feat: add rate limit to session creation

server/package.json

@@ -38,6 +38,7 @@
     "passport-google-oidc": "^0.1.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
+    "rate-limiter-flexible": "^11.2.3",
     "socket.io": "^4.7.1",
     "swagger-ui-express": "^5.0.0",
     "validator": "^13.15.22",

server/src/middleware/rateLimiter.ts

@@ -1,9 +1,12 @@
 import rateLimit from 'express-rate-limit'
 import type { Options } from 'express-rate-limit'
 import type { Request, Response, NextFunction } from 'express'
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+import { TRPCError } from '@trpc/server'
 import { LoginAttempt } from '@odyssey/models'
 import config from '../config.js'
 import logger from '../utils/logger.js'
+import { middleware } from '../trpc.js'
 
 function createRateLimiter(options: Partial<Options>) {
   if (config.testing.enabled) {
@@ -22,13 +25,32 @@ export const authenticateRateLimit = createRateLimiter({
   max: 5,
 })
 
-export const sessionRateLimit = createRateLimiter({
-  windowMs: 10 * 1000,
-  max: 1,
-  keyGenerator: (req: Request) => {
-    return req.user ? (req.user as any)._id : req.ip || ''
-  },
-})
+export function trpcRateLimit({
+  points,
+  duration,
+}: {
+  points: number
+  duration: number
+}) {
+  const limiter = new RateLimiterMemory({ points, duration })
+  return middleware(async (opts) => {
+    if (config.testing.enabled) {
+      return opts.next()
+    }
+    const key = opts.ctx.user?.id ?? opts.ctx.ip ?? ''
+    try {
+      await limiter.consume(key)
+    } catch {
+      throw new TRPCError({
+        code: 'TOO_MANY_REQUESTS',
+        message: 'Too many requests. Please try again later.',
+      })
+    }
+    return opts.next()
+  })
+}
+
+export const sessionRateLimit = trpcRateLimit({ points: 3, duration: 60 })
 
 export async function rateLimitByAccount(
   req: Request,

server/src/routers/sessionRouter.ts

@@ -8,6 +8,7 @@ import config from '../config.js'
 import { protectedProcedure, router } from '../trpc.js'
 import { questManager } from '../models/quest.js'
 import { genJWT } from '../utils/auth'
+import { sessionRateLimit } from '../middleware/rateLimiter.js'
 
 export type SessionDetail = Awaited<ReturnType<typeof sessionDetail>>
 
@@ -47,6 +48,7 @@ async function sessionDetail(session: ISession) {
 
 export const sessionRouter = router({
   createSession: protectedProcedure
+    .use(sessionRateLimit)
     .input(
       z.object({
         questId: z.string(),

server/src/trpc.ts

@@ -18,7 +18,7 @@ const t = initTRPC.context<AppContext>().create()
  * Export reusable router and procedure helpers
  * that can be used throughout the router
  */
-export const { router, procedure: publicProcedure } = t
+export const { router, procedure: publicProcedure, middleware } = t
 
 export const protectedProcedure = publicProcedure.use(async (opts) => {
   if (opts.ctx.isAuthenticated() && !('newUser' in opts.ctx.user)) {