feat(api): implement centralized rate limiting middleware for public endpoints (JhaSourav07#581)

## Description

Fixes JhaSourav07#270

Implemented centralized middleware-based API rate limiting for public
endpoints to improve backend stability and protect shared GitHub API
quota usage.

### Protected Routes

- `/api/streak`
- `/api/github`
- `/api/track-user`

---

## What Changed

### Centralized Middleware Protection

- added reusable middleware-based rate limiting
- implemented IP-based request throttling
- added graceful `429 Too Many Requests` responses
- configured route-specific middleware matchers

### Rate Limiting Infrastructure

- introduced lightweight in-memory request tracking using `Map`
- added automatic cleanup/eviction handling for large tracking sets
- preserved low-latency edge-compatible behavior
- avoided external infrastructure dependencies

### Response Improvements

Added standard rate-limit headers:

- `X-RateLimit-Limit`
- `X-RateLimit-Remaining`
- `X-RateLimit-Reset`

### Stability & Safety

- preserved existing API response behavior
- preserved cache and refresh flow compatibility
- prevented unnecessary GitHub API request flooding
- ensured middleware execution only applies to protected routes

---

## Verification

Validated successfully with:

- `npm run format`
- `npm run lint`
- `npm run typecheck`
- `npm run test`
- `npm run build`

### Test Results

- all existing tests passing
- added dedicated rate limiting tests
- verified edge/runtime compatibility

---

## Pillar

- [ ] 🎨 Pillar 1 — New Theme Design
- [ ] 📐 Pillar 2 — Geometric SVG Improvement
- [ ] 🕐 Pillar 3 — Timezone Logic Optimization
- [x] 🛠️ Other (Bug fix, refactoring, docs)

---

## Visual Preview

### Example 429 Response

```json
{
  "error": "Too many requests"
}
```

---

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [ ] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have starred the repo.
- [x] I have made sure that I have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [x] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: Rachit-Kakkad1

lib/rate-limit.test.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { rateLimit } from './rate-limit';
+
+describe('rateLimit', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  it('allows requests within the limit', () => {
+    const ip = '1.2.3.4';
+    for (let i = 0; i < 60; i++) {
+      const result = rateLimit(ip, 60, 60000);
+      expect(result.success).toBe(true);
+      expect(result.remaining).toBe(60 - (i + 1));
+    }
+  });
+
+  it('blocks requests exceeding the limit', () => {
+    const ip = '2.3.4.5';
+    // Consume 60 requests
+    for (let i = 0; i < 60; i++) {
+      rateLimit(ip, 60, 60000);
+    }
+
+    // 61st request should fail
+    const result = rateLimit(ip, 60, 60000);
+    expect(result.success).toBe(false);
+    expect(result.remaining).toBe(0);
+  });
+
+  it('resets after the window expires', () => {
+    const ip = '3.4.5.6';
+    const windowMs = 60000;
+
+    // Consume all requests
+    for (let i = 0; i < 60; i++) {
+      rateLimit(ip, 60, windowMs);
+    }
+
+    expect(rateLimit(ip, 60, windowMs).success).toBe(false);
+
+    // Fast-forward time
+    vi.advanceTimersByTime(windowMs + 1);
+
+    const result = rateLimit(ip, 60, windowMs);
+    expect(result.success).toBe(true);
+    expect(result.remaining).toBe(59);
+  });
+
+  it('tracks different IPs separately', () => {
+    const ip1 = '11.11.11.11';
+    const ip2 = '22.22.22.22';
+
+    // Consume all requests for ip1
+    for (let i = 0; i < 60; i++) {
+      rateLimit(ip1, 60, 60000);
+    }
+
+    expect(rateLimit(ip1, 60, 60000).success).toBe(false);
+    expect(rateLimit(ip2, 60, 60000).success).toBe(true);
+  });
+});

lib/rate-limit.ts

@@ -30,3 +30,79 @@ export class RateLimiter {
 
 // Global instance for track-user endpoint (5 requests per IP per minute)
 export const trackUserRateLimiter = new RateLimiter(5, 60000);
+
+/**
+ * Lightweight in-memory rate limiter for Next.js Edge Middleware.
+ *
+ * Note: In a distributed edge environment, this is per-instance.
+ * For global rate limiting, a distributed store like Redis would be required.
+ */
+
+interface RateLimitResult {
+  success: boolean;
+  limit: number;
+  remaining: number;
+  reset: number;
+}
+
+const trackers = new Map<string, { count: number; expires: number }>();
+
+/**
+ * Checks if a request from a given IP should be rate limited.
+ *
+ * @param ip The IP address to track
+ * @param limit Maximum number of requests allowed in the window
+ * @param windowMs Time window in milliseconds
+ * @returns RateLimitResult
+ */
+export function rateLimit(
+  ip: string,
+  limit: number = 60,
+  windowMs: number = 60000
+): RateLimitResult {
+  const now = Date.now();
+  const tracker = trackers.get(ip);
+
+  // Periodic cleanup of the map to prevent memory leaks.
+  // We perform a partial cleanup if the map grows too large.
+  if (trackers.size > 2000) {
+    let cleaned = 0;
+    for (const [key, value] of trackers.entries()) {
+      if (now > value.expires) {
+        trackers.delete(key);
+        cleaned++;
+      }
+      // Stop cleaning after some work to avoid blocking the request for too long
+      if (cleaned > 500) break;
+    }
+  }
+
+  if (!tracker || now > tracker.expires) {
+    const expires = now + windowMs;
+    trackers.set(ip, { count: 1, expires });
+    return {
+      success: true,
+      limit,
+      remaining: limit - 1,
+      reset: expires,
+    };
+  }
+
+  tracker.count++;
+
+  if (tracker.count > limit) {
+    return {
+      success: false,
+      limit,
+      remaining: 0,
+      reset: tracker.expires,
+    };
+  }
+
+  return {
+    success: true,
+    limit,
+    remaining: limit - tracker.count,
+    reset: tracker.expires,
+  };
+}

middleware.ts

@@ -0,0 +1,56 @@
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { rateLimit } from './lib/rate-limit';
+
+/**
+ * Middleware to enforce rate limiting on specific API routes.
+ *
+ * Protected Routes:
+ * - /api/streak
+ * - /api/github
+ * - /api/track-user
+ *
+ * Limit: 60 requests per minute per IP.
+ */
+export function middleware(request: NextRequest) {
+  // Use Vercel's ip property if available, fallback to headers, then localhost
+  const ip =
+    request.headers.get('x-forwarded-for')?.split(',')[0] ??
+    request.headers.get('x-real-ip') ??
+    '127.0.0.1';
+
+  // Apply rate limiting
+  // 60 requests per 60,000ms (1 minute)
+  const result = rateLimit(ip, 60, 60000);
+
+  if (!result.success) {
+    return NextResponse.json(
+      { error: 'Too many requests' },
+      {
+        status: 429,
+        headers: {
+          'Content-Type': 'application/json',
+          'X-RateLimit-Limit': result.limit.toString(),
+          'X-RateLimit-Remaining': result.remaining.toString(),
+          'X-RateLimit-Reset': result.reset.toString(),
+        },
+      }
+    );
+  }
+
+  // Add rate limit headers to the response for successful requests
+  const response = NextResponse.next();
+  response.headers.set('X-RateLimit-Limit', result.limit.toString());
+  response.headers.set('X-RateLimit-Remaining', result.remaining.toString());
+  response.headers.set('X-RateLimit-Reset', result.reset.toString());
+
+  return response;
+}
+
+/**
+ * Configure which routes should trigger this middleware.
+ * Using a matcher is more efficient than checking pathnames inside the middleware.
+ */
+export const config = {
+  matcher: ['/api/streak/:path*', '/api/github/:path*', '/api/track-user/:path*'],
+};