implement rate limiting for public profile endpoints (#72)

Signed-off-by: Parth Patidar <parth11.patidar@gmail.com>

Author: parthpatidar03

apps/backend/package.json

@@ -23,6 +23,7 @@
     "@fastify/helmet": "^12.0.0",
     "@fastify/jwt": "^9.0.0",
     "@fastify/multipart": "^9.0.0",
+    "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^8.0.0",
     "@prisma/client": "^6.0.0",
     "dotenv": "^16.4.0",

apps/backend/src/app.ts

@@ -5,6 +5,7 @@ import jwt from '@fastify/jwt';
 import cookie from '@fastify/cookie';
 import multipart from '@fastify/multipart';
 import fastifyStatic from '@fastify/static';
+import rateLimit from '@fastify/rate-limit';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
@@ -62,6 +63,10 @@ export async function buildApp() {
 
   await app.register(cookie);
   await app.register(multipart, { limits: { fileSize: 5 * 1024 * 1024 } }); // 5MB
+  await app.register(rateLimit, {
+    max: 100,
+    timeWindow: '1 minute',
+  });
 
   // Static file serving for uploads
   await app.register(fastifyStatic, {

apps/backend/src/routes/public.ts

@@ -62,6 +62,14 @@ type UsernameCardPublicProfileResponse = {
 
 export async function publicRoutes(app: FastifyInstance) {
   // ─── Public Profile ───
+  app.get('/:username', {
+    config: {
+      rateLimit: {
+        max: 100,
+        timeWindow: '1 minute'
+      }
+    }
+  }, async (request: FastifyRequest<{ Params: { username: string } }>, reply: FastifyReply) => {
   /**
    * GET /api/public/:username
    * Returns the public profile information for a user.
@@ -162,7 +170,14 @@ export async function publicRoutes(app: FastifyInstance) {
   */
   // ─── Shared Card View (Direct) ───
 
-  app.get('/card/:cardId', async (request: FastifyRequest<{ Params: { cardId: string } }>, reply: FastifyReply) => {
+  app.get('/card/:cardId', {
+    config: {
+      rateLimit: {
+        max: 100,
+        timeWindow: '1 minute'
+      }
+    }
+  }, async (request: FastifyRequest<{ Params: { cardId: string } }>, reply: FastifyReply) => {
     const { cardId } = request.params;
 
     const card = await app.prisma.card.findUnique({
@@ -203,6 +218,14 @@ export async function publicRoutes(app: FastifyInstance) {
   });
 
   // ─── Public Card View ───
+  app.get('/:username/card/:cardId', {
+    config: {
+      rateLimit: {
+        max: 100,
+        timeWindow: '1 minute'
+      }
+    }
+  }, async (request: FastifyRequest<{ Params: { username: string; cardId: string } }>, reply: FastifyReply) => {
   /**
    * GET /api/public/:username/card/:cardId
    * Returns full owner profile + specific card data.
@@ -282,7 +305,14 @@ export async function publicRoutes(app: FastifyInstance) {
 
   // ─── QR Code Generation ───
 
-  app.get('/:username/qr', async (request: FastifyRequest<{
+  app.get('/:username/qr', {
+    config: {
+      rateLimit: {
+        max: 50, // Lower limit for QR generation as it's more resource intensive
+        timeWindow: '1 minute'
+      }
+    }
+  }, async (request: FastifyRequest<{
     Params: { username: string };
     Querystring: { format?: string; size?: string };
   }>, reply: FastifyReply) => {