From c5f8105db8218dba7d50f1cc23c66a9892567840 Mon Sep 17 00:00:00 2001
From: ryan <ryan@arctel.net>
Date: Sun, 19 Jul 2026 18:14:16 +0800
Subject: [PATCH] feat(proxy-route): allow -1 to disable rate limits

---
 internal/apps/openflare/proxy_route/errs.go   |  2 +-
 .../apps/openflare/proxy_route/helpers.go     |  7 +++--
 .../proxy_route/helpers_limit_test.go         | 29 +++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)
 create mode 100644 internal/apps/openflare/proxy_route/helpers_limit_test.go

diff --git a/internal/apps/openflare/proxy_route/errs.go b/internal/apps/openflare/proxy_route/errs.go
index 1b8270b3..f7c2fff8 100644
--- a/internal/apps/openflare/proxy_route/errs.go
+++ b/internal/apps/openflare/proxy_route/errs.go
@@ -27,7 +27,7 @@ const (
 	errProxyRouteCertDomainLength    = "domain_cert_ids must match domains length"
 	errProxyRouteRedirectHTTP        = "redirect_http requires enable_https"
 	errProxyRouteBasicAuth           = "basic_auth_username and basic_auth_password cannot be empty when basic auth is enabled"
-	errProxyRouteLimitRate           = "limit_rate must be a number or use the 512k / 1m format"
+	errProxyRouteLimitRate           = "limit_rate must be a number or use the 512k / 1m format, or -1 to disable"
 	errProxyRouteCachePolicy         = "cache policy is not supported"
 	errProxyRouteCacheSuffix         = "cache suffix format is invalid"
 	errProxyRouteCachePath           = "cache path rule format is invalid"
diff --git a/internal/apps/openflare/proxy_route/helpers.go b/internal/apps/openflare/proxy_route/helpers.go
index 57697c9e..1c67cec6 100644
--- a/internal/apps/openflare/proxy_route/helpers.go
+++ b/internal/apps/openflare/proxy_route/helpers.go
@@ -326,8 +326,8 @@ func validateProxyRouteZoneDomainCertificates(ctx context.Context, domains []mod
 }
 
 func normalizeProxyRouteLimitConnValue(value int, field string) (int, error) {
-	if value < 0 {
-		return 0, fmt.Errorf("%s must be greater than or equal to 0", field)
+	if value < -1 {
+		return 0, fmt.Errorf("%s must be greater than or equal to -1", field)
 	}
 	return value, nil
 }
@@ -337,6 +337,9 @@ func normalizeProxyRouteLimitRate(raw string) (string, error) {
 	if normalized == "" || normalized == "0" {
 		return "", nil
 	}
+	if normalized == "-1" {
+		return "-1", nil
+	}
 	if !proxyRouteLimitRatePattern.MatchString(normalized) {
 		return "", errors.New(errProxyRouteLimitRate)
 	}
diff --git a/internal/apps/openflare/proxy_route/helpers_limit_test.go b/internal/apps/openflare/proxy_route/helpers_limit_test.go
new file mode 100644
index 00000000..7327ddc6
--- /dev/null
+++ b/internal/apps/openflare/proxy_route/helpers_limit_test.go
@@ -0,0 +1,29 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package proxy_route
+
+import "testing"
+
+func TestNormalizeProxyRouteLimitConnValue(t *testing.T) {
+	t.Parallel()
+	got, err := normalizeProxyRouteLimitConnValue(-1, "limit_conn_per_server")
+	if err != nil || got != -1 {
+		t.Fatalf("want -1, got %d err %v", got, err)
+	}
+	if _, err := normalizeProxyRouteLimitConnValue(-2, "limit_conn_per_server"); err == nil {
+		t.Fatal("expected error for -2")
+	}
+}
+
+func TestNormalizeProxyRouteLimitRate(t *testing.T) {
+	t.Parallel()
+	got, err := normalizeProxyRouteLimitRate("-1")
+	if err != nil || got != "-1" {
+		t.Fatalf("want -1, got %q err %v", got, err)
+	}
+	got, err = normalizeProxyRouteLimitRate("0")
+	if err != nil || got != "" {
+		t.Fatalf("want empty inherit, got %q err %v", got, err)
+	}
+}