Madhura68
a0a10001d5
lib/rate-limit.ts: 11 nieuwe scope-configs + enforceUserRateLimit(scope, userId)
helper. Returnt { error, code: 429 } shape voor consistent foutbeleid.
Toegepast op de high-value mutation-paths:
- actions/pbis.ts createPbiAction
- actions/stories.ts createStoryAction
- actions/tasks.ts saveTask (alleen create-path) + createTaskAction
- actions/todos.ts createTodoAction
- actions/sprints.ts createSprintAction
- actions/products.ts createProductAction + createProductFormAction
- actions/api-tokens.ts createApiTokenAction
- actions/questions.ts answerQuestion
- actions/claude-jobs.ts enqueueClaudeJobAction + enqueueClaudeJobsBatchAction
- app/api/profile/avatar/route.ts POST
- app/api/stories/[id]/log/route.ts POST
Limits zijn ruim genoeg voor normaal gebruik, eng genoeg voor abuse-loops:
create-task 100/min, create-todo 60/min, create-pbi 30/min, create-product
5/min, create-token 10/uur, etc. Per-user scope (geen globale block).
Niet aangeraakt: reorder/status-toggle (intra-session frequent, lage abuse),
update/delete (laag-volume), cron-routes (CRON_SECRET-gated).
Consumer-tweaks: 'success' in result narrowing waar TS de bredere union niet
meer accepteerde. Tests: 9 nieuwe op rate-limit-helper.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
81 lines
2.6 KiB
TypeScript
81 lines
2.6 KiB
TypeScript
// Simple in-memory rate limiter.
|
|
// Note: resets on server restart and does not share state across multiple processes.
|
|
// Suitable for MVP; replace with Redis for production scale-out.
|
|
|
|
interface RateLimitConfig {
|
|
windowMs: number
|
|
max: number
|
|
}
|
|
|
|
const CONFIGS: Record<string, RateLimitConfig> = {
|
|
login: { windowMs: 60_000, max: 10 }, // 10 attempts per minute
|
|
register: { windowMs: 3_600_000, max: 5 }, // 5 attempts per hour
|
|
'pair-start': { windowMs: 60_000, max: 10 }, // 10 QR-pairings per minute (M10)
|
|
|
|
// v1-readiness item 3 — per-user mutation-rate-limits.
|
|
// Limits zijn ruim genoeg voor normaal gebruik, eng genoeg om abuse-loops
|
|
// (bv. een runaway-script dat duizenden tasks aanmaakt) te stoppen.
|
|
'create-pbi': { windowMs: 60_000, max: 30 },
|
|
'create-story': { windowMs: 60_000, max: 50 },
|
|
'create-task': { windowMs: 60_000, max: 100 },
|
|
'create-todo': { windowMs: 60_000, max: 60 },
|
|
'create-sprint': { windowMs: 60_000, max: 5 },
|
|
'create-product': { windowMs: 60_000, max: 5 },
|
|
'create-token': { windowMs: 3_600_000, max: 10 }, // 10 API-tokens/uur/user
|
|
'enqueue-job': { windowMs: 60_000, max: 30 },
|
|
'log-story': { windowMs: 60_000, max: 60 },
|
|
'upload-avatar': { windowMs: 3_600_000, max: 20 },
|
|
'answer-question': { windowMs: 60_000, max: 30 },
|
|
}
|
|
|
|
const DEFAULT_CONFIG: RateLimitConfig = { windowMs: 60_000, max: 10 }
|
|
|
|
const store = new Map<string, { count: number; resetAt: number }>()
|
|
|
|
export function checkRateLimit(key: string): boolean {
|
|
const prefix = key.split(':')[0]
|
|
const config = CONFIGS[prefix] ?? DEFAULT_CONFIG
|
|
const now = Date.now()
|
|
const entry = store.get(key)
|
|
|
|
if (!entry || now > entry.resetAt) {
|
|
store.set(key, { count: 1, resetAt: now + config.windowMs })
|
|
return true
|
|
}
|
|
|
|
if (entry.count >= config.max) {
|
|
return false
|
|
}
|
|
|
|
entry.count++
|
|
return true
|
|
}
|
|
|
|
/**
|
|
* Wrapper voor server-actions: scope op (action, userId), retourneert het
|
|
* standaard `{ error, code: 429 }` shape als de gebruiker over de limiet is.
|
|
*
|
|
* Gebruik in een action:
|
|
*
|
|
* const limited = enforceUserRateLimit('create-pbi', session.userId)
|
|
* if (limited) return limited
|
|
*/
|
|
export function enforceUserRateLimit(
|
|
scope: keyof typeof CONFIGS,
|
|
userId: string,
|
|
): { error: string; code: 429 } | null {
|
|
if (!checkRateLimit(`${scope}:${userId}`)) {
|
|
return {
|
|
error: 'Te veel acties achter elkaar. Probeer het over een minuut opnieuw.',
|
|
code: 429,
|
|
}
|
|
}
|
|
return null
|
|
}
|
|
|
|
/**
|
|
* Voor test-isolatie: leegt de in-memory store. Niet exporteren in productie-paden.
|
|
*/
|
|
export function _resetRateLimit() {
|
|
store.clear()
|
|
}
|