merge: feat(security): Centralized Middleware for Authentication and Rate Limiting (#8254)

## Description

Fixes #7437

Introduces a centralized, configurable middleware layer to handle API
authentication, authorization, rate-limiting, and security headers
globally. Redundant manual security checks have been removed from route
handlers.

Key changes:
- Created a route rules registry inside `middleware.ts` to manage
route-specific auth levels and rate limits.
- Configured NextAuth session checks and enterprise admin role checks
within the centralized middleware runtime.
- Standardized security headers across all responses and integrated
robust error handling for unauthorized/forbidden paths.
- Removed duplicated authentication code from `/api/enterprise` and
`/api/architecture` routes.

## Pillar

- [ ] 🎨 Pillar 1 — New Theme Design
- [ ] 📐 Pillar 2 — Geometric SVG Improvement
- [ ] 🕐 Pillar 3 — Timezone Logic Optimization
- [x] 🛠️ Other (Bug fix, refactoring, docs)

## Visual Preview

None (Backend/Security refactoring)

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [ ] I have updated `README.md` if I added a new theme or URL
parameter.
- [ ] I have started the repo.
- [x] I have made sure that i have only one commit to merge in this PR.
- [ ] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [x] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

app/api/architecture/route.ts

@@ -9,13 +9,10 @@ import pLimit from 'p-limit';
 import { cloneGitHubRepository } from '@/lib/git-clone';
 import { getGitHubTokens } from '@/lib/github';
 import { formatRepoRefForLogging, sanitizeErrorForLogging } from '@/lib/sanitize-git-credentials';
-import { auth } from '@/auth';
 import { getClientIp } from '@/utils/getClientIp';
 
 const execFilePromise = promisify(execFile);
 
-const REST_TIMEOUT_MS = 5000; // 5s timeout for external API requests
-
 // Per-IP concurrent clone tracking (max 3 concurrent clones per IP)
 const MAX_CONCURRENT_CLONES_PER_IP = 3;
 const MAX_TEMP_DIR_SIZE_BYTES = 500 * 1024 * 1024; // 500MB
@@ -310,12 +307,6 @@ export async function POST(req: NextRequest) {
   let tempDir = '';
   const ip = getClientIp(req);
 
-  // Require authenticated session
-  const session = await auth();
-  if (!session?.user) {
-    return NextResponse.json({ error: 'Authentication required' }, { status: 401 });
-  }
-
   // Check concurrent clone limit per IP
   if (!incrementClones(ip)) {
     return NextResponse.json(

app/api/enterprise/route.ts

@@ -1,6 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { aggregateTeamData } from '@/lib/analytics/teamHealth';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 import type { TeamMember } from '@/types/enterprise';
 import type { ContributionCalendar } from '@/types';
 
@@ -35,9 +34,6 @@ function createMockTeamMembers(usernames: string[]): TeamMember[] {
 }
 
 export async function GET(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const searchParams = request.nextUrl.searchParams;
   const teamId = searchParams.get('teamId') || 'default-team';
   const teamName = searchParams.get('teamName') || 'Engineering Team';
@@ -74,9 +70,6 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   let body: Record<string, unknown>;
   try {
     body = await request.json();

app/api/enterprise/teams/[teamId]/route.ts

@@ -1,13 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 
 export async function PATCH(
   _request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
 ) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const { teamId } = await params;
 
   if (!teamId) {
@@ -24,9 +20,6 @@ export async function DELETE(
   _request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
 ) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const { teamId } = await params;
 
   if (!teamId) {

app/api/enterprise/teams/route.ts

@@ -1,12 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { requireEnterpriseAdmin } from '@/lib/enterprise-auth';
 
 const mockTeams: Record<string, { id: string; name: string; members: string[] }> = {};
 
 export async function GET() {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   const teams = Object.values(mockTeams);
 
   return NextResponse.json({
@@ -16,9 +12,6 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const { error } = await requireEnterpriseAdmin();
-  if (error) return error;
-
   let body: { name?: string; members?: string[] };
   try {
     body = await request.json();

auth.ts

@@ -21,7 +21,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
   callbacks: {
     async jwt({ token, account }) {
       if (account?.access_token) {
-        token.ghToken = encryptToken(account.access_token);
+        token.ghToken = await encryptToken(account.access_token);
       }
       return token;
     },

lib/crypto.empty-fallback.test.ts

@@ -10,75 +10,75 @@ afterEach(() => {
 });
 
 describe('crypto empty / missing inputs verification', () => {
-  it('encrypts and decrypts a normal token string', () => {
+  it('encrypts and decrypts a normal token string', async () => {
     const plain = 'gho_abc123def456token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     expect(encrypted).toBeDefined();
     expect(encrypted).not.toBe(plain);
     expect(encrypted.split('.')).toHaveLength(4);
-    expect(decryptToken(encrypted)).toBe(plain);
+    expect(await decryptToken(encrypted)).toBe(plain);
   });
 
-  it('handles empty string encryption and decryption', () => {
-    const encrypted = encryptToken('');
+  it('handles empty string encryption and decryption', async () => {
+    const encrypted = await encryptToken('');
     expect(encrypted.split('.')).toHaveLength(4);
-    expect(decryptToken(encrypted)).toBe('');
+    expect(await decryptToken(encrypted)).toBe('');
   });
 
-  it('rejects malformed payload with wrong number of parts', () => {
-    expect(() => decryptToken('only-one-part')).toThrow();
-    expect(() => decryptToken('two.parts')).toThrow();
-    expect(() => decryptToken('a.b.c.d')).toThrow();
+  it('rejects malformed payload with wrong number of parts', async () => {
+    await expect(decryptToken('only-one-part')).rejects.toThrow();
+    await expect(decryptToken('two.parts')).rejects.toThrow();
+    await expect(decryptToken('a.b.c.d')).rejects.toThrow();
   });
 
-  it('rejects payload with invalid base64', () => {
+  it('rejects payload with invalid base64', async () => {
     const payload = '!!!invalid-base64!!!.aaaa.aaaa';
-    expect(() => decryptToken(payload)).toThrow();
+    await expect(decryptToken(payload)).rejects.toThrow();
   });
 
-  it('rejects empty payload string', () => {
-    expect(() => decryptToken('')).toThrow();
+  it('rejects empty payload string', async () => {
+    await expect(decryptToken('')).rejects.toThrow();
   });
 
-  it('rejects tampered ciphertext (modified encrypted part)', () => {
+  it('rejects tampered ciphertext (modified encrypted part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = [parts[0], parts[1], '////'].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 
-  it('rejects tampered auth tag (modified tag part)', () => {
+  it('rejects tampered auth tag (modified tag part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = [parts[0], '////', parts[2]].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 
-  it('rejects tampered IV (modified iv part)', () => {
+  it('rejects tampered IV (modified iv part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = ['////', parts[1], parts[2]].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 });
 
 describe('crypto key errors', () => {
-  it('throws when ENCRYPTION_KEY is missing', () => {
+  it('throws when ENCRYPTION_KEY is missing', async () => {
     vi.stubEnv('ENCRYPTION_KEY', '');
-    expect(() => encryptToken('test')).toThrow(/ENCRYPTION_KEY/i);
+    await expect(encryptToken('test')).rejects.toThrow(/ENCRYPTION_KEY/i);
   });
 
-  it('throws when ENCRYPTION_KEY is too short', () => {
+  it('throws when ENCRYPTION_KEY is too short', async () => {
     vi.stubEnv('ENCRYPTION_KEY', 'short');
-    expect(() => encryptToken('test')).toThrow(/ENCRYPTION_KEY/i);
+    await expect(encryptToken('test')).rejects.toThrow(/ENCRYPTION_KEY/i);
   });
 
-  it('throws on decrypt with wrong key', () => {
-    const encrypted = encryptToken('secret');
+  it('throws on decrypt with wrong key', async () => {
+    const encrypted = await encryptToken('secret');
     vi.stubEnv('ENCRYPTION_KEY', 'a-different-key-that-is-32-char!!');
-    expect(() => decryptToken(encrypted)).toThrow();
+    await expect(decryptToken(encrypted)).rejects.toThrow();
   });
 });

lib/crypto.massive-scaling.test.ts

@@ -10,50 +10,50 @@ afterEach(() => {
 });
 
 describe('crypto massive scaling', () => {
-  it('handles very long token strings without truncation', () => {
+  it('handles very long token strings without truncation', async () => {
     const long = 'a'.repeat(10_000);
-    const encrypted = encryptToken(long);
-    expect(decryptToken(encrypted)).toBe(long);
+    const encrypted = await encryptToken(long);
+    expect(await decryptToken(encrypted)).toBe(long);
   });
 
-  it('handles unicode characters including emoji', () => {
+  it('handles unicode characters including emoji', async () => {
     const unicode = '🚀🔥💯 commitpulse 测试 テスト тест';
-    const encrypted = encryptToken(unicode);
-    expect(decryptToken(encrypted)).toBe(unicode);
+    const encrypted = await encryptToken(unicode);
+    expect(await decryptToken(encrypted)).toBe(unicode);
   });
 
-  it('handles strings with special characters', () => {
+  it('handles strings with special characters', async () => {
     const special = '!@#$%^&*()_+-=[]{}|;:\'",.<>?/`~';
-    const encrypted = encryptToken(special);
-    expect(decryptToken(encrypted)).toBe(special);
+    const encrypted = await encryptToken(special);
+    expect(await decryptToken(encrypted)).toBe(special);
   });
 
-  it('handles JSON-serialized payload', () => {
+  it('handles JSON-serialized payload', async () => {
     const payload = JSON.stringify({
       access_token: 'gho_xxx',
       scope: 'repo,user',
       token_type: 'bearer',
     });
-    const encrypted = encryptToken(payload);
-    expect(decryptToken(encrypted)).toBe(payload);
+    const encrypted = await encryptToken(payload);
+    expect(await decryptToken(encrypted)).toBe(payload);
   });
 
-  it('maintains round-trip integrity for repeated encryptions of same plaintext (different IV)', () => {
+  it('maintains round-trip integrity for repeated encryptions of same plaintext (different IV)', async () => {
     const plain = 'gho_consistent_token_value';
     const results = new Set<string>();
     for (let i = 0; i < 10; i++) {
-      results.add(encryptToken(plain));
+      results.add(await encryptToken(plain));
     }
     expect(results.size).toBe(10);
-    results.forEach((enc) => {
-      expect(decryptToken(enc)).toBe(plain);
-    });
+    for (const enc of Array.from(results)) {
+      expect(await decryptToken(enc)).toBe(plain);
+    }
   });
 
-  it('handles maximum token length (512 bytes) typical for GitHub tokens', () => {
+  it('handles maximum token length (512 bytes) typical for GitHub tokens', async () => {
     const typical = 'ghp_' + 'a'.repeat(508);
     expect(typical.length).toBe(512);
-    const encrypted = encryptToken(typical);
-    expect(decryptToken(encrypted)).toBe(typical);
+    const encrypted = await encryptToken(typical);
+    expect(await decryptToken(encrypted)).toBe(typical);
   });
 });

lib/crypto.test.ts

@@ -13,52 +13,52 @@ afterAll(() => {
 });
 
 describe('encryptToken / decryptToken', () => {
-  it('round-trips a plain text token', () => {
+  it('round-trips a plain text token', async () => {
     const plain = 'ghp_test123token';
-    const enc = encryptToken(plain);
+    const enc = await encryptToken(plain);
     expect(enc).not.toBe(plain);
-    expect(decryptToken(enc)).toBe(plain);
+    expect(await decryptToken(enc)).toBe(plain);
   });
 
-  it('produces different ciphertexts for the same input (random salt/IV)', () => {
+  it('produces different ciphertexts for the same input (random salt/IV)', async () => {
     const plain = 'same-value';
-    const a = encryptToken(plain);
-    const b = encryptToken(plain);
+    const a = await encryptToken(plain);
+    const b = await encryptToken(plain);
     expect(a).not.toBe(b);
   });
 
-  it('rejects a tampered ciphertext', () => {
-    const enc = encryptToken('secret');
+  it('rejects a tampered ciphertext', async () => {
+    const enc = await encryptToken('secret');
     const parts = enc.split('.');
     parts[2] = Buffer.from('ffffffffffffffff').toString('base64');
-    expect(() => decryptToken(parts.join('.'))).toThrow();
+    await expect(decryptToken(parts.join('.'))).rejects.toThrow();
   });
 
-  it('throws on invalid payload format', () => {
-    expect(() => decryptToken('not-a-valid-format')).toThrow();
+  it('throws on invalid payload format', async () => {
+    await expect(decryptToken('not-a-valid-format')).rejects.toThrow();
   });
 
-  it('handles empty string', () => {
-    const enc = encryptToken('');
-    expect(decryptToken(enc)).toBe('');
+  it('handles empty string', async () => {
+    const enc = await encryptToken('');
+    expect(await decryptToken(enc)).toBe('');
   });
 
-  it('handles special characters', () => {
+  it('handles special characters', async () => {
     const plain = 'abc123!@#$%^&*()_+=-[]{}|;:,.<>?/~`';
-    expect(decryptToken(encryptToken(plain))).toBe(plain);
+    expect(await decryptToken(await encryptToken(plain))).toBe(plain);
   });
 
-  it('throws when ENCRYPTION_KEY is missing', () => {
+  it('throws when ENCRYPTION_KEY is missing', async () => {
     const saved = process.env.ENCRYPTION_KEY;
     delete process.env.ENCRYPTION_KEY;
-    expect(() => encryptToken('x')).toThrow('ENCRYPTION_KEY');
+    await expect(encryptToken('x')).rejects.toThrow('ENCRYPTION_KEY');
     process.env.ENCRYPTION_KEY = saved;
   });
 
-  it('throws when ENCRYPTION_KEY is too short', () => {
+  it('throws when ENCRYPTION_KEY is too short', async () => {
     const saved = process.env.ENCRYPTION_KEY;
     process.env.ENCRYPTION_KEY = 'short';
-    expect(() => encryptToken('x')).toThrow('ENCRYPTION_KEY');
+    await expect(encryptToken('x')).rejects.toThrow('ENCRYPTION_KEY');
     process.env.ENCRYPTION_KEY = saved;
   });
 });