OKO-517

backend/admin_api/package.json

@@ -23,6 +23,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.21.1",
+    "express-rate-limit": "^8.2.1",
     "he": "^1.2.0",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
@@ -38,6 +39,7 @@
   "devDependencies": {
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.6",
+    "@types/express-rate-limit": "^6.0.2",
     "@types/he": "^1.2.0",
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^9.0.7",

backend/admin_api/src/middleware/rate_limit.ts

@@ -0,0 +1,24 @@
+import type { OkoApiErrorResponse } from "@oko-wallet/oko-types/api_response";
+import rateLimit from "express-rate-limit";
+
+export interface RateLimitMiddlewareOption {
+  windowSeconds: number;
+  maxRequests: number;
+}
+
+export function rateLimitMiddleware(option: RateLimitMiddlewareOption) {
+  const message: OkoApiErrorResponse = {
+    success: false,
+    code: "RATE_LIMIT_EXCEEDED",
+    msg: `Too many requests, please try again after ${option.windowSeconds} seconds`,
+  };
+
+  return rateLimit({
+    windowMs: option.windowSeconds * 1000,
+    max: option.maxRequests,
+    message,
+    statusCode: 429,
+    standardHeaders: true,
+    legacyHeaders: false,
+  });
+}

backend/admin_api/src/routes/index.ts

@@ -53,6 +53,7 @@ import {
 import { customerLogoUploadMiddleware } from "@oko-wallet-admin-api/middleware/multer";
 
 import { adminAuthMiddleware } from "@oko-wallet-admin-api/middleware/auth";
+import { rateLimitMiddleware } from "@oko-wallet-admin-api/middleware/rate_limit";
 import { typeformWebhookMiddleware } from "../middleware/typeform_webhook";
 import { create_customer } from "./create_customer";
 import { get_customer_list } from "./get_customer_list";
@@ -413,7 +414,11 @@ export function makeOkoAdminRouter() {
       },
     },
   });
-  router.post("/user/login", user_login);
+  router.post(
+    "/user/login",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
+    user_login,
+  );
 
   registry.registerPath({
     method: "post",

backend/ct_dashboard_api/src/routes/customer_auth.ts

@@ -515,6 +515,7 @@ export function setCustomerAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/send-code",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<SendVerificationResponse>>) => {
       try {
         const state = req.app.locals;
@@ -618,6 +619,7 @@ export function setCustomerAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/verify-login",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<LoginResponse>>) => {
       try {
         const state = req.app.locals as any;
@@ -808,6 +810,7 @@ export function setCustomerAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/signin",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<LoginResponse>>) => {
       try {
         const state = req.app.locals as any;
@@ -998,6 +1001,7 @@ export function setCustomerAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/change-password",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     customerJwtMiddleware,
     async (
       req: CustomerAuthenticatedRequest<ChangePasswordRequest>,

backend/social_login_api/src/routes/social_login.ts

@@ -19,6 +19,7 @@ import {
   X_CLIENT_ID,
   X_SOCIAL_LOGIN_TOKEN_URL,
 } from "@oko-wallet-social-login-api/constants/x";
+import { rateLimitMiddleware } from "@oko-wallet-social-login-api/middleware/rate_limit";
 
 export function setSocialLoginRoutes(router: Router) {
   registry.registerPath({
@@ -66,6 +67,7 @@ export function setSocialLoginRoutes(router: Router) {
   });
   router.post(
     "/x/get-token",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (
       req: Request<any, any, SocialLoginXBody>,
       res: Response<OkoApiResponse<SocialLoginXResponse>>,
@@ -159,6 +161,7 @@ export function setSocialLoginRoutes(router: Router) {
   });
   router.get(
     "/x/verify-user",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (
       req: Request<any, any, null>,
       res: Response<OkoApiResponse<SocialLoginXVerifyUserResponse>>,

backend/user_dashboard_api/src/routes/user_auth.ts

@@ -42,6 +42,7 @@ import {
   customerJwtMiddleware,
   type CustomerAuthenticatedRequest,
 } from "@oko-wallet-usrd-api/middleware/auth";
+import { rateLimitMiddleware } from "@oko-wallet-usrd-api/middleware/rate_limit";
 
 export function setUserAuthRoutes(router: Router) {
   registry.registerPath({
@@ -98,6 +99,7 @@ export function setUserAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/send-code",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<SendVerificationResponse>>) => {
       try {
         const state = req.app.locals;
@@ -201,6 +203,7 @@ export function setUserAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/verify-login",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<LoginResponse>>) => {
       try {
         const state = req.app.locals as any;
@@ -391,6 +394,7 @@ export function setUserAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/signin",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     async (req, res: Response<OkoApiResponse<LoginResponse>>) => {
       try {
         const state = req.app.locals as any;
@@ -581,6 +585,7 @@ export function setUserAuthRoutes(router: Router) {
   });
   router.post(
     "/customer/auth/change-password",
+    rateLimitMiddleware({ windowSeconds: 60, maxRequests: 10 }),
     customerJwtMiddleware,
     async (
       req: CustomerAuthenticatedRequest<ChangePasswordRequest>,

yarn.lock

@@ -10049,6 +10049,7 @@ __metadata:
     "@oko-wallet/stdlib-js": "npm:0.0.2-rc.41"
     "@types/cors": "npm:^2.8.17"
     "@types/express": "npm:^5.0.6"
+    "@types/express-rate-limit": "npm:^6.0.2"
     "@types/he": "npm:^1.2.0"
     "@types/jest": "npm:^29.5.14"
     "@types/jsonwebtoken": "npm:^9.0.7"
@@ -10062,6 +10063,7 @@ __metadata:
     cors: "npm:^2.8.5"
     dotenv: "npm:^16.4.5"
     express: "npm:^4.21.1"
+    express-rate-limit: "npm:^8.2.1"
     he: "npm:^1.2.0"
     helmet: "npm:^8.0.0"
     jest: "npm:^30.1.3"
@@ -25369,7 +25371,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express-rate-limit@npm:*, express-rate-limit@npm:8.2.1":
+"express-rate-limit@npm:*, express-rate-limit@npm:8.2.1, express-rate-limit@npm:^8.2.1":
   version: 8.2.1
   resolution: "express-rate-limit@npm:8.2.1"
   dependencies: