Merge pull request #97 from bocan:just-a-thursday

Implement rate limiting for various endpoints and update dependencies

Author: bocan

package-lock.json

@@ -11,6 +11,7 @@ import searchRoutes from "./routes/search";
 import attachmentRoutes from "./routes/attachments";
 import templatesRoutes from "./routes/templates";
 import { requireAuth } from "./middleware/auth";
+import { healthCheckLimiter, staticFileLimiter } from "./middleware/rateLimiters";
 import { GitService } from "./services/gitService";
 import { DATA_DIR as DEFAULT_DATA_DIR, FileSystemService } from "./services/fileSystem";
 
@@ -258,25 +259,25 @@ app.use("/api/search", requireAuth, searchRoutes); // Protected
 app.use("/api/attachments", requireAuth, attachmentRoutes); // Protected
 
 // Health check
-app.get("/api/health", (req: Request, res: Response) => {
+app.get("/api/health", healthCheckLimiter, (req: Request, res: Response) => {
   res.json({ status: "ok" });
 });
 
 // Handle .well-known/* routes that aren't supported (for MCP clients doing OAuth discovery)
-app.get("/.well-known/oauth-authorization-server", (req: Request, res: Response) => {
+app.get("/.well-known/oauth-authorization-server", healthCheckLimiter, (req: Request, res: Response) => {
   res.status(404).json({ error: "OAuth not supported", message: "This server uses API key authentication" });
 });
-app.get("/.well-known/openid-configuration", (req: Request, res: Response) => {
+app.get("/.well-known/openid-configuration", healthCheckLimiter, (req: Request, res: Response) => {
   res.status(404).json({ error: "OIDC not supported", message: "This server uses API key authentication" });
 });
 
 // Serve static files in production
 if (process.env.NODE_ENV === "production") {
   const clientDistPath = path.join(__dirname, "../../client/dist");
-  app.use(express.static(clientDistPath));
+  app.use(staticFileLimiter, express.static(clientDistPath));
 
   // Handle client-side routing - serve index.html for all non-API routes
-  app.get(/.*/, (req: Request, res: Response) => {
+  app.get(/.*/, staticFileLimiter, (req: Request, res: Response) => {
     res.sendFile(path.join(clientDistPath, "index.html"));
   });
 }

server/src/index.ts

@@ -1,5 +1,44 @@
 import rateLimit from "express-rate-limit";
 
+/**
+ * Rate limiter for read operations (get pages, list folders, view history)
+ * These read from the file system but don't modify it
+ * Limit: 120 requests per minute per IP
+ */
+export const readLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 120,
+  message: { error: "Too many read requests, please slow down" },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+/**
+ * Rate limiter for static file serving
+ * Used for serving the SPA and static assets
+ * Limit: 200 requests per minute per IP (generous for page loads with many assets)
+ */
+export const staticFileLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 200,
+  message: { error: "Too many requests, please slow down" },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+/**
+ * Rate limiter for health check and metadata endpoints
+ * These are lightweight but should still be protected
+ * Limit: 60 requests per minute per IP
+ */
+export const healthCheckLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 60,
+  message: { error: "Too many health check requests" },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
 /**
  * Rate limiter for file operations (create, update, delete, rename, move)
  * These are expensive operations that modify the file system and git history

server/src/middleware/rateLimiters.ts

@@ -103,7 +103,7 @@ router.post("/", fileTransferLimiter, upload.single("file"), async (req: Request
 });
 
 // List attachments for a folder
-router.get("/", async (req: Request, res: Response) => {
+router.get("/", fileTransferLimiter, async (req: Request, res: Response) => {
   try {
     const folderPath = getFolderQueryParam(req);
 

server/src/routes/attachments.ts

@@ -1,25 +1,25 @@
 import { Router } from "express";
 import * as pageController from "../controllers/pageController";
-import { fileOperationLimiter } from "../middleware/rateLimiters";
+import { fileOperationLimiter, readLimiter } from "../middleware/rateLimiters";
 
 const router = Router();
 
 // Specific routes must come before wildcard routes
-router.get("/", pageController.getPages);
+router.get("/", readLimiter, pageController.getPages);
 router.post("/", fileOperationLimiter, pageController.createPage);
 router.put("/move", fileOperationLimiter, pageController.movePage);
 router.put("/rename/file", fileOperationLimiter, pageController.renamePage);
 
 // Wildcard routes (path-to-regexp v8): use `/*name` for "rest of path"
 // Order matters: more specific routes must come before the generic page handler.
-router.get("/*path/history", pageController.getPageHistory);
-router.get("/*path/versions/:hash", pageController.getPageVersion);
+router.get("/*path/history", readLimiter, pageController.getPageHistory);
+router.get("/*path/versions/:hash", readLimiter, pageController.getPageVersion);
 router.post(
   "/*path/restore/:hash",
   fileOperationLimiter,
   pageController.restorePageVersion,
 );
-router.get("/*path", pageController.getPage);
+router.get("/*path", readLimiter, pageController.getPage);
 router.put("/*path", fileOperationLimiter, pageController.updatePage);
 router.delete("/*path", fileOperationLimiter, pageController.deletePage);
 

server/src/routes/pages.ts

@@ -1,8 +1,9 @@
 import { Router } from "express";
 import * as templatesController from "../controllers/templatesController";
+import { readLimiter } from "../middleware/rateLimiters";
 
 const router = Router();
 
-router.get("/", templatesController.getTemplates);
+router.get("/", readLimiter, templatesController.getTemplates);
 
 export default router;