✨ Add rate limiter

package.json

@@ -22,9 +22,11 @@
     "cors": "^2.8.5",
     "dotenv": "^16.0.3",
     "express": "^4.18.2",
+    "moment": "^2.29.4",
     "mongoose": "^6.7.5",
     "multer": "^1.4.5-lts.1",
     "openai": "^3.2.1",
+    "redis": "^4.6.5",
     "uuid": "^9.0.0"
   },
   "devDependencies": {

src/app/index.js

@@ -6,9 +6,10 @@ const mongoose = require("mongoose");
 const bodyParser = require("body-parser")
 
 const connectDB = require('../config/dbConnection');
-const corsOptions = require('../config/corsOptions');
+// const corsOptions = require('../config/corsOptions');
 const checkOrigins = require('../middleware/checkOrigins');
 const v1PastPaperRoutes = require('../v1/routes/pastPaperRoutes');
+const { redisRateLimiter } = require('../middleware/rateLimiter');
 
 // Connect to MongoDB
 connectDB();
@@ -24,6 +25,8 @@ app.use(checkOrigins);
 // Cross Origin Resource Sharing
 app.use(cors({ origin: "*" }));
 
+app.use(redisRateLimiter)
+
 // middleware for json 
 app.use(express.json());
 

src/middleware/rateLimiter.js

@@ -0,0 +1,67 @@
+import moment from "moment";
+import redis from "redis";
+
+const redisClient = redis.createClient();
+redisClient.on("error", (err) => console.log("Redis error: ", err));
+
+const WINDOW_SIZE_IN_HOURS = 24;
+const MAX_WINDOW_REQUEST_COUNT = 100;
+const WINDOW_LOG_INTERVAL_IN_HOURS = 1;
+
+export const redisRateLimiter = async ( req, res, next ) => {
+    await redisClient.connect();
+    try {
+        // check that redis client exists
+        if (!redisClient) {
+            throw new Error("Redis client does not exist!");
+        }
+        const record = await redisClient.get(req.ip);
+        const currentRequestTime = moment();
+        console.log("Current time: ", currentRequestTime.format());
+        // if no record exists, create a new record for user
+        if (record == null) {
+            let newRecord = [];
+            let requestLog = {
+                requestTimeStamp: currentRequestTime.unix(),
+                requestCount: 1,
+            }
+            newRecord.push(requestLog);
+            await redisClient.set(req.ip, JSON.stringify(newRecord));
+            next();
+        }
+        // if record exists, parse data and determine whether user has reached max requests per window
+        let data = JSON.parse(record);
+        let windowStartTimestamp = moment().subtract(WINDOW_SIZE_IN_HOURS, "hours").unix();
+        let requestsWithinWindow = data.filter(entry => {
+            return entry.requestTimeStamp > windowStartTimestamp;
+        })
+        console.log("Request data within window: ", requestsWithinWindow);
+        let totalWindowRequestsCount = requestsWithinWindow.reduce((accumulator, entry) => {
+            return accumulator + entry.requestCount;
+        }, 0);
+
+        if (totalWindowRequestsCount >= MAX_WINDOW_REQUEST_COUNT) {
+            return res.status(429).send("You have exceeded the " + MAX_WINDOW_REQUEST_COUNT + " requests in " + WINDOW_SIZE_IN_HOURS + " hrs limit!");
+        }
+        else {
+            // if user has not reached max requests per window, increment counter
+            let lastRequestLog = data[data.length - 1];
+            let potentialCurrentWindowIntervalStartTimeStamp = currentRequestTime.subtract(WINDOW_LOG_INTERVAL_IN_HOURS, "hours").unix();
+            if (lastRequestLog.requestTimeStamp < potentialCurrentWindowIntervalStartTimeStamp) {
+                let requestLog = {
+                    requestTimeStamp: currentRequestTime.unix(),
+                    requestCount: 1,
+                }
+                data.push(requestLog);
+            }
+            else {
+                lastRequestLog.requestCount++;
+            }
+            await redisClient.set(req.ip, JSON.stringify(data));
+            next();
+        }
+
+    } catch(err) {
+        next(err)
+    }
+}

src/v1/routes/pastPaperRoutes.js

@@ -7,9 +7,9 @@ const { uploadImages } = require('../../middleware/imageUpload');
 
 router.get('/', pastPaperController.fetchAllPapers);
 router.get('/:pastPaperId', getPastPaper, pastPaperController.fetchSinglePastPaper);
-router.post(`/${process.env.ACCESS_CODE}/`, uploadImages.array("images", 10), pastPaperController.addPastPaper);
-router.patch(`/${process.env.ACCESS_CODE}/:pastPaperId`, getPastPaper, pastPaperController.updatePastPaper);
-router.delete(`/${process.env.ACCESS_CODE}/:pastPaperId`, getPastPaper, pastPaperController.deletePastPaper);
+router.post("/", uploadImages.array("images", 10), pastPaperController.addPastPaper);
+router.patch("/:pastPaperId", getPastPaper, pastPaperController.updatePastPaper);
+router.delete("/:pastPaperId", getPastPaper, pastPaperController.deletePastPaper);
 router.post("/gpt", chatGPTPrompt.getAnswers);
 
 module.exports = router;