From 58f3bf7817e35f2f6ff7c6a0237f4968fcfaac80 Mon Sep 17 00:00:00 2001
From: Justin Lin <wancat@wancat.cc>
Date: Sun, 27 Apr 2025 16:41:19 +0800
Subject: [PATCH] fix: use config value instead of hard coded values

---
 server/src/middleware/rateLimiter.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/middleware/rateLimiter.ts b/server/src/middleware/rateLimiter.ts
index 9f0de96..4a5fb04 100644
--- a/server/src/middleware/rateLimiter.ts
+++ b/server/src/middleware/rateLimiter.ts
@@ -40,7 +40,7 @@ export async function rateLimitByAccount(
     return next()
   }
 
-  const since = new Date(Date.now() - 10 * 60 * 1000)
+  const since = new Date(Date.now() - config.rateLimit.lockoutTime)
 
   const recentFailedCount = await LoginAttempt.countDocuments({
     username,
@@ -49,7 +49,7 @@ export async function rateLimitByAccount(
     time: { $gte: since },
   })
 
-  if (recentFailedCount >= 5) {
+  if (recentFailedCount >= config.rateLimit.maxFailedAttempts) {
     logger.warn(
       `Too many failed login attempts for "${username}" from ${req.ip}`
     )