fix(core): resolve timezone, cache cleanup, and rate limit reset issues (JhaSourav07#2454)

## Description

Fixes JhaSourav07#2453 

This PR resolves three reliability and correctness issues across the
application:

### 1. Timezone Shift Bug in GitHub Wrapped Busiest Month

The busiest month display was generated using:

```ts
new Date(wrappedData.busiestMonth + "-01")
```

Because date-only strings are interpreted as UTC, users in negative
timezone offsets could see the month shifted backward (e.g. December
displayed as November).

#### Fix

Replaced UTC-sensitive parsing with timezone-safe date construction to
ensure consistent month rendering across all user timezones.

---

### 2. Unbounded Memory Growth in Singleton Tracking Services

The following singleton services stored data in unbounded in-memory
Maps:

* refresh-rate-limiter.ts
* refresh-policy.ts
* track-user-protection.ts

Because entries were never removed, memory usage could continuously
increase as new users, IPs, or identifiers were encountered.

#### Fix

Migrated tracking storage to TTL-based caching so expired entries are
automatically cleaned up after their cooldown periods.

Benefits:

* Prevents stale entry accumulation
* Reduces long-term memory usage
* Avoids potential OOM issues in long-running deployments

---

### 3. Incorrect Rate Limit Reset Timestamp

The rate limiter returned:

```ts
reset: now + windowMs
```

for every request.

This caused the `X-RateLimit-Reset` value to continuously move forward
even though the actual cache expiration remained fixed.

#### Fix

Added a persistent `resetAt` timestamp to tracker records and returned
that value instead of recalculating it on every request.

Benefits:

* Accurate rate-limit reset headers
* Correct retry timing for API consumers
* Consistent server/client behavior

---

### Testing

Verified:

* Busiest month displays correctly across multiple timezone offsets.
* Expired tracking entries are automatically removed.
* Memory usage remains stable during repeated requests.
* Rate-limit reset headers remain fixed throughout the active window.
* Existing rate limiting behavior remains unchanged.

## Pillar

* [ ] 🎨 Pillar 1 — New Theme Design
* [ ] 📐 Pillar 2 — Geometric SVG Improvement
* [x] 🕐 Pillar 3 — Timezone Logic Optimization
* [x] 🛠️ Other (Bug fix, refactoring, docs)

## Checklist before requesting a review:

* [x] I have read the `CONTRIBUTING.md` file.
* [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
* [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
* [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
* [ ] I have updated `README.md` if I added a new theme or URL
parameter. (Not applicable)
* [x] I have started the repo.
* [x] I have made sure that I have only one commit to merge in this PR.
* [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
* [ ] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: Aditya30ag

components/dashboard/GithubWrapped.tsx

@@ -107,10 +107,18 @@ export default function GithubWrapped({ profile, wrappedData }: GithubWrappedPro
             <Calendar className="text-purple-400 mb-2" size={24} />
             <p className="text-sm text-white/60">Busiest Month</p>
             <p className="text-2xl font-bold">
-              {new Date(wrappedData.busiestMonth + '-01').toLocaleString('default', {
-                month: 'long',
-                year: 'numeric',
-              })}
+              {(() => {
+                const parts = wrappedData.busiestMonth.split('-');
+                if (parts.length === 2) {
+                  const [year, month] = parts.map(Number);
+                  const date = new Date(year, month - 1, 1);
+                  return date.toLocaleString('default', {
+                    month: 'long',
+                    year: 'numeric',
+                  });
+                }
+                return wrappedData.busiestMonth;
+              })()}
             </p>
           </motion.div>
 

lib/rate-limit.ts

@@ -15,7 +15,7 @@ interface RateLimitResult {
  * For multi-instance strict syncing, a Redis store (Vercel KV/Upstash) should be used.
  */
 export class RateLimiter {
-  private cache: DistributedCache<number>;
+  private cache: DistributedCache<{ count: number; resetAt: number }>;
   private limit: number;
   private windowMs: number;
   private allowlist = new Set<string>();
@@ -30,7 +30,7 @@ export class RateLimiter {
   constructor(limit = 5, windowMs = 60000) {
     this.limit = limit;
     this.windowMs = windowMs;
-    this.cache = new DistributedCache<number>(10000, windowMs);
+    this.cache = new DistributedCache<{ count: number; resetAt: number }>(10000, windowMs);
   }
 
   /**
@@ -50,9 +50,17 @@ export class RateLimiter {
   async check(ip: string): Promise<boolean> {
     if (this.allowlist.has(ip)) return true;
     if (this.blocklist.has(ip)) return false;
-    const count = await this.cache.incr(`ratelimit:${ip}`, this.windowMs);
-    return count <= this.limit;
+    const record = await this.cache.get(ip);
+    const count = record?.count ?? 0;
+    if (count >= this.limit) return false;
+    if (!record) {
+      await this.cache.set(ip, { count: 1, resetAt: Date.now() + this.windowMs }, this.windowMs);
+    } else {
+      await this.cache.update(ip, { count: count + 1, resetAt: record.resetAt });
+    }
+    return true;
   }
+
   async checkWithResult(ip: string): Promise<RateLimitResult> {
     if (this.allowlist.has(ip))
       return {
@@ -65,24 +73,39 @@ export class RateLimiter {
       return { success: false, limit: this.limit, remaining: 0, reset: Date.now() + this.windowMs };
 
     const now = Date.now();
-    const count = await this.cache.incr(`ratelimit:${ip}`, this.windowMs);
+    const record = await this.cache.get(ip);
+    const count = record?.count ?? 0;
 
-    if (count > this.limit) {
+    if (count >= this.limit) {
       return {
         success: false,
         limit: this.limit,
         remaining: 0,
-        reset: now + this.windowMs,
+        reset: record?.resetAt ?? now + this.windowMs,
       };
     }
 
-    return {
-      success: true,
-      limit: this.limit,
-      remaining: this.limit - count,
-      reset: now + this.windowMs,
-    };
+    if (!record) {
+      const resetAt = now + this.windowMs;
+      await this.cache.set(ip, { count: 1, resetAt }, this.windowMs);
+      return {
+        success: true,
+        limit: this.limit,
+        remaining: this.limit - 1,
+        reset: resetAt,
+      };
+    } else {
+      const resetAt = record.resetAt;
+      await this.cache.update(ip, { count: count + 1, resetAt });
+      return {
+        success: true,
+        limit: this.limit,
+        remaining: this.limit - (count + 1),
+        reset: resetAt,
+      };
+    }
   }
+
   /**
    * Resets the request count for a given IP address.
    *
@@ -97,6 +120,7 @@ export class RateLimiter {
   async reset(ip: string): Promise<void> {
     await this.cache.delete(`ratelimit:${ip}`);
   }
+
   /**
    * Returns the number of remaining requests allowed for a given IP
    * in the current window.
@@ -112,8 +136,9 @@ export class RateLimiter {
    * console.log(`You have ${left} requests left.`);
    */
   async remaining(ip: string): Promise<number> {
-    const current = ((await this.cache.get(`ratelimit:${ip}`)) as unknown as number) ?? 0;
-    return Math.max(0, this.limit - current);
+    const record = await this.cache.get(ip);
+    const count = record?.count ?? 0;
+    return Math.max(0, this.limit - count);
   }
 
   allow(ip: string): void {
@@ -149,7 +174,7 @@ export const notifyRateLimiter = new RateLimiter(5, 60000);
  * Falls back to a local in-memory cache for development environments.
  */
 
-const trackers = new DistributedCache<number>(2000, 60000);
+const trackers = new DistributedCache<{ count: number; resetAt: number }>(2000, 60000);
 
 /**
  * Checks if a request from a given IP should be rate limited.
@@ -171,21 +196,35 @@ export async function rateLimit(
   windowMs: number = 60000
 ): Promise<RateLimitResult> {
   const now = Date.now();
-  const count = await trackers.incr(ip, windowMs);
+  const tracker = await trackers.get(ip);
+
+  if (!tracker) {
+    const resetAt = now + windowMs;
+    await trackers.set(ip, { count: 1, resetAt }, windowMs);
+    return {
+      success: true,
+      limit,
+      remaining: limit - 1,
+      reset: resetAt,
+    };
+  }
+
+  tracker.count++;
+  await trackers.update(ip, tracker);
 
-  if (count > limit) {
+  if (tracker.count > limit) {
     return {
       success: false,
       limit,
       remaining: 0,
-      reset: now + windowMs,
+      reset: tracker.resetAt,
     };
   }
 
   return {
     success: true,
     limit,
-    remaining: limit - count,
-    reset: now + windowMs,
+    remaining: limit - tracker.count,
+    reset: tracker.resetAt,
   };
 }

services/github/refresh-policy.ts

@@ -1,13 +1,14 @@
 import { quotaMonitor } from './quota-monitor';
+import { TTLCache } from '../../lib/cache';
 
 export class RefreshPolicy {
   private static instance: RefreshPolicy;
 
   // Cooldown in milliseconds (default 5 minutes)
   private cooldownMs = 5 * 60 * 1000;
 
-  // Map of username -> last successful refresh timestamp
-  private refreshTimes = new Map<string, number>();
+  // Cache of username -> last successful refresh timestamp
+  private refreshTimes = new TTLCache<number>(5000, 60 * 60 * 1000);
 
   private constructor() {}
 
@@ -40,8 +41,14 @@ export class RefreshPolicy {
       return false;
     }
 
-    // 2. Check per-username cooldown
-    const lastRefresh = this.refreshTimes.get(sanitized);
+    // 2. When cooldown is 0, always allow immediately
+    if (this.cooldownMs === 0) {
+      return true;
+    }
+
+    // 3. Check per-username cooldown (use fallback key for empty usernames)
+    const cacheKey = sanitized === '' ? '__anonymous__' : sanitized;
+    const lastRefresh = this.refreshTimes.get(cacheKey);
     if (!lastRefresh) {
       return true;
     }
@@ -54,7 +61,12 @@ export class RefreshPolicy {
    */
   public recordRefresh(username: string): void {
     const sanitized = username.trim().toLowerCase();
-    this.refreshTimes.set(sanitized, Date.now());
+    // When cooldownMs is 0 there is nothing to enforce, skip the write
+    // (TTLCache rejects ttlMs <= 0). Use a fallback key for empty usernames.
+    if (this.cooldownMs > 0) {
+      const cacheKey = sanitized === '' ? '__anonymous__' : sanitized;
+      this.refreshTimes.set(cacheKey, Date.now(), this.cooldownMs);
+    }
     quotaMonitor.incrementRefreshCount();
   }
 
@@ -64,7 +76,8 @@ export class RefreshPolicy {
    */
   public getRemainingCooldown(username: string): number {
     const sanitized = username.trim().toLowerCase();
-    const lastRefresh = this.refreshTimes.get(sanitized);
+    const cacheKey = sanitized === '' ? '__anonymous__' : sanitized;
+    const lastRefresh = this.refreshTimes.get(cacheKey);
     if (!lastRefresh) {
       return 0;
     }

services/github/refresh-rate-limiter.ts

@@ -1,3 +1,5 @@
+import { TTLCache } from '../../lib/cache';
+
 interface RefreshLimitRecord {
   count: number;
   windowStart: number;
@@ -10,7 +12,7 @@ export class RefreshRateLimiter {
   private limit = 3;
   private windowMs = 60 * 60 * 1000; // 1 hour
 
-  private tracker = new Map<string, RefreshLimitRecord>();
+  private tracker = new TTLCache<RefreshLimitRecord>(100000, 60 * 60 * 1000);
 
   private constructor() {
     this.loadLimitFromEnv();
@@ -52,7 +54,7 @@ export class RefreshRateLimiter {
   } {
     this.loadLimitFromEnv(); // Ensure latest env config is applied
     const now = Date.now();
-    const clientKey = ip.trim();
+    const clientKey = ip.trim() || '__unknown__';
 
     let record = this.tracker.get(clientKey);
 
@@ -62,7 +64,7 @@ export class RefreshRateLimiter {
         count: 0,
         windowStart: now,
       };
-      this.tracker.set(clientKey, record);
+      this.tracker.set(clientKey, record, this.windowMs);
     }
 
     const resetTime = record.windowStart + this.windowMs;
@@ -78,6 +80,7 @@ export class RefreshRateLimiter {
 
     // Increment count on checking (optimistic allocation)
     record.count++;
+    this.tracker.update(clientKey, record);
 
     return {
       success: true,

services/security/track-user-protection.ts

@@ -1,4 +1,5 @@
 import { gitHubUserValidator } from '../github/validate-user';
+import { TTLCache } from '../../lib/cache';
 
 // GitHub username rules: alphanumeric or single hyphens, max 39 chars, cannot start/end with hyphen
 const GITHUB_USERNAME_REGEX = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}$/i;
@@ -9,8 +10,8 @@ const WRITE_COOLDOWN_MS = 5 * 60 * 1000;
 export class TrackUserProtection {
   private static instance: TrackUserProtection;
 
-  // Map of username -> last database write timestamp
-  private lastWriteTimes = new Map<string, number>();
+  // Cache of username -> last database write timestamp
+  private lastWriteTimes = new TTLCache<number>(5000, 60 * 60 * 1000);
 
   private constructor() {}
 
@@ -51,7 +52,7 @@ export class TrackUserProtection {
    */
   public recordWrite(username: string): void {
     const sanitized = username.trim().toLowerCase();
-    this.lastWriteTimes.set(sanitized, Date.now());
+    this.lastWriteTimes.set(sanitized, Date.now(), WRITE_COOLDOWN_MS);
   }
 
   /**