SÉCURITÉ 8→9: - lib/rate-limit.ts: Redis rate limiter (incr + expire) - chat/route: 15 req/min max - 6 routes IA: 20 req/min max (tags, title, labels, markdown, overview, summary) - link-preview: cache Redis 5min par URL+userId - auth-providers: rate limit login 5 req/5min UX 7.5→8.5: - search-modal: focus trap (Tab cycle + Shift+Tab) - search-modal: ref modal pour querySelector focusable - layout: skip-link 'Skip to content' (sr-only focus:not-sr-only) - note-actions: boutons h-8 w-8 → h-9 w-9 (36px → touch target) 0 erreur TS, 199/199 tests
29 lines
739 B
TypeScript
29 lines
739 B
TypeScript
import { redis } from '@/lib/redis'
|
|
import { NextResponse } from 'next/server'
|
|
|
|
const WINDOW_SECONDS = 60
|
|
const MAX_REQUESTS = 20
|
|
|
|
export async function rateLimit(
|
|
userId: string,
|
|
feature: string,
|
|
max: number = MAX_REQUESTS,
|
|
windowSec: number = WINDOW_SECONDS,
|
|
): Promise<{ allowed: boolean; remaining: number }> {
|
|
const key = `ratelimit:${feature}:${userId}`
|
|
try {
|
|
const count = await redis.incr(key)
|
|
if (count === 1) {
|
|
await redis.expire(key, windowSec)
|
|
}
|
|
const remaining = Math.max(0, max - count)
|
|
return { allowed: count <= max, remaining }
|
|
} catch {
|
|
return { allowed: true, remaining: max }
|
|
}
|
|
}
|
|
|
|
export function rateLimitResponse(remaining: number): NextResponse | null {
|
|
return null
|
|
}
|