feat: introduced rate-limit (#20)

Author: ShreyashSri

app/api/evaluator/register/route.ts

@@ -4,6 +4,7 @@ import dbConnect from "@/lib/db";
 import Evaluator from "@/models/Evaluator";
 import User from "@/models/User";
 import { getAuth } from "@/lib/firebase-admin";
+import { checkRateLimit } from "@/lib/rate-limit";
 
 export const dynamic = 'force-dynamic';
 
@@ -32,6 +33,11 @@ function createErrorResponse(message: string, code: string, status: number) {
  */
 export async function POST(request: NextRequest) {
     try {
+        const ip = request.headers.get("x-forwarded-for") || "unknown";
+        if (!checkRateLimit(ip, 5, 60 * 1000)) {
+            return createErrorResponse("Too many requests. Please try again later.", "RATE_LIMIT_EXCEEDED", 429);
+        }
+
         const authHeader = request.headers.get('authorization');
         if (!authHeader || !authHeader.startsWith('Bearer ')) {
             return createErrorResponse("Authentication required", "AUTH_REQUIRED", 401);

app/api/registration/route.ts

@@ -10,6 +10,7 @@ import path from "path";
 import os from "os";
 import dbConnect from "@/lib/db";
 import User, { IUser } from "@/models/User";
+import { checkRateLimit } from "@/lib/rate-limit";
 
 // Utility functions for format validation
 const validateEmail = (email: string) =>
@@ -205,6 +206,18 @@ const getOrCreateBatchDocument = async () => {
 
 export async function POST(request: Request) {
   try {
+    // Basic IP Rate limiting (5 requests per minute)
+    const ip = request.headers.get("x-forwarded-for") || "unknown";
+    if (!checkRateLimit(ip, 5, 60 * 1000)) {
+      return NextResponse.json(
+        {
+          message: "Too many requests. Please try again later.",
+          error: "Rate limit exceeded",
+        },
+        { status: 429 }
+      );
+    }
+
     const REGISTRATION_DEADLINE = new Date("2026-07-19T10:00:00+05:30");
     if (new Date() > REGISTRATION_DEADLINE) {
       return NextResponse.json(
@@ -361,11 +374,12 @@ export async function POST(request: Request) {
       );
     }
 
-    // Validate password
-    if (password.length < 6) {
+    // Validate password (min 8 chars, 1 uppercase, 1 lowercase, 1 number, 1 special char)
+    const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;
+    if (!passwordRegex.test(password)) {
       return NextResponse.json(
         {
-          message: "Password must be at least 6 characters long.",
+          message: "Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.",
           error: "Weak password",
         },
         { status: 400 },

app/evaluator/register/page.tsx

@@ -49,6 +49,13 @@ export default function EvaluatorRegisterPage() {
             return;
         }
 
+        const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^A-Za-z0-9]).{8,}$/;
+        if (!passwordRegex.test(formData.password)) {
+            setError("Password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one number, and one special character.");
+            setIsSubmitting(false);
+            return;
+        }
+
         if (!formData.evaluatorCode.trim()) {
             setError("Evaluator code is required");
             setIsSubmitting(false);

lib/rate-limit.ts

@@ -0,0 +1,36 @@
+type RateLimitInfo = {
+  count: number;
+  lastReset: number;
+};
+
+const rateLimits = new Map<string, RateLimitInfo>();
+
+// Cleans up the Map every 5 minutes to prevent memory leaks
+setInterval(() => {
+  const now = Date.now();
+  for (const [ip, info] of rateLimits.entries()) {
+    if (now - info.lastReset > 5 * 60 * 1000) {
+      rateLimits.delete(ip);
+    }
+  }
+}, 5 * 60 * 1000);
+
+export function checkRateLimit(ip: string, limit: number, windowMs: number): boolean {
+  const now = Date.now();
+  const info = rateLimits.get(ip) || { count: 0, lastReset: now };
+
+  if (now - info.lastReset > windowMs) {
+    info.count = 1;
+    info.lastReset = now;
+    rateLimits.set(ip, info);
+    return true;
+  }
+
+  if (info.count >= limit) {
+    return false;
+  }
+
+  info.count++;
+  rateLimits.set(ip, info);
+  return true;
+}