hof 20.0.0-beta.6 → 20.0.0-beta.9

package/frontend/template-mixins/partials/forms/checkbox-group.html

@@ -1,9 +1,9 @@
 <div id="{{key}}-group" class="govuk-form-group{{#className}} {{className}} {{/className}}{{#formGroupClassName}} {{formGroupClassName}}{{/formGroupClassName}}{{#error}} govuk-form-group--error{{/error}}">
     <fieldset class="govuk-fieldset" {{#hint}} aria-describedby="{{key}}-hint"{{/hint}}>
-        <legend class="govuk-fieldset__legend {{^noHeading}}govuk-fieldset__legend--l{{/noHeading}}{{#legendClassName}} {{legendClassName}}{{/legendClassName}}">
-            {{^noHeading}}<h1 class="govuk-fieldset__heading">{{/noHeading}}
+        <legend class="govuk-fieldset__legend {{#isPageHeading}}govuk-fieldset__legend--l{{/isPageHeading}}{{#legendClassName}} {{legendClassName}}{{/legendClassName}}">
+            {{#isPageHeading}}<h1 class="govuk-fieldset__heading">{{/isPageHeading}}
                 {{legend}}
-            {{^noHeading}}</h1>{{/noHeading}}
+            {{#isPageHeading}}</h1>{{/isPageHeading}}
         </legend>
         {{#hint}}<div id="{{key}}-hint" class="govuk-hint">{{hint}}</div>{{/hint}}
         {{#error}}

package/frontend/template-mixins/partials/forms/input-text-group.html

@@ -1,8 +1,8 @@
 <div id="{{id}}-group" class="{{#compound}} form-group-compound{{/compound}}{{#formGroupClassName}}{{formGroupClassName}}{{/formGroupClassName}}{{#error}} govuk-form-group--error{{/error}}">
-    {{^noHeading}}<h1 class="govuk-label-wrapper">{{/noHeading}}<label for="{{id}}" class="{{labelClassName}}">
+    {{#isPageHeading}}<h1 class="govuk-label-wrapper">{{/isPageHeading}}<label for="{{id}}" class="{{labelClassName}}">
         {{{label}}}
       </label>
-    {{^noHeading}}</h1>{{/noHeading}}
+    {{#isPageHeading}}</h1>{{/isPageHeading}}
     {{#hint}}<span {{$hintId}}id="{{hintId}}" {{/hintId}}class="govuk-hint">{{hint}}</span>{{/hint}}
     {{#error}}
       <p class="govuk-error-message">

package/frontend/template-mixins/partials/forms/option-group.html

@@ -1,9 +1,9 @@
 <div id="{{key}}-group" class="govuk-form-group{{#className}} {{className}} {{/className}}{{#formGroupClassName}} {{formGroupClassName}}{{/formGroupClassName}}{{#error}} govuk-form-group--error{{/error}}">
   <fieldset class="govuk-fieldset" {{#hint}} aria-describedby="{{key}}-hint"{{/hint}}>
-      <legend class="govuk-fieldset__legend {{^noHeading}}govuk-fieldset__legend--l{{/noHeading}}{{#legendClassName}} {{legendClassName}}{{/legendClassName}}">
-          {{^noHeading}}<h1 class="govuk-fieldset__heading">{{/noHeading}}
+      <legend class="govuk-fieldset__legend {{#isPageHeading}}govuk-fieldset__legend--l{{/isPageHeading}}{{#legendClassName}} {{legendClassName}}{{/legendClassName}}">
+          {{#isPageHeading}}<h1 class="govuk-fieldset__heading">{{/isPageHeading}}
               {{legend}}
-          {{^noHeading}}</h1>{{/noHeading}}
+          {{#isPageHeading}}</h1>{{/isPageHeading}}
       </legend>
       {{#hint}}<div id="{{key}}-hint" class="govuk-hint">{{hint}}</div>{{/hint}}
       {{#error}}<p id="{{key}}-error" class="govuk-error-message"><span class="govuk-visually-hidden">Error:</span> {{error.message}}</p>{{/error}}

package/frontend/template-mixins/partials/forms/select.html

@@ -1,5 +1,5 @@
 <div id="{{id}}-group" class="{{#compound}} form-group-compound{{/compound}}{{#formGroupClassName}} {{formGroupClassName}}{{/formGroupClassName}}{{#error}} govuk-form-group--error{{/error}}">
-    {{^noHeading}}<h1 class="govuk-label-wrapper">{{/noHeading}}<label for="{{id}}" class="{{labelClassName}}{{^noHeading}}govuk-label--l{{/noHeading}}">
+    {{#isPageHeading}}<h1 class="govuk-label-wrapper">{{/isPageHeading}}<label for="{{id}}" class="{{labelClassName}}{{#isPageHeading}}govuk-label--l{{/isPageHeading}}">
         {{{label}}}
         {{#hint}}<span {{$hintId}}id="{{hintId}}" {{/hintId}}class="govuk-hint">{{hint}}</span>{{/hint}}
         {{#error}}
@@ -8,7 +8,7 @@
           </p>
         {{/error}}
     </label>
-    {{^noHeading}}</h1>{{/noHeading}}
+    {{#isPageHeading}}</h1>{{/isPageHeading}}
     <select id="{{id}}" class="govuk-select{{#className}} {{className}}{{/className}}{{#error}} invalid-input{{/error}}" name="{{id}}" aria-required="{{required}}">
     {{#options}}
         <option value="{{value}}" {{#selected}}selected{{/selected}}>{{label}}</option>

package/frontend/template-mixins/partials/forms/textarea-group.html

@@ -2,7 +2,7 @@
 <div class="govuk-character-count" data-module="govuk-character-count" data-maxlength="{{maxlength}}">
 {{/maxlength}}
 <div id="{{id}}-group" class="{{#compound}}form-group-compound {{/compound}}{{#formGroupClassName}}{{formGroupClassName}}{{/formGroupClassName}}{{#error}} govuk-form-group--error{{/error}}">
-    {{^noHeading}}<h1 class="govuk-label-wrapper">{{/noHeading}}<label for="{{id}}" class="{{labelClassName}}">
+    {{#isPageHeading}}<h1 class="govuk-label-wrapper">{{/isPageHeading}}<label for="{{id}}" class="{{labelClassName}}">
         {{{label}}}
         {{#error}} 
         <p id="{{id}}-error" class="govuk-error-message">
@@ -10,7 +10,7 @@
           </p>
         {{/error}}
     </label>
-    {{^noHeading}}</h1>{{/noHeading}}
+    {{#isPageHeading}}</h1>{{/isPageHeading}}
     {{#hint}}<div {{$hintId}}id="{{hintId}}" {{/hintId}}class="govuk-hint">{{hint}}</div>{{/hint}}
     {{#renderChild}}{{/renderChild}}
     <textarea

package/frontend/template-mixins/partials/mixins/panel.html

@@ -1,5 +1,4 @@
-<div id="{{toggle}}-panel"
-  class="{{#radioOption}}govuk-radios__conditional govuk-radios__conditional--hidden{{/radioOption}}
+<div id="{{toggle}}-panel" class="{{#radioOption}}govuk-radios__conditional govuk-radios__conditional--hidden{{/radioOption}}
   {{^radioOption}}govuk-checkboxes__conditional govuk-checkboxes__conditional--hidden{{/radioOption}}">
   {{#renderMixin}}{{/renderMixin}}
 </div>

package/frontend/template-partials/translations/src/en/errors.json

@@ -14,5 +14,17 @@
   "cookies-required": {
     "title": "Cookies are required to use this service",
     "message": "Cookies are required in order to use this service.<br /><br /> Please <a href=\"http://www.aboutcookies.org/how-to-control-cookies/\" rel=\"external\">enable cookies</a> and try again. Find out <a href=\"/cookies\">how to we use cookies</a>."
+  },
+  "ddos-rate-limit": {
+    "title": "Too many requests submitted",
+    "message": "You have submitted too many requests in quick succession.",
+    "pre-time-to-wait": "Please try again in ",
+    "post-time-to-wait": " minutes."
+  },
+  "submission-rate-limit": {
+    "title": "Too many submissions",
+    "message": "You have submitted too many applications in a short space of time.",
+    "pre-time-to-wait": "Please try again in ",
+    "post-time-to-wait": " minutes."
   }
 }

package/frontend/template-partials/views/rate-limit-error.html

@@ -0,0 +1,10 @@
+{{<layout}}
+  {{$header}}
+    {{content.title}}
+  {{/header}}
+  {{$content}}
+    <p>{{content.message}}</p>
+    <p>{{content.preTimeToWait}}{{content.timeToWait}}{{content.postTimeToWait}}</p>
+    <a href="/" class="button" role="button">{{#t}}buttons.try-again{{/t}}</a>
+  {{/content}}
+{{/layout}}

package/frontend/themes/gov-uk/client-js/govuk-cookies.js

@@ -1,6 +1,7 @@
+/* eslint-disable no-undef, no-param-reassign, no-unused-vars */
 (function () {
-  "use strict"
-  var root = this;
+  'use strict';
+  const root = this;
   if(typeof root.GOVUK === 'undefined') { root.GOVUK = {}; }
 
   /*
@@ -19,37 +20,35 @@
       GOVUK.cookie('hobnob', null);
   */
   GOVUK.cookie = function (name, value, options) {
-    if(typeof value !== 'undefined'){
+    if(typeof value !== 'undefined') {
       if(value === false || value === null) {
         return GOVUK.setCookie(name, '', { days: -1 });
-      } else {
-        return GOVUK.setCookie(name, value, options);
       }
-    } else {
-      return GOVUK.getCookie(name);
+      return GOVUK.setCookie(name, value, options);
     }
+    return GOVUK.getCookie(name);
   };
   GOVUK.setCookie = function (name, value, options) {
     if(typeof options === 'undefined') {
       options = {};
     }
-    var cookieString = name + "=" + value + "; path=/";
+    let cookieString = name + '=' + value + '; path=/';
     if (options.days) {
-      var date = new Date();
+      const date = new Date();
       date.setTime(date.getTime() + (options.days * 24 * 60 * 60 * 1000));
-      cookieString = cookieString + "; expires=" + date.toGMTString();
+      cookieString = cookieString + '; expires=' + date.toGMTString();
     }
-    if (document.location.protocol == 'https:'){
-      cookieString = cookieString + "; Secure";
+    if (document.location.protocol === 'https:') {
+      cookieString = cookieString + '; Secure';
     }
     document.cookie = cookieString;
   };
   GOVUK.getCookie = function (name) {
-    var nameEQ = name + "=";
-    var cookies = document.cookie.split(';');
-    for(var i = 0, len = cookies.length; i < len; i++) {
-      var cookie = cookies[i];
-      while (cookie.charAt(0) == ' ') {
+    const nameEQ = name + '=';
+    const cookies = document.cookie.split(';');
+    for(let i = 0, len = cookies.length; i < len; i++) {
+      let cookie = cookies[i];
+      while (cookie.charAt(0) === ' ') {
         cookie = cookie.substring(1, cookie.length);
       }
       if (cookie.indexOf(nameEQ) === 0) {
@@ -60,33 +59,33 @@
   };
 }).call(this);
 (function () {
-  'use strict'
-  var root = this
-  if (typeof root.GOVUK === 'undefined') { root.GOVUK = {} }
+  'use strict';
+  const root = this;
+  if (typeof root.GOVUK === 'undefined') { root.GOVUK = {}; }
 
   GOVUK.addCookieMessage = function () {
-    var message = document.getElementById('global-cookie-message')
+    const message = document.getElementById('global-cookie-message');
 
-    var hasCookieMessage = (message && GOVUK.cookie('seen_cookie_message') === null)
+    const hasCookieMessage = (message && GOVUK.cookie('seen_cookie_message') === null);
 
     if (hasCookieMessage) {
-      message.style.display = 'block'
-      GOVUK.cookie('seen_cookie_message', 'yes', { days: 28 })
+      message.style.display = 'block';
+      GOVUK.cookie('seen_cookie_message', 'yes', { days: 28 });
 
       document.addEventListener('DOMContentLoaded', function (event) {
         if (GOVUK.analytics && typeof GOVUK.analytics.trackEvent === 'function') {
           GOVUK.analytics.trackEvent('cookieBanner', 'Cookie banner shown', {
             value: 1,
             nonInteraction: true
-          })
+          });
         }
-      })
-    };
-  }
+      });
+    }
+  };
 }).call(this)
 ;
-(function() {
-  "use strict"
+(function () {
+  'use strict';
 
   // add cookie message
   if (window.GOVUK && GOVUK.addCookieMessage) {
@@ -94,28 +93,28 @@
   }
 
   // header navigation toggle
-  if (document.querySelectorAll && document.addEventListener){
-    var els = document.querySelectorAll('.js-header-toggle'),
-        i, _i;
-    for(i=0,_i=els.length; i<_i; i++){
-      els[i].addEventListener('click', function(e){
+  if (document.querySelectorAll && document.addEventListener) {
+    const els = document.querySelectorAll('.js-header-toggle');
+    let i; let _i;
+    for(i = 0, _i = els.length; i < _i; i++) {
+      els[i].addEventListener('click', function (e) {
         e.preventDefault();
-        var target = document.getElementById(this.getAttribute('href').substr(1)),
-            targetClass = target.getAttribute('class') || '',
-            sourceClass = this.getAttribute('class') || '';
+        const target = document.getElementById(this.getAttribute('href').substr(1));
+        const targetClass = target.getAttribute('class') || '';
+        const sourceClass = this.getAttribute('class') || '';
 
-        if(targetClass.indexOf('js-visible') !== -1){
+        if(targetClass.indexOf('js-visible') !== -1) {
           target.setAttribute('class', targetClass.replace(/(^|\s)js-visible(\s|$)/, ''));
         } else {
-          target.setAttribute('class', targetClass + " js-visible");
+          target.setAttribute('class', targetClass + ' js-visible');
         }
-        if(sourceClass.indexOf('js-visible') !== -1){
+        if(sourceClass.indexOf('js-visible') !== -1) {
           this.setAttribute('class', sourceClass.replace(/(^|\s)js-visible(\s|$)/, ''));
         } else {
-          this.setAttribute('class', sourceClass + " js-visible");
+          this.setAttribute('class', sourceClass + ' js-visible');
         }
-        this.setAttribute('aria-expanded', this.getAttribute('aria-expanded') !== "true");
-        target.setAttribute('aria-hidden', target.getAttribute('aria-hidden') === "false");
+        this.setAttribute('aria-expanded', this.getAttribute('aria-expanded') !== 'true');
+        target.setAttribute('aria-hidden', target.getAttribute('aria-hidden') === 'false');
       });
     }
   }

package/frontend/themes/gov-uk/client-js/index.js

@@ -1,4 +1,4 @@
-/* eslint-disable no-var */
+/* eslint-disable no-var, vars-on-top, no-unused-vars */
 'use strict';
 
 var toolkit = require('../../../toolkit');
@@ -8,7 +8,7 @@ var formFocus = toolkit.formFocus;
 var characterCount = toolkit.characterCount;
 var validation = toolkit.validation;
 
-var GOVUK = require('govuk-frontend')
+var GOVUK = require('govuk-frontend');
 GOVUK.initAll();
 window.GOVUK = GOVUK;
 var skipToMain = require('./skip-to-main');

package/frontend/themes/gov-uk/client-js/skip-to-main.js

@@ -1,18 +1,19 @@
 const skipToMain = function () {
-    const skipToMainLink = document.getElementById("skip-to-main");
-    const firstControlId = skipToMainLink.hash.split('#')[1] ? skipToMainLink.hash.split('#')[1] : "main-content";
-    if(firstControlId === "main-content"){
-      skipToMainLink.setAttribute("href", "#main-content");
-    }
-    if(firstControlId) {
-      skipToMainLink.onclick = function(e) {
-        //here timeout added just to make this functionality asynchronous 
-        //to focus on form as well as non form contents
-        setTimeout(() => {
-          const firstControl = document.getElementById(firstControlId);
-          firstControl.focus();
-        }, 10);      
-      }
-    }
-  };
-  skipToMain();
+  const skipToMainLink = document.getElementById('skip-to-main');
+  const firstControlId = skipToMainLink.hash.split('#')[1] ? skipToMainLink.hash.split('#')[1] : 'main-content';
+  if(firstControlId === 'main-content') {
+    skipToMainLink.setAttribute('href', '#main-content');
+  }
+  if(firstControlId) {
+    // eslint-disable-next-line no-unused-vars
+    skipToMainLink.onclick = function (e) {
+      // here timeout added just to make this functionality asynchronous
+      // to focus on form as well as non form contents
+      setTimeout(() => {
+        const firstControl = document.getElementById(firstControlId);
+        firstControl.focus();
+      }, 10);
+    };
+  }
+};
+skipToMain();

package/index.js

@@ -120,8 +120,9 @@ const getContentSecurityPolicy = (config, res) => {
  * @param options.getTerms {boolean} Optional boolean - whether to mount the /terms endpoint
  * @param options.getCookies {boolean} Optional boolean - whether to mount the /cookies endpoint
  * @param options.noCache {boolean} Optional boolean - whether to disable caching
- * @param options.getAccessibilityStatement {boolean} Optional boolean - whether to mount the /accessibility-statement endpoint
- * 
+ * @param options.getAccessibilityStatement {boolean} Optional boolean - whether to mount the
+ * /accessibility-statement endpoint
+ *
  * @returns {object} A new HOF application using the configuration supplied in options
  */
 function bootstrap(options) {
@@ -205,9 +206,13 @@ function bootstrap(options) {
   }));
   app.use(mixins());
   app.use(markdown(config.markdown));
-  
+  // rate limits have to be loaded before all routes so it is applied to them
+  if (config.rateLimits.requests.active) {
+    app.use(hofMiddleware.rateLimiter(config, 'requests'));
+  }
+
   // Set up routing so <YOUR-SITE-URL>/assets are served from /node_modules/govuk-frontend/govuk/assets
-  app.use('/assets', express.static(path.join(__dirname, '/node_modules/govuk-frontend/govuk/assets')))
+  app.use('/assets', express.static(path.join(__dirname, '/node_modules/govuk-frontend/govuk/assets')));
 
   if (config.getAccessibility === true) {
     deprecate(

package/lib/router.js

@@ -19,7 +19,8 @@ function getWizardConfig(config) {
   const wizardConfig = {
     name: config.route.name || (config.route.baseUrl || '').replace('/', ''),
     protocol: config.protocol,
-    env: config.env
+    env: config.env,
+    sanitiseInputs: config.sanitiseInputs
   };
 
   if (config.appConfig) {

package/lib/settings.js

@@ -7,19 +7,20 @@ const hoganExpressStrict = require('hogan-express-strict');
 const expressPartialTemplates = require('express-partial-templates');
 const bodyParser = require('body-parser');
 
-const filterEmptyViews = (views) => {
-  return views.filter(view => dirExists(view))
-}
-
-const dirExists = (dir) => {
+const dirExists = dir => {
   try {
     if (fs.existsSync(dir)) {
       return true;
     }
+    return false;
   } catch(err) {
-    throw new Error(`${err}: Cannot check if the directory path exists`)
+    throw new Error(`${err}: Cannot check if the directory path exists`);
   }
-}
+};
+
+const filterEmptyViews = views => {
+  return views.filter(view => dirExists(view));
+};
 
 module.exports = async (app, config) => {
   const viewEngine = config.viewEngine || 'html';
@@ -31,7 +32,7 @@ module.exports = async (app, config) => {
 
   app.use(config.theme());
 
-  const filteredViews = filterEmptyViews(config.theme.views)
+  const filteredViews = filterEmptyViews(config.theme.views);
   const viewPaths = [].concat(filteredViews);
   app.set('view engine', viewEngine);
   app.enable('view cache');

package/middleware/errors.js

@@ -1,6 +1,8 @@
 /* eslint-disable no-unused-vars */
 'use strict';
 
+const rateLimitsConfig = require('../config/rate-limits');
+
 const errorTitle = code => `${code}_ERROR`;
 const errorMsg = code => `There is a ${code}_ERROR`;
 // eslint-disable-next-line complexity
@@ -21,6 +23,36 @@ const getContent = (err, translate) => {
     content.message = (translate && translate('errors.cookies-required.message'));
   }
 
+  if (err.code === 'DDOS_RATE_LIMIT') {
+    err.status = 429;
+    err.template = 'rate-limit-error';
+    err.title = (translate && translate('errors.ddos-rate-limit.title'));
+    err.message = (translate && translate('errors.ddos-rate-limit.message'));
+    err.preTimeToWait = (translate && translate('errors.ddos-rate-limit.pre-time-to-wait'));
+    err.timeToWait = rateLimitsConfig.rateLimits.requests.windowSizeInMinutes;
+    err.postTimeToWait = (translate && translate('errors.ddos-rate-limit.post-time-to-wait'));
+    content.title = (translate && translate('errors.ddos-rate-limit.title'));
+    content.message = (translate && translate('errors.ddos-rate-limit.message'));
+    content.preTimeToWait = (translate && translate('errors.ddos-rate-limit.pre-time-to-wait'));
+    content.timeToWait = rateLimitsConfig.rateLimits.requests.windowSizeInMinutes;
+    content.postTimeToWait = (translate && translate('errors.ddos-rate-limit.post-time-to-wait'));
+  }
+
+  if (err.code === 'SUBMISSION_RATE_LIMIT') {
+    err.status = 429;
+    err.template = 'rate-limit-error';
+    err.title = (translate && translate('errors.submission-rate-limit.title'));
+    err.message = (translate && translate('errors.submission-rate-limit.message'));
+    err.preTimeToWait = (translate && translate('errors.submission-rate-limit.pre-time-to-wait'));
+    err.timeToWait = rateLimitsConfig.rateLimits.submissions.windowSizeInMinutes;
+    err.postTimeToWait = (translate && translate('errors.submission-rate-limit.post-time-to-wait'));
+    content.title = (translate && translate('errors.submission-rate-limit.title'));
+    content.message = (translate && translate('errors.submission-rate-limit.message'));
+    content.preTimeToWait = (translate && translate('errors.submission-rate-limit.pre-time-to-wait'));
+    content.timeToWait = rateLimitsConfig.rateLimits.submissions.windowSizeInMinutes;
+    content.postTimeToWait = (translate && translate('errors.submission-rate-limit.post-time-to-wait'));
+  }
+
   err.code = err.code || 'UNKNOWN';
   err.status = err.status || 500;
 

package/middleware/index.js

@@ -4,5 +4,6 @@ module.exports = {
   cookies: require('./cookies'),
   errors: require('./errors'),
   notFound: require('./not-found'),
-  deepTranslate: require('./deep-translate')
+  deepTranslate: require('./deep-translate'),
+  rateLimiter: require('./rate-limiter')
 };

package/middleware/rate-limiter.js

@@ -0,0 +1,98 @@
+
+const moment = require('moment');
+const redis = require('redis');
+const config = require('./../config/hof-defaults');
+
+module.exports = (options, rateLimitType) => {
+  // eslint-disable-next-line no-console
+  const logger = options.logger || { log: (func, msg) => console[func](msg) };
+  const rateLimits = options.rateLimits[rateLimitType];
+  const timestampName = `${rateLimitType}TimeStamp`;
+  const countName = `${rateLimitType}Count`;
+
+  const WINDOW_SIZE_IN_MINUTES = rateLimits.windowSizeInMinutes;
+  const MAX_WINDOW_REQUEST_COUNT = rateLimits.maxWindowRequestCount;
+  const WINDOW_LOG_INTERVAL_IN_MINUTES = rateLimits.windowLogIntervalInMinutes;
+  const ERROR_CODE = rateLimits.errCode;
+
+  return async (req, res, next) => {
+    const redisClient = redis.createClient(config.redis);
+
+    // check that redis client exists
+    if (!redisClient) {
+      logger.log('error', 'Redis client does not exist!');
+      return next();
+    }
+
+    const closeConnection = async err => {
+      await redisClient.quit();
+      return next(err);
+    };
+
+    try {
+      // fetch records of current user using IP address, returns null when no record is found
+      return await redisClient.get(req.ip, async (err, record) => {
+        if (err) {
+          logger.log('error', `Error with requesting redis session for rate limiting: ${err}`);
+          return await closeConnection();
+        }
+        const currentRequestTime = moment();
+        const windowStartTimestamp = moment().subtract(WINDOW_SIZE_IN_MINUTES, 'minutes').unix();
+        let oldRecord = false;
+        let data;
+        //  if no record is found , create a new record for user and store to redis
+        if (record) {
+          data = JSON.parse(record);
+          oldRecord = data[data.length - 1][timestampName] < windowStartTimestamp;
+        }
+
+        if (!record || oldRecord) {
+          const newRecord = [];
+          const requestLog = {
+            [timestampName]: currentRequestTime.unix(),
+            [countName]: 1
+          };
+          newRecord.push(requestLog);
+          await redisClient.set(req.ip, JSON.stringify(newRecord));
+          return await closeConnection();
+        }
+        // if record is found, parse it's value and calculate number of requests users has made within the last window
+        const requestsWithinWindow = data.filter(entry => entry[timestampName] > windowStartTimestamp);
+
+        const totalWindowRequestsCount = requestsWithinWindow.reduce((accumulator, entry) => {
+          return accumulator + entry[countName];
+        }, 0);
+
+        if (!options.rateLimits.env || options.rateLimits.env === 'development') {
+          const requestsRemaining = MAX_WINDOW_REQUEST_COUNT - totalWindowRequestsCount;
+          const msg = `Requests made by client: ${totalWindowRequestsCount}\nRequests remaining: ${requestsRemaining}`;
+          logger.log('info', msg);
+        }
+        // if number of requests made is greater than or equal to the desired maximum, return error
+        if (totalWindowRequestsCount >= MAX_WINDOW_REQUEST_COUNT) {
+          return await closeConnection({ code: ERROR_CODE });
+        }
+        // if number of requests made is less than allowed maximum, log new entry
+        const lastRequestLog = data[data.length - 1];
+        const potentialCurrentWindowIntervalStartTimeStamp = currentRequestTime
+          .subtract(WINDOW_LOG_INTERVAL_IN_MINUTES, 'minutes')
+          .unix();
+        //  if interval has not passed since last request log, increment counter
+        if (lastRequestLog[timestampName] > potentialCurrentWindowIntervalStartTimeStamp) {
+          lastRequestLog[countName]++;
+          data[data.length - 1] = lastRequestLog;
+        } else {
+          //  if interval has passed, log new entry for current user and timestamp
+          data.push({
+            [timestampName]: currentRequestTime.unix(),
+            [countName]: 1
+          });
+        }
+        await redisClient.set(req.ip, JSON.stringify(data));
+        return await closeConnection();
+      });
+    } catch (err) {
+      return await closeConnection(err);
+    }
+  };
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hof",
   "description": "A bootstrap for HOF projects",
-  "version": "20.0.0-beta.6",
+  "version": "20.0.0-beta.9",
   "license": "MIT",
   "main": "index.js",
   "author": "HomeOffice",
@@ -57,7 +57,7 @@
     "findup": "^0.1.5",
     "glob": "^7.2.0",
     "govuk-elements-sass": "^3.1.3",
-    "govuk-frontend": "^4.1.0",
+    "govuk-frontend": "3.14",
     "govuk_template_mustache": "^0.26.0",
     "helmet": "^3.22.0",
     "hogan-express-strict": "^0.5.4",
@@ -70,10 +70,9 @@
     "lodash": "^4.17.21",
     "markdown-it": "^12.3.2",
     "minimatch": "^3.0.3",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.6",
     "mixwith": "^0.1.1",
-    "mkdirp": "^0.5.1",
-    "moment": "^2.24.0",
+    "moment": "^2.29.2",
     "morgan": "^1.10.0",
     "mustache": "^2.3.0",
     "nodemailer": "^6.6.3",
@@ -88,8 +87,8 @@
     "serve-static": "^1.14.1",
     "uglify-js": "^3.14.3",
     "underscore": "^1.12.1",
-    "urijs": "^1.19.10",
-    "winston": "^3.3.3"
+    "urijs": "^1.19.11",
+    "winston": "^3.7.2"
   },
   "devDependencies": {
     "@cucumber/cucumber": "^7.3.0",