feat: add rate limiting middleware to all API endpoints (#10)

.env.example

@@ -1,56 +1,66 @@
-# Server
-PORT=4000
-
-# Redis
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=
-REDIS_URL=redis://redis:6379
-
-# Database
-DATABASE_URL=postgres://smartdrop:smartdrop@postgres:5432/smartdrop
-# Runtime environment
-# NODE_ENV: string enum (development, test, production). Default: development.
-NODE_ENV=development
-
-# PORT: number. Default: 3000.
-PORT=3000
-
-# REDIS_URL: URL. Required in production. Development/test default: redis://localhost:6379.
-REDIS_URL=redis://localhost:6379
-
-# DATABASE_URL: URL. Required in production. Development default: postgres://localhost/smartdrop. Test default: postgres://localhost/smartdrop_test.
-DATABASE_URL=postgres://localhost/smartdrop
-
-# STELLAR_HORIZON_URL: URL. Default: https://horizon.stellar.org.
-STELLAR_HORIZON_URL=https://horizon.stellar.org
-
-# USDC_ISSUER: Stellar public key. Default: Stellar USDC issuer.
-USDC_ISSUER=GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335AX2OBFLDTQLNUEHRGPTM6RIA
-
-# COINGECKO_API_KEY: string. Optional. Default: empty.
-COINGECKO_API_KEY=
-
-# COINMARKETCAP_API_KEY: string. Optional. Default: empty.
-COINMARKETCAP_API_KEY=
-
-# PRICE_CACHE_TTL_SECONDS: number. Default: 60.
-PRICE_CACHE_TTL_SECONDS=60
-
-# PRICE_REFRESH_INTERVAL_SECONDS: number. Default: 30.
-PRICE_REFRESH_INTERVAL_SECONDS=30
-
-# PRICE_STALE_THRESHOLD_MINUTES: number. Default: 5.
-PRICE_STALE_THRESHOLD_MINUTES=5
-
-# PRICE_ANOMALY_THRESHOLD_PCT: number. Default: 20.
-PRICE_ANOMALY_THRESHOLD_PCT=20
-
-# API key auth
-ADMIN_API_KEY=
-
-# LOG_LEVEL: string enum (debug, info, warn, error). Default: info.
-LOG_LEVEL=info
-
-# CORS
+# Server
+PORT=4000
+
+# Redis
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_URL=redis://redis:6379
+
+# Database
+DATABASE_URL=postgres://smartdrop:smartdrop@postgres:5432/smartdrop
+# Runtime environment
+# NODE_ENV: string enum (development, test, production). Default: development.
+NODE_ENV=development
+
+# PORT: number. Default: 3000.
+PORT=3000
+
+# REDIS_URL: URL. Required in production. Development/test default: redis://localhost:6379.
+REDIS_URL=redis://localhost:6379
+
+# DATABASE_URL: URL. Required in production. Development default: postgres://localhost/smartdrop. Test default: postgres://localhost/smartdrop_test.
+DATABASE_URL=postgres://localhost/smartdrop
+
+# STELLAR_HORIZON_URL: URL. Default: https://horizon.stellar.org.
+STELLAR_HORIZON_URL=https://horizon.stellar.org
+
+# USDC_ISSUER: Stellar public key. Default: Stellar USDC issuer.
+USDC_ISSUER=GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335AX2OBFLDTQLNUEHRGPTM6RIA
+
+# COINGECKO_API_KEY: string. Optional. Default: empty.
+COINGECKO_API_KEY=
+
+# COINMARKETCAP_API_KEY: string. Optional. Default: empty.
+COINMARKETCAP_API_KEY=
+
+# PRICE_CACHE_TTL_SECONDS: number. Default: 60.
+PRICE_CACHE_TTL_SECONDS=60
+
+# PRICE_REFRESH_INTERVAL_SECONDS: number. Default: 30.
+PRICE_REFRESH_INTERVAL_SECONDS=30
+
+# PRICE_STALE_THRESHOLD_MINUTES: number. Default: 5.
+PRICE_STALE_THRESHOLD_MINUTES=5
+
+# PRICE_ANOMALY_THRESHOLD_PCT: number. Default: 20.
+PRICE_ANOMALY_THRESHOLD_PCT=20
+
+# API key auth
+ADMIN_API_KEY=
+
+# LOG_LEVEL: string enum (debug, info, warn, error). Default: info.
+LOG_LEVEL=info
+
+# Rate limiting (Redis-backed, per IP)
+# RATE_LIMIT_WINDOW_MS: global API window in milliseconds. Default: 60000 (1 minute).
+RATE_LIMIT_WINDOW_MS=60000
+# RATE_LIMIT_MAX: max requests per IP per global window. Default: 100.
+RATE_LIMIT_MAX=100
+# PRICE_RATELIMIT_WINDOW: price endpoint window in seconds. Default: 60.
+PRICE_RATELIMIT_WINDOW=60
+# PRICE_RATELIMIT_MAX: max price requests per IP per window. Default: 30.
+PRICE_RATELIMIT_MAX=30
+
+# CORS
 CORS_ALLOWED_ORIGINS=http://localhost:4000,http://localhost:3001

src/config.js

@@ -1,101 +1,109 @@
-require('dotenv').config();
-
-const { cleanEnv, makeValidator, num, port, str, url } = require('envalid');
-
-const stellarAddress = makeValidator((input) => {
-  if (!/^G[A-Z0-9]{55}$/.test(input)) {
-    throw new Error('must be a valid Stellar public key');
-  }
-  return input;
-});
-
-const databaseDevDefault =
-  process.env.NODE_ENV === 'test'
-    ? 'postgres://localhost/smartdrop_test'
-    : 'postgres://localhost/smartdrop';
-
-const rawEnv = {
-  ...process.env,
-  NODE_ENV: process.env.NODE_ENV || 'development',
-};
-
-const env = cleanEnv(rawEnv, {
-  NODE_ENV: str({
-    default: 'development',
-    choices: ['development', 'test', 'production'],
-  }),
-  PORT: port({ default: 3000 }),
-  REDIS_URL: url({ devDefault: 'redis://localhost:6379' }),
-  DATABASE_URL: url({ devDefault: databaseDevDefault }),
-  STELLAR_HORIZON_URL: url({ default: 'https://horizon.stellar.org' }),
-  USDC_ISSUER: stellarAddress({
-    default: 'GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335AX2OBFLDTQLNUEHRGPTM6RIA',
-  }),
-  COINGECKO_API_KEY: str({ default: '' }),
-  COINMARKETCAP_API_KEY: str({ default: '' }),
-  ADMIN_API_KEY: str({ default: '' }),
-  PRICE_CACHE_TTL_SECONDS: num({ default: 60 }),
-  PRICE_REFRESH_INTERVAL_SECONDS: num({ default: 30 }),
-  PRICE_STALE_THRESHOLD_MINUTES: num({ default: 5 }),
-  PRICE_ANOMALY_THRESHOLD_PCT: num({ default: 20 }),
-  LOG_LEVEL: str({
-    default: 'info',
-    choices: ['debug', 'info', 'warn', 'error'],
-  }),
-});
-
-const usdcIssuer = env.USDC_ISSUER;
-
-module.exports = {
-  nodeEnv: env.NODE_ENV,
-  port: env.PORT,
-  databaseUrl: env.DATABASE_URL,
-  redis: {
-    url: env.REDIS_URL,
-  },
-  stellar: {
-    horizonUrl: env.STELLAR_HORIZON_URL,
-    usdcIssuer,
-  },
-  coingecko: {
-    apiKey: env.COINGECKO_API_KEY,
-    baseUrl: 'https://api.coingecko.com/api/v3',
-  },
-  coinmarketcap: {
-    apiKey: env.COINMARKETCAP_API_KEY,
-    baseUrl: 'https://pro-api.coinmarketcap.com/v1',
-    assetIssuerMap: {
-      XLM: { symbol: 'XLM' },
-      [`USDC:${usdcIssuer}`]: { id: 3408 },
-    },
-  },
-  price: {
-    cacheTtl: env.PRICE_CACHE_TTL_SECONDS,
-    refreshInterval: env.PRICE_REFRESH_INTERVAL_SECONDS,
-    staleThresholdMinutes: env.PRICE_STALE_THRESHOLD_MINUTES,
-    anomalyThresholdPercent: env.PRICE_ANOMALY_THRESHOLD_PCT,
-  },
-  auth: {
-    adminApiKey: env.ADMIN_API_KEY,
-  },
-  corsAllowedOrigins: (process.env.CORS_ALLOWED_ORIGINS || 'http://localhost:3000,http://localhost:3001')
-    .split(',')
-    .map((o) => o.trim())
-    .filter(Boolean),
-  webhooks: {
-    maxAttempts: parseInt(process.env.WEBHOOK_MAX_ATTEMPTS, 10) || 3,
-    retryBaseMs: parseInt(process.env.WEBHOOK_RETRY_BASE_MS, 10) || 30000,
-    retryFactor: parseFloat(process.env.WEBHOOK_RETRY_FACTOR) || 2,
-    timeoutMs: parseInt(process.env.WEBHOOK_TIMEOUT_MS, 10) || 5000,
-    retryPollMs: parseInt(process.env.WEBHOOK_RETRY_POLL_MS, 10) || 5000,
-    retryBatchSize: parseInt(process.env.WEBHOOK_RETRY_BATCH, 10) || 25,
-    rateLimit: {
-      windowSeconds: parseInt(process.env.WEBHOOK_RATELIMIT_WINDOW, 10) || 60,
-      max: parseInt(process.env.WEBHOOK_RATELIMIT_MAX, 10) || 60,
-    },
-    testRateLimit: {
-      windowSeconds: parseInt(process.env.WEBHOOK_TEST_RATELIMIT_WINDOW, 10) || 60,
-      max: parseInt(process.env.WEBHOOK_TEST_RATELIMIT_MAX, 10) || 5,
-    },
-  },
-};
+require('dotenv').config();
+
+const { cleanEnv, makeValidator, num, port, str, url } = require('envalid');
+
+const stellarAddress = makeValidator((input) => {
+  if (!/^G[A-Z0-9]{55}$/.test(input)) {
+    throw new Error('must be a valid Stellar public key');
+  }
+  return input;
+});
+
+const databaseDevDefault =
+  process.env.NODE_ENV === 'test'
+    ? 'postgres://localhost/smartdrop_test'
+    : 'postgres://localhost/smartdrop';
+
+const rawEnv = {
+  ...process.env,
+  NODE_ENV: process.env.NODE_ENV || 'development',
+};
+
+const env = cleanEnv(rawEnv, {
+  NODE_ENV: str({
+    default: 'development',
+    choices: ['development', 'test', 'production'],
+  }),
+  PORT: port({ default: 3000 }),
+  REDIS_URL: url({ devDefault: 'redis://localhost:6379' }),
+  DATABASE_URL: url({ devDefault: databaseDevDefault }),
+  STELLAR_HORIZON_URL: url({ default: 'https://horizon.stellar.org' }),
+  USDC_ISSUER: stellarAddress({
+    default: 'GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335AX2OBFLDTQLNUEHRGPTM6RIA',
+  }),
+  COINGECKO_API_KEY: str({ default: '' }),
+  COINMARKETCAP_API_KEY: str({ default: '' }),
+  ADMIN_API_KEY: str({ default: '' }),
+  PRICE_CACHE_TTL_SECONDS: num({ default: 60 }),
+  PRICE_REFRESH_INTERVAL_SECONDS: num({ default: 30 }),
+  PRICE_STALE_THRESHOLD_MINUTES: num({ default: 5 }),
+  PRICE_ANOMALY_THRESHOLD_PCT: num({ default: 20 }),
+  LOG_LEVEL: str({
+    default: 'info',
+    choices: ['debug', 'info', 'warn', 'error'],
+  }),
+});
+
+const usdcIssuer = env.USDC_ISSUER;
+
+module.exports = {
+  nodeEnv: env.NODE_ENV,
+  port: env.PORT,
+  databaseUrl: env.DATABASE_URL,
+  redis: {
+    url: env.REDIS_URL,
+  },
+  stellar: {
+    horizonUrl: env.STELLAR_HORIZON_URL,
+    usdcIssuer,
+  },
+  coingecko: {
+    apiKey: env.COINGECKO_API_KEY,
+    baseUrl: 'https://api.coingecko.com/api/v3',
+  },
+  coinmarketcap: {
+    apiKey: env.COINMARKETCAP_API_KEY,
+    baseUrl: 'https://pro-api.coinmarketcap.com/v1',
+    assetIssuerMap: {
+      XLM: { symbol: 'XLM' },
+      [`USDC:${usdcIssuer}`]: { id: 3408 },
+    },
+  },
+  price: {
+    cacheTtl: env.PRICE_CACHE_TTL_SECONDS,
+    refreshInterval: env.PRICE_REFRESH_INTERVAL_SECONDS,
+    staleThresholdMinutes: env.PRICE_STALE_THRESHOLD_MINUTES,
+    anomalyThresholdPercent: env.PRICE_ANOMALY_THRESHOLD_PCT,
+  },
+  auth: {
+    adminApiKey: env.ADMIN_API_KEY,
+  },
+  corsAllowedOrigins: (process.env.CORS_ALLOWED_ORIGINS || 'http://localhost:3000,http://localhost:3001')
+    .split(',')
+    .map((o) => o.trim())
+    .filter(Boolean),
+  rateLimit: {
+    windowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS, 10) || 60000,
+    max: parseInt(process.env.RATE_LIMIT_MAX, 10) || 100,
+  },
+  priceRateLimit: {
+    windowSeconds: parseInt(process.env.PRICE_RATELIMIT_WINDOW, 10) || 60,
+    max: parseInt(process.env.PRICE_RATELIMIT_MAX, 10) || 30,
+  },
+  webhooks: {
+    maxAttempts: parseInt(process.env.WEBHOOK_MAX_ATTEMPTS, 10) || 3,
+    retryBaseMs: parseInt(process.env.WEBHOOK_RETRY_BASE_MS, 10) || 30000,
+    retryFactor: parseFloat(process.env.WEBHOOK_RETRY_FACTOR) || 2,
+    timeoutMs: parseInt(process.env.WEBHOOK_TIMEOUT_MS, 10) || 5000,
+    retryPollMs: parseInt(process.env.WEBHOOK_RETRY_POLL_MS, 10) || 5000,
+    retryBatchSize: parseInt(process.env.WEBHOOK_RETRY_BATCH, 10) || 25,
+    rateLimit: {
+      windowSeconds: parseInt(process.env.WEBHOOK_RATELIMIT_WINDOW, 10) || 60,
+      max: parseInt(process.env.WEBHOOK_RATELIMIT_MAX, 10) || 60,
+    },
+    testRateLimit: {
+      windowSeconds: parseInt(process.env.WEBHOOK_TEST_RATELIMIT_WINDOW, 10) || 60,
+      max: parseInt(process.env.WEBHOOK_TEST_RATELIMIT_MAX, 10) || 5,
+    },
+  },
+};