Merge pull request #93 from jd-apprentice/development

UPDATE PROD

Author: jd-apprentice

package.json

@@ -31,7 +31,8 @@
     "mongoose": "^8.6.1",
     "multer": "^1.4.4",
     "multer-storage-cloudinary": "^4.0.0",
-    "rollbar": "^2.26.4"
+    "rollbar": "^2.26.4",
+    "express-rate-limit": "^7.5.0"
   },
   "devDependencies": {
     "@types/bcrypt": "^5.0.2",

src/user/user-routes.ts

@@ -1,5 +1,6 @@
 // External Modules
 import { Router } from 'express';
+import rateLimit from 'express-rate-limit';
 
 // Internal Modules
 import userController from './user-controller';
@@ -8,13 +9,19 @@ import { userExists, validateUser, validateToken } from './user-middleware';
 
 const userRouter = Router();
 
-userRouter.get('/', validateToken, userController.getUsers);
-userRouter.get('/info', validateToken, userController.getUserInfo);
-userRouter.post('/login', validateUser, userController.login);
-userRouter.post('/create', userExists, userController.createUser);
-userRouter.get('/:id', validateToken, userController.getUser);
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 requests per windowMs
+});
+
+userRouter.get('/', limiter, validateToken, userController.getUsers);
+userRouter.get('/info', limiter, validateToken, userController.getUserInfo);
+userRouter.post('/login', limiter, validateUser, userController.login);
+userRouter.post('/create', limiter, userExists, userController.createUser);
+userRouter.get('/:id', limiter, validateToken, userController.getUser);
 userRouter.patch(
   '/',
+  limiter,
   validateToken,
   upload.single('image'),
   userController.updatePicture,