From b510d187584a30b712f80b99014e628d5beb5575 Mon Sep 17 00:00:00 2001
From: Justin Lin <wancat@wancat.cc>
Date: Tue, 3 Nov 2026 20:28:04 +1100
Subject: [PATCH] feat: add rate limit to session creation

---
 bun.lock                             |  3 +++
 server/package.json                  |  1 +
 server/src/middleware/rateLimiter.ts | 36 ++++++++++++++++++++++------
 server/src/routers/sessionRouter.ts  |  2 ++
 server/src/trpc.ts                   |  2 +-
 5 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/bun.lock b/bun.lock
index f93bacf..6620b14 100644
--- a/bun.lock
+++ b/bun.lock
@@ -133,6 +133,7 @@
         "passport-google-oidc": "^0.1.0",
         "passport-jwt": "^4.0.1",
         "passport-local": "^1.0.0",
+        "rate-limiter-flexible": "^11.2.3",
         "socket.io": "^4.7.1",
         "swagger-ui-express": "^5.0.0",
         "validator": "^13.15.22",
@@ -1604,6 +1605,8 @@
 
     "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],
 
+    "rate-limiter-flexible": ["rate-limiter-flexible@11.2.3", "", {}, "sha512-w4HX4toAsEbu1VksOauZwI9d6URb6/4WqJJ5Hg1bESihMt2KJfQ2iTwvDkhIg+y2HetLh65DGu/8xIkUz/xNPA=="],
+
     "raw-body": ["raw-body@2.5.3", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "unpipe": "~1.0.0" } }, "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA=="],
 
     "react-is": ["react-is@17.0.2", "", {}, "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w=="],
diff --git a/server/package.json b/server/package.json
index b42e9bc..a43f5ce 100644
--- a/server/package.json
+++ b/server/package.json
@@ -38,6 +38,7 @@
     "passport-google-oidc": "^0.1.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
+    "rate-limiter-flexible": "^11.2.3",
     "socket.io": "^4.7.1",
     "swagger-ui-express": "^5.0.0",
     "validator": "^13.15.22",
diff --git a/server/src/middleware/rateLimiter.ts b/server/src/middleware/rateLimiter.ts
index 43adaa5..bed6558 100644
--- a/server/src/middleware/rateLimiter.ts
+++ b/server/src/middleware/rateLimiter.ts
@@ -1,9 +1,12 @@
 import rateLimit from 'express-rate-limit'
 import type { Options } from 'express-rate-limit'
 import type { Request, Response, NextFunction } from 'express'
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+import { TRPCError } from '@trpc/server'
 import { LoginAttempt } from '@odyssey/models'
 import config from '../config.js'
 import logger from '../utils/logger.js'
+import { middleware } from '../trpc.js'
 
 function createRateLimiter(options: Partial<Options>) {
   if (config.testing.enabled) {
@@ -22,13 +25,32 @@ export const authenticateRateLimit = createRateLimiter({
   max: 5,
 })
 
-export const sessionRateLimit = createRateLimiter({
-  windowMs: 10 * 1000,
-  max: 1,
-  keyGenerator: (req: Request) => {
-    return req.user ? (req.user as any)._id : req.ip || ''
-  },
-})
+export function trpcRateLimit({
+  points,
+  duration,
+}: {
+  points: number
+  duration: number
+}) {
+  const limiter = new RateLimiterMemory({ points, duration })
+  return middleware(async (opts) => {
+    if (config.testing.enabled) {
+      return opts.next()
+    }
+    const key = opts.ctx.user?.id ?? opts.ctx.ip ?? ''
+    try {
+      await limiter.consume(key)
+    } catch {
+      throw new TRPCError({
+        code: 'TOO_MANY_REQUESTS',
+        message: 'Too many requests. Please try again later.',
+      })
+    }
+    return opts.next()
+  })
+}
+
+export const sessionRateLimit = trpcRateLimit({ points: 3, duration: 60 })
 
 export async function rateLimitByAccount(
   req: Request,
diff --git a/server/src/routers/sessionRouter.ts b/server/src/routers/sessionRouter.ts
index 84fdaf5..ac814a0 100644
--- a/server/src/routers/sessionRouter.ts
+++ b/server/src/routers/sessionRouter.ts
@@ -8,6 +8,7 @@ import config from '../config.js'
 import { protectedProcedure, router } from '../trpc.js'
 import { questManager } from '../models/quest.js'
 import { genJWT } from '../utils/auth'
+import { sessionRateLimit } from '../middleware/rateLimiter.js'
 
 export type SessionDetail = Awaited<ReturnType<typeof sessionDetail>>
 
@@ -47,6 +48,7 @@ async function sessionDetail(session: ISession) {
 
 export const sessionRouter = router({
   createSession: protectedProcedure
+    .use(sessionRateLimit)
     .input(
       z.object({
         questId: z.string(),
diff --git a/server/src/trpc.ts b/server/src/trpc.ts
index 8e7c939..a26a06c 100644
--- a/server/src/trpc.ts
+++ b/server/src/trpc.ts
@@ -18,7 +18,7 @@ const t = initTRPC.context<AppContext>().create()
  * Export reusable router and procedure helpers
  * that can be used throughout the router
  */
-export const { router, procedure: publicProcedure } = t
+export const { router, procedure: publicProcedure, middleware } = t
 
 export const protectedProcedure = publicProcedure.use(async (opts) => {
   if (opts.ctx.isAuthenticated() && !('newUser' in opts.ctx.user)) {