5"
 
-ejs@3.1.6, ejs@^3.0.0, ejs@^3.1.6:
-  version "3.1.8"
-  resolved "https://registry.yarnpkg.com/ejs/-/ejs-3.1.8.tgz#758d32910c78047585c7ef1f92f9ee041c1c190b"
-  integrity sha512-/sXZeMlhS0ArkfX2Aw780gJzXSMPnKjtspYZv+f3NiKLlubezAHDU5+9xz6gd3/NhG3txQCo6xlglmTS+oTGEQ==
+ejs@3.1.6, ejs@^3.1.6, ejs@^3.1.8:
+  version "3.1.9"
+  resolved "https://registry.yarnpkg.com/ejs/-/ejs-3.1.9.tgz#03c9e8777fe12686a9effcef22303ca3d8eeb361"
+  integrity sha512-rC+QVNMJWv+MtPgkt0y+0rVEIdbtxVADApW9JXrUVlzHetgcyczP/E7DJmWJ4fJCZF2cPcBk0laWO9ZHMG3DmQ==
   dependencies:
     jake "^10.8.5"
 
@@ -10219,6 +10219,11 @@ explain-error@^1.0.4:
   resolved "https://registry.yarnpkg.com/explain-error/-/explain-error-1.0.4.tgz#a793d3ac0cad4c6ab571e9968fbbab6cb2532929"
   integrity sha512-/wSgNMxFusiYRy1rd19LT2SQlIXDppHpumpWo06wxjflD1OYxDLbl6rMVw+U3bxD5Nuhex4TKqv9Aem4D0lVzQ==
 
+express-rate-limit@^6.7.0:
+  version "6.7.0"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-6.7.0.tgz#6aa8a1bd63dfe79702267b3af1161a93afc1d3c2"
+  integrity sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==
+
 express@^4.14.0, express@^4.17.3, express@^4.18.1:
   version "4.18.2"
   resolved "https://registry.yarnpkg.com/express/-/express-4.18.2.tgz#3fabe08296e930c796c19e3c516979386ba9fd59"