root
54 lines
1.9 KiB
TypeScript
54 lines
1.9 KiB
TypeScript
import rateLimit, { ipKeyGenerator } from 'express-rate-limit'
|
|
|
|
const trustProxy = process.env.NODE_ENV === 'production'
|
|
const getClientIpKey = (req: Parameters<typeof ipKeyGenerator>[0]) =>
|
|
trustProxy
|
|
? ipKeyGenerator((req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() ?? req.ip ?? '')
|
|
: ipKeyGenerator(req.ip ?? '')
|
|
|
|
// Strict limiter for auth endpoints — prevents brute-force and credential stuffing
|
|
export const authLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
max: 960,
|
|
standardHeaders: 'draft-7',
|
|
legacyHeaders: false,
|
|
skipSuccessfulRequests: false,
|
|
keyGenerator: (req) => getClientIpKey(req),
|
|
message: { error: 'too_many_requests', message: 'Too many attempts, please try again later', statusCode: 429 },
|
|
})
|
|
|
|
// Standard limiter for general authenticated API endpoints
|
|
export const apiLimiter = rateLimit({
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 960,
|
|
standardHeaders: 'draft-7',
|
|
legacyHeaders: false,
|
|
keyGenerator: (req) => {
|
|
const ip = getClientIpKey(req)
|
|
const companyId = (req as any).companyId ?? ''
|
|
const renterId = (req as any).renterId ?? ''
|
|
return `${ip}:${companyId || renterId}`
|
|
},
|
|
message: { error: 'too_many_requests', message: 'Rate limit exceeded', statusCode: 429 },
|
|
})
|
|
|
|
// Tight limiter for public marketplace and site endpoints (no auth)
|
|
export const publicLimiter = rateLimit({
|
|
windowMs: 60 * 1000,
|
|
max: 960,
|
|
standardHeaders: 'draft-7',
|
|
legacyHeaders: false,
|
|
keyGenerator: (req) => getClientIpKey(req),
|
|
message: { error: 'too_many_requests', message: 'Rate limit exceeded', statusCode: 429 },
|
|
})
|
|
|
|
// Tight limiter for admin endpoints
|
|
export const adminLimiter = rateLimit({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 960,
|
|
standardHeaders: 'draft-7',
|
|
legacyHeaders: false,
|
|
keyGenerator: (req) => getClientIpKey(req),
|
|
message: { error: 'too_many_requests', message: 'Too many admin requests', statusCode: 429 },
|
|
})
|