Ratelimit (#2)

* Using UPSTASH_REDIS_REST_API as database

* Added ratelimit

Author: SomajitDey

api/helper.js

@@ -1,5 +1,5 @@
 import Crypto from 'node:crypto';
-import { kv } from '@vercel/kv';
+import { createClient } from '@vercel/kv';
 
 const secret = process.env.SECRET;
 const sigLen = parseInt(process.env.SIG_LEN);
@@ -10,6 +10,10 @@ const dbKeyPrefix = {
                 oneToMany: "o2m:",
                 oneToOne: "o2o:",
             }
+const kv = createClient({
+  url: process.env.UPSTASH_REDIS_REST_URL,
+  token: process.env.UPSTASH_REDIS_REST_TOKEN,
+})
 
 function hash(str){
     return Crypto.hash('md5', str, 'base64url').substr(0,hashLen);

example.env

@@ -10,9 +10,13 @@ HASH_LEN=5 # Hash character count
 TTL=86400 # Time to live for data in seconds
 BODYLIMIT=10000 # Max content-length in bytes. Note: 1 byte = 1 character.
 FIELDLIMIT = 5 # Max length of the one-to-one token
+RATELIMIT= 20 # Max number of requests within following time period
+RATELIMIT_WINDOW = '300 s'
 
-# Redis credentials
-KV_URL=
+# Redis credentials to be used for rate-limiting
 KV_REST_API_URL=
 KV_REST_API_TOKEN=
-KV_REST_API_READ_ONLY_TOKEN=
+
+# Redis credentials to be used for database
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=

middleware.js

@@ -0,0 +1,35 @@
+/*
+Refs:
+https://vercel.com/guides/rate-limiting-edge-middleware-vercel-kv
+https://vercel.com/docs/functions/edge-middleware/middleware-api
+https://upstash.com/docs/redis/sdks/ratelimit-ts/features#caching
+https://upstash.com/docs/redis/sdks/ratelimit-ts/methods#limit
+*/
+import { ipAddress } from '@vercel/functions'
+import { next } from '@vercel/edge'
+import { Ratelimit } from '@upstash/ratelimit'
+import { kv } from '@vercel/kv'
+
+const cache = new Map(); // must be outside of your serverless function handler
+
+const ratelimit = new Ratelimit({
+  redis: kv,
+  ephemeralCache: cache,
+  analytics: false,
+  limiter: Ratelimit.slidingWindow(parseInt(process.env.RATELIMIT), process.env.RATELIMIT_WINDOW),
+})
+
+export default async function middleware(request) {
+  // You could alternatively limit based on user ID or similar
+  const ip = ipAddress(request) || '127.0.0.1'
+  const { success, reset } = await ratelimit.limit(
+    ip
+  )
+
+  return success ? next() : Response.json(
+    { message: `Try after ${(reset - Date.now())/1000} seconds`, error: "Too Many Requests", statusCode: 429 },
+    {
+      status: 429,
+    },
+  )
+}

package.json

@@ -2,6 +2,9 @@
   "dependencies": {
     "@fastify/cors": "^10.0.1",
     "@fastify/formbody": "^8.0.1",
+    "@upstash/ratelimit": "^2.0.3",
+    "@vercel/edge": "^1.1.2",
+    "@vercel/functions": "^1.4.2",
     "@vercel/kv": "^2.0.0",
     "fastify": "^5.0.0"
   },