Merge pull request #87 from CleanDev-Fix/cleandev-fix/rate-limit-public-endpoints-56

Add public API rate limit tiers

Author: jobbykings

backend/src/index.js

@@ -44,7 +44,10 @@ const quizRoutes = resolveRoute(require('./routes/quizRoutes'));
 const eventLoggerRoutes = resolveRoute(require('./routes/eventLoggerRoutes'));
 const syncRoutes = resolveRoute(require('./routes/syncRoutes'));
 const rbacRoutes = resolveRoute(require('./routes/rbacRoutes'));
+const authRoutes = require('./routes/auth');
 const contentRoutes = require('./routes/content');
+const courseRoutes = require('./routes/courses');
+const searchRoutes = require('./routes/search');
 const transactionRoutes = require('./routes/transactions');
 const notificationRoutes = resolveRoute(require('./routes/notificationRoutes'));
 
@@ -113,7 +116,10 @@ const v1Router = createVersionedRouter('v1');
 v1Router.use('/quizzes', quizRoutes);
 v1Router.use('/events', eventLoggerRoutes);
 v1Router.use('/sync', syncRoutes);
+v1Router.use('/auth', authRoutes);
 v1Router.use('/content', contentRoutes);
+v1Router.use('/courses', courseRoutes);
+v1Router.use('/search', searchRoutes);
 v1Router.use('/rbac', rbacRoutes);
 v1Router.use('/transactions', transactionRoutes);
 v1Router.use('/notifications', notificationRoutes);

backend/src/middleware/rateLimit.ts

@@ -5,6 +5,8 @@
 
 import rateLimit from 'express-rate-limit';
 
+const ONE_MINUTE = 60 * 1000;
+
 export interface RateLimitOptions {
   windowMs: number; // Time window in milliseconds
   max: number; // Max requests per window
@@ -15,13 +17,31 @@ export interface RateLimitOptions {
   skipFailedRequests?: boolean;
 }
 
+export const publicRateLimitTiers = {
+  strict: {
+    windowMs: ONE_MINUTE,
+    max: 5,
+    message: 'Too many authentication attempts, please try again after a minute',
+  },
+  moderate: {
+    windowMs: ONE_MINUTE,
+    max: 30,
+    message: 'Too many content write requests, please try again after a minute',
+  },
+  liberal: {
+    windowMs: ONE_MINUTE,
+    max: 100,
+    message: 'Too many read requests, please try again after a minute',
+  },
+} as const;
+
 export const rateLimitMiddleware = (options: RateLimitOptions) => {
   return rateLimit({
     windowMs: options.windowMs,
     max: options.max,
     message: options.message || 'Too many requests from this IP, please try again later.',
     standardHeaders: options.standardHeaders !== false, // Send rate limit info in headers
-    legacyHeaders: options.legacyHeaders !== false, // Send rate limit info in legacy headers
+    legacyHeaders: options.legacyHeaders !== false, // Send X-RateLimit-* headers
     skipSuccessfulRequests: options.skipSuccessfulRequests || false,
     skipFailedRequests: options.skipFailedRequests || false,
     handler: (req, res) => {
@@ -35,31 +55,25 @@ export const rateLimitMiddleware = (options: RateLimitOptions) => {
 
 // Predefined rate limit configurations
 export const rateLimits = {
-  // Very strict limits for sensitive operations
-  auth: rateLimitMiddleware({
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 5, // 5 attempts per 15 minutes
-    message: 'Too many authentication attempts, please try again later.'
-  }),
+  strict: rateLimitMiddleware(publicRateLimitTiers.strict),
+
+  moderate: rateLimitMiddleware(publicRateLimitTiers.moderate),
+
+  liberal: rateLimitMiddleware(publicRateLimitTiers.liberal),
+
+  auth: rateLimitMiddleware(publicRateLimitTiers.strict),
 
   // Strict limits for file uploads
   upload: rateLimitMiddleware({
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 20, // 20 uploads per 15 minutes
-    message: 'Too many file uploads, please try again later.'
+    ...publicRateLimitTiers.moderate,
+    message: 'Too many file uploads, please try again after a minute.'
   }),
 
   // Moderate limits for general API usage
-  general: rateLimitMiddleware({
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 100, // 100 requests per 15 minutes
-  }),
+  general: rateLimitMiddleware(publicRateLimitTiers.moderate),
 
   // Lenient limits for read-only operations
-  readOnly: rateLimitMiddleware({
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 200, // 200 requests per 15 minutes
-  }),
+  readOnly: rateLimitMiddleware(publicRateLimitTiers.liberal),
 
   // Very lenient limits for static content
   static: rateLimitMiddleware({

backend/src/middleware/rateLimiter.js

@@ -3,6 +3,32 @@ const redisConfig = require('../config/redis');
 const securityConfig = require('../config/security');
 const logger = require('../utils/logger');
 
+const ONE_MINUTE = 60 * 1000;
+
+const publicRateLimitTiers = {
+  strict: {
+    windowMs: ONE_MINUTE,
+    max: 5,
+    message: 'Too many authentication attempts, please try again after a minute',
+    keyPrefix: 'rl:public:strict:',
+    keyByUser: false,
+  },
+  moderate: {
+    windowMs: ONE_MINUTE,
+    max: 30,
+    message: 'Too many content write requests, please try again after a minute',
+    keyPrefix: 'rl:public:moderate:',
+    keyByUser: true,
+  },
+  liberal: {
+    windowMs: ONE_MINUTE,
+    max: 100,
+    message: 'Too many read requests, please try again after a minute',
+    keyPrefix: 'rl:public:liberal:',
+    keyByUser: false,
+  },
+};
+
 /**
  * Custom Simple Redis Store for express-rate-limit
  */
@@ -21,12 +47,11 @@ class RedisStore {
       multi.expire(fullKey, this.expiry);
       const results = await multi.exec();
 
-      const currentCount = results[0];
-      const ttl = results[1];
+      const currentCount = Array.isArray(results[0]) ? results[0][1] : results[0];
 
       return {
         totalHits: currentCount,
-        resetTime: new Date(Date.now() + (ttl * 1000 || this.expiry * 1000))
+        resetTime: new Date(Date.now() + (this.expiry * 1000))
       };
     } catch (error) {
       logger.error(`RedisStore error for key ${fullKey}:`, error);
@@ -63,6 +88,7 @@ const createRateLimiter = (options = {}) => {
     max = securityConfig.tiers.default.max,
     message = securityConfig.tiers.default.message,
     keyPrefix = 'rl:',
+    keyByUser = true,
   } = options;
 
   const securityService = require('../services/securityService');
@@ -75,7 +101,7 @@ const createRateLimiter = (options = {}) => {
       message,
     },
     standardHeaders: true,
-    legacyHeaders: false,
+    legacyHeaders: true,
     store: new RedisStore({
       prefix: keyPrefix,
       expiry: Math.ceil(windowMs / 1000),
@@ -94,11 +120,10 @@ const createRateLimiter = (options = {}) => {
       res.status(options.statusCode).send(options.message);
     },
     keyGenerator: (req) => {
-      // Use user ID if authenticated, else fallback to IP
-      if (req.user && (req.user.id || req.user.sub)) {
-        return `${keyPrefix}${req.user.id || req.user.sub}`;
+      if (keyByUser && req.user && (req.user.id || req.user.sub || req.user.userId)) {
+        return `user:${req.user.id || req.user.sub || req.user.userId}`;
       }
-      return req.ip;
+      return `ip:${req.ip}`;
     },
     skip: (req) => {
       // Skip whitelisted IPs or in test environment (unless explicitly testing security)
@@ -141,9 +166,7 @@ const adminLimiter = createRateLimiter({
 
 // Endpoint-specific limiters
 const authLimiter = createRateLimiter({
-  windowMs: securityConfig.endpoints.auth.windowMs,
-  max: securityConfig.endpoints.auth.max,
-  message: securityConfig.endpoints.auth.message,
+  ...publicRateLimitTiers.strict,
   keyPrefix: 'rl:auth:',
 });
 
@@ -161,6 +184,32 @@ const ipfsLimiter = createRateLimiter({
   keyPrefix: 'rl:ipfs:',
 });
 
+const strictLimiter = createRateLimiter(publicRateLimitTiers.strict);
+
+const moderateLimiter = createRateLimiter(publicRateLimitTiers.moderate);
+
+const liberalLimiter = createRateLimiter(publicRateLimitTiers.liberal);
+
+const contentWriteLimiter = createRateLimiter({
+  ...publicRateLimitTiers.moderate,
+  keyPrefix: 'rl:content:write:',
+});
+
+const readLimiter = createRateLimiter({
+  ...publicRateLimitTiers.liberal,
+  keyPrefix: 'rl:public:read:',
+});
+
+const searchWriteLimiter = createRateLimiter({
+  ...publicRateLimitTiers.moderate,
+  keyPrefix: 'rl:search:write:',
+});
+
+const courseWriteLimiter = createRateLimiter({
+  ...publicRateLimitTiers.moderate,
+  keyPrefix: 'rl:courses:write:',
+});
+
 /**
  * Middleware to select rate limiter based on user role
  */
@@ -189,5 +238,13 @@ module.exports = {
   authLimiter,
   transactionLimiter,
   ipfsLimiter,
+  strictLimiter,
+  moderateLimiter,
+  liberalLimiter,
+  contentWriteLimiter,
+  readLimiter,
+  searchWriteLimiter,
+  courseWriteLimiter,
+  publicRateLimitTiers,
   createRateLimiter
 };

backend/src/routes/auth.js

@@ -3,7 +3,7 @@ const jwt = require('jsonwebtoken');
 const bcrypt = require('bcryptjs');
 const { authenticateToken, requireAdmin, requirePermission } = require('../middleware/auth');
 const { UserRole, PERMISSIONS } = require('../utils/roles');
-const { authLimiter } = require('../middleware/rateLimiter');
+const { authLimiter, readLimiter, moderateLimiter } = require('../middleware/rateLimiter');
 const securityService = require('../services/securityService');
 const router = express.Router();
 
@@ -169,7 +169,7 @@ router.post('/login', authLimiter, async (req, res) => {
  * Get current user profile
  * GET /api/auth/profile
  */
-router.get('/profile', authenticateToken, (req, res) => {
+router.get('/profile', readLimiter, authenticateToken, (req, res) => {
   const user = users.get(req.user.id);
 
   if (!user) {
@@ -195,7 +195,7 @@ router.get('/profile', authenticateToken, (req, res) => {
  * Update user profile
  * PUT /api/auth/profile
  */
-router.put('/profile', authenticateToken, async (req, res) => {
+router.put('/profile', moderateLimiter, authenticateToken, async (req, res) => {
   try {
     const { username, email, currentPassword, newPassword } = req.body;
     const user = users.get(req.user.id);
@@ -286,6 +286,7 @@ router.put('/profile', authenticateToken, async (req, res) => {
  * PUT /api/auth/assign-role/:userId
  */
 router.put('/assign-role/:userId', 
+  moderateLimiter,
   authenticateToken, 
   requireAdmin, 
   requirePermission(PERMISSIONS.USER_ASSIGN_ROLE),
@@ -341,6 +342,7 @@ router.put('/assign-role/:userId',
  * GET /api/auth/users
  */
 router.get('/users', 
+  readLimiter,
   authenticateToken, 
   requireAdmin, 
   requirePermission(PERMISSIONS.USER_READ),
@@ -393,6 +395,7 @@ router.get('/users',
  * DELETE /api/auth/users/:userId
  */
 router.delete('/users/:userId', 
+  moderateLimiter,
   authenticateToken, 
   requireAdmin, 
   requirePermission(PERMISSIONS.USER_DELETE),

backend/src/routes/content.js

@@ -6,7 +6,7 @@ const { requirePermission } = require('../middleware/rbac');
 const { PERMISSIONS } = require('../utils/roles');
 const { ipfsAuth, optionalIpfsAuth, validateContentAccess, validateFileSize } = require('../middleware/ipfsAuth');
 const { createIpfsError } = require('../utils/ipfsUtils');
-const { ipfsLimiter } = require('../middleware/rateLimiter');
+const { contentWriteLimiter, readLimiter } = require('../middleware/rateLimiter');
 
 // Configure multer for file uploads
 const storage = multer.memoryStorage();
@@ -27,8 +27,8 @@ const upload = multer({
  * POST /api/content/upload
  */
 router.post('/upload', 
+  contentWriteLimiter,
   requirePermission(PERMISSIONS.CONTENT_CREATE),
-  ipfsLimiter,
   ipfsAuth('upload'),
   upload.single('file'),
   validateFileSize,
@@ -90,8 +90,8 @@ router.post('/upload',
  * POST /api/content/upload/batch
  */
 router.post('/upload/batch',
+  contentWriteLimiter,
   requirePermission(PERMISSIONS.CONTENT_CREATE),
-  ipfsLimiter,
   ipfsAuth('upload'),
   upload.array('files', 10),
   validateFileSize,
@@ -158,6 +158,7 @@ router.post('/upload/batch',
  * GET /api/content/:cid
  */
 router.get('/:cid',
+  readLimiter,
   requirePermission(PERMISSIONS.CONTENT_READ),
   validateContentAccess,
   async (req, res) => {
@@ -215,6 +216,7 @@ router.get('/:cid',
  * GET /api/content/:cid/metadata
  */
 router.get('/:cid/metadata',
+  readLimiter,
   requirePermission(PERMISSIONS.CONTENT_READ),
   validateContentAccess,
   async (req, res) => {
@@ -262,6 +264,7 @@ router.get('/:cid/metadata',
  * POST /api/content/:cid/pin
  */
 router.post('/:cid/pin',
+  contentWriteLimiter,
   requirePermission(PERMISSIONS.COURSE_UPDATE), // Pinning requires course update permission
   validateContentAccess,
   async (req, res) => {
@@ -301,6 +304,7 @@ router.post('/:cid/pin',
  * DELETE /api/content/:cid/pin
  */
 router.delete('/:cid/pin',
+  contentWriteLimiter,
   requirePermission(PERMISSIONS.COURSE_UPDATE),
   validateContentAccess,
   async (req, res) => {
@@ -340,6 +344,7 @@ router.delete('/:cid/pin',
  * GET /api/content/node/info
  */
 router.get('/node/info',
+  readLimiter,
   requirePermission(PERMISSIONS.SYSTEM_MANAGE),
   async (req, res) => {
     try {
@@ -375,6 +380,7 @@ router.get('/node/info',
  * GET /api/content/cache/stats
  */
 router.get('/cache/stats',
+  readLimiter,
   requirePermission(PERMISSIONS.ANALYTICS_READ),
   async (req, res) => {
     try {
@@ -401,6 +407,7 @@ router.get('/cache/stats',
  * DELETE /api/content/cache
  */
 router.delete('/cache',
+  contentWriteLimiter,
   requirePermission(PERMISSIONS.SYSTEM_MANAGE),
   async (req, res) => {
     try {
@@ -427,6 +434,7 @@ router.delete('/cache',
  * GET /api/content/health
  */
 router.get('/health',
+  readLimiter,
   async (req, res) => {
     try {
       const nodeInfo = await ipfsService.getNodeInfo();