Merge pull request #603 from wheval/fix/issues-549

Author: ogazboiz

backend/.env.example

@@ -33,6 +33,9 @@ INDEXER_POLL_INTERVAL_MS=5000
 # Ledger sequence to start indexing from on first run (0 = latest)
 INDEXER_START_LEDGER=0
 
+# Max stream creation requests per wallet per minute (default: 10)
+STREAM_CREATE_RATE_LIMIT=10
+
 # Server-side Stellar secret key used to sign and submit on-chain transactions
 # (cancel_stream, top_up_stream). Must be funded on the target network.
 KEEPER_SECRET_KEY=

backend/src/middleware/stream-rate-limiter.middleware.ts

@@ -65,9 +65,8 @@ export function createStreamRateLimiter(
 
 /**
  * Pre-configured rate limiter for stream creation endpoint
- * 10 requests per minute per wallet
+ * Default: 10 requests per minute per wallet (override via STREAM_CREATE_RATE_LIMIT)
  */
 export const streamCreationRateLimiter = createStreamRateLimiter({
   windowMs: 60 * 1000, // 1 minute
-  max: 10, // 10 requests per minute
 });

backend/tests/stream-rate-limiter.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import request from 'supertest';
 import express, { type Request, type Response, type NextFunction } from 'express';
 import { createStreamRateLimiter } from '../src/middleware/stream-rate-limiter.middleware.js';
@@ -242,32 +242,85 @@ describe('Stream Creation Rate Limiter Middleware', () => {
   });
 
   describe('Environment Variable Configuration', () => {
-    it('should use STREAM_CREATE_RATE_LIMIT environment variable', () => {
-      const originalEnv = process.env.STREAM_CREATE_RATE_LIMIT;
-      process.env.STREAM_CREATE_RATE_LIMIT = '5';
+    const originalEnv = process.env.STREAM_CREATE_RATE_LIMIT;
 
-      createStreamRateLimiter({ windowMs: 10000 });
-      // The limiter should be created with max: 5 from env
-
-      // Clean up
-      if (originalEnv) {
+    afterEach(() => {
+      if (originalEnv !== undefined) {
         process.env.STREAM_CREATE_RATE_LIMIT = originalEnv;
       } else {
         delete process.env.STREAM_CREATE_RATE_LIMIT;
       }
+      vi.resetModules();
     });
 
-    it('should default to 10 requests when STREAM_CREATE_RATE_LIMIT is not set', () => {
-      const originalEnv = process.env.STREAM_CREATE_RATE_LIMIT;
+    it('should use STREAM_CREATE_RATE_LIMIT when max is omitted', async () => {
+      process.env.STREAM_CREATE_RATE_LIMIT = '2';
+      vi.resetModules();
+      const { createStreamRateLimiter: createLimiter } = await import(
+        '../src/middleware/stream-rate-limiter.middleware.js'
+      );
+      const limiter = createLimiter({ windowMs: 10000 });
+
+      app.post(
+        '/streams',
+        mockAuthMiddleware('GENV123'),
+        limiter,
+        (req: Request, res: Response) => res.status(201).json({ success: true })
+      );
+
+      await request(app).post('/streams').set('Content-Type', 'application/json');
+      await request(app).post('/streams').set('Content-Type', 'application/json');
+
+      const res = await request(app)
+        .post('/streams')
+        .set('Content-Type', 'application/json');
+      expect(res.status).toBe(429);
+      expect(res.headers['ratelimit-limit']).toBe('2');
+    });
+
+    it('should default to 10 requests when STREAM_CREATE_RATE_LIMIT is not set', async () => {
       delete process.env.STREAM_CREATE_RATE_LIMIT;
+      vi.resetModules();
+      const { createStreamRateLimiter: createLimiter } = await import(
+        '../src/middleware/stream-rate-limiter.middleware.js'
+      );
+      const limiter = createLimiter({ windowMs: 10000 });
 
-      // The limiter should be created with max: 10 by default
-      createStreamRateLimiter({ windowMs: 10000 });
+      app.post(
+        '/streams',
+        mockAuthMiddleware('GENV456'),
+        limiter,
+        (req: Request, res: Response) => res.status(201).json({ success: true })
+      );
 
-      // Clean up
-      if (originalEnv) {
-        process.env.STREAM_CREATE_RATE_LIMIT = originalEnv;
-      }
+      const res = await request(app)
+        .post('/streams')
+        .set('Content-Type', 'application/json');
+      expect(res.headers['ratelimit-limit']).toBe('10');
+    });
+
+    it('should apply STREAM_CREATE_RATE_LIMIT to streamCreationRateLimiter export', async () => {
+      process.env.STREAM_CREATE_RATE_LIMIT = '2';
+      vi.resetModules();
+      const { streamCreationRateLimiter } = await import(
+        '../src/middleware/stream-rate-limiter.middleware.js'
+      );
+
+      app.post(
+        '/streams',
+        mockAuthMiddleware('GEXPORT123'),
+        streamCreationRateLimiter,
+        (req: Request, res: Response) => res.status(201).json({ success: true })
+      );
+
+      await request(app).post('/streams').set('Content-Type', 'application/json');
+      await request(app).post('/streams').set('Content-Type', 'application/json');
+
+      const res = await request(app)
+        .post('/streams')
+        .set('Content-Type', 'application/json');
+      expect(res.status).toBe(429);
+      expect(res.headers['ratelimit-limit']).toBe('2');
     });
   });