feat(api): implement granular rate limiting for waitlist endpoints

apps/api/src/modules/waitlist/join-waitlist/router.ts

@@ -1,20 +1,24 @@
+import { fixedWindow } from 'bunlimit';
 import { Elysia } from 'elysia';
-
 import { databaseMiddleware } from '../../../shared/http/middlewares/database';
+import { rateLimitMiddleware } from '../../../shared/http/middlewares/rate-limitter';
 import { joinWaitlistBodySchema, joinWaitlistSuccessResponseSchema } from './schemas';
 import { joinWaitlistUseCase } from './use-case';
 
-export const joinWaitlistRouter = new Elysia().use(databaseMiddleware).post(
-  '/join',
-  async ({ body, status, db }) => {
-    const { entry } = await joinWaitlistUseCase(db, { email: body.email });
+export const joinWaitlistRouter = new Elysia()
+  .use(rateLimitMiddleware({ strategy: fixedWindow(5, 120), key: 'join-waitlist' }))
+  .use(databaseMiddleware)
+  .post(
+    '/join',
+    async ({ body, status, db }) => {
+      const { entry } = await joinWaitlistUseCase(db, { email: body.email });
 
-    return status(201, entry);
-  },
-  {
-    body: joinWaitlistBodySchema,
-    response: {
-      201: joinWaitlistSuccessResponseSchema
+      return status(201, entry);
+    },
+    {
+      body: joinWaitlistBodySchema,
+      response: {
+        201: joinWaitlistSuccessResponseSchema
+      }
     }
-  }
-);
+  );

apps/api/src/modules/waitlist/router.ts

@@ -1,13 +1,15 @@
+import { tokenBucket } from 'bunlimit';
 import { Elysia } from 'elysia';
-
+import { rateLimitMiddleware } from '../../shared/http/middlewares/rate-limitter';
 import { getWaitlistRouter } from './get-count/router';
 import { getWaitlistJoinDateRouter } from './get-waitlist-join-date/router';
 import { joinWaitlistRouter } from './join-waitlist/router';
 import { unsubscribeWaitlistRouter } from './unsubscribe-waitlist/router';
 
-export const waitlistRouter = new Elysia({ prefix: '/waitlist', tags: ['waitlist'] }).use([
-  joinWaitlistRouter,
-  getWaitlistRouter,
-  getWaitlistJoinDateRouter,
-  unsubscribeWaitlistRouter
-]);
+export const waitlistRouter = new Elysia({ prefix: '/waitlist', tags: ['waitlist'] })
+  .use(joinWaitlistRouter)
+  .group('', (app) =>
+    app
+      .use(rateLimitMiddleware({ strategy: tokenBucket(5, 30) }))
+      .use([getWaitlistRouter, getWaitlistJoinDateRouter, unsubscribeWaitlistRouter])
+  );

apps/api/src/shared/http/index.ts

@@ -7,7 +7,6 @@ import { z } from 'zod';
 import { waitlistRouter } from '../../modules/waitlist/router';
 import { envs } from '../config/envs';
 import { errorHandler } from './middlewares/error-handler';
-import { rateLimitMiddleware } from './middlewares/rate-limitter';
 
 const app = new Elysia()
   .use(cors())
@@ -17,7 +16,6 @@ const app = new Elysia()
     })
   )
   .use(errorHandler)
-  .use(rateLimitMiddleware)
   .use(
     openapi({
       path: '/swagger',

apps/api/src/shared/http/middlewares/rate-limitter.ts

@@ -1,26 +1,25 @@
-import { Ratelimit, tokenBucket } from 'bunlimit';
+import type { Algorithm } from 'bunlimit';
+import { Ratelimit } from 'bunlimit';
 import Elysia from 'elysia';
 
 import { RateLimitError } from '../../errors/rate-limit-error';
 import { redis } from '../../providers/redis';
 
-const ratelimit = new Ratelimit({
-  redis,
-  limiter: tokenBucket(5, 30)
-});
+export const rateLimitMiddleware = ({ strategy, key }: { strategy: Algorithm; key?: string }) =>
+  new Elysia({ name: 'rate-limit' }).onBeforeHandle({ as: 'scoped' }, async ({ request }) => {
+    const ratelimit = new Ratelimit({
+      redis,
+      limiter: strategy
+    });
 
-export const rateLimitMiddleware = new Elysia({ name: 'rate-limit' }).onBeforeHandle(
-  { as: 'global' },
-  async ({ request }) => {
     const ip =
       request.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
       request.headers.get('x-real-ip') ||
       'unknown';
 
-    const { success } = await ratelimit.limit(ip);
+    const { success } = await ratelimit.limit(key ? `${key}:${ip}` : ip);
 
     if (!success) throw new RateLimitError('Rate limit exceeded');
 
     return;
-  }
-);
+  });