Merge pull request #34 from Shashank0701-byte/feature/api-rate-limiting-issue-10

feat: implement comprehensive API rate limiting protection - #10

Author: rishabh3562

.env.example

@@ -5,3 +5,7 @@ NEXT_PUBLIC_GEMINI_API_KEY=your_gemini_api_key_here
 # MongoDB Database Configuration
 # Format: mongodb+srv://username:password@cluster.mongodb.net/database?retryWrites=true&w=majority
 MONGODB_URI=mongodb+srv://username:password@cluster.mongodb.net/toolbox?retryWrites=true&w=majority
+
+# Rate Limiting (Upstash Redis)
+UPSTASH_REDIS_REST_URL=your-upstash-redis-url
+UPSTASH_REDIS_REST_TOKEN=your-upstash-redis-token

README.md

@@ -28,6 +28,7 @@ ToolBox is revolutionizing how developers create and share productivity tools. W
 - **🌙 Dark Mode** - Full dark mode support for comfortable extended use
 - **📦 MongoDB Integration** - Robust data storage with user isolation
 - **🛡️ Type Safe** - Built with TypeScript for reliability and superior developer experience
+- **🚨 Rate Limiting** - API protection with intelligent rate limiting and IP-based tracking
 
 ### 🚀 Roadmap (Community Contributions Welcome!)
 - **🔌 Plugin Marketplace** - Discover and install community-created tools

__tests__/rate-limiting.test.ts

@@ -0,0 +1,206 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { withRateLimit, checkRateLimit } from "../lib/middleware/rate-limit-middleware";
+import { RATE_LIMIT_CONFIG } from "../lib/rate-limit";
+
+// Mock the rate limiter for testing
+jest.mock("../lib/rate-limit", () => ({
+  ...jest.requireActual("../lib/rate-limit"),
+  rateLimiters: {
+    default: {
+      limit: jest.fn(),
+    },
+    api: {
+      limit: jest.fn(),
+    },
+    templates: {
+      limit: jest.fn(),
+    },
+    snippets: {
+      limit: jest.fn(),
+    },
+    ai: {
+      limit: jest.fn(),
+    },
+    auth: {
+      limit: jest.fn(),
+    },
+    upload: {
+      limit: jest.fn(),
+    },
+  },
+}));
+
+describe("Rate Limiting", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe("Rate Limit Configuration", () => {
+    it("should have correct rate limit configurations", () => {
+      expect(RATE_LIMIT_CONFIG.default).toEqual({ requests: 100, window: "1h" });
+      expect(RATE_LIMIT_CONFIG.api).toEqual({ requests: 60, window: "1m" });
+      expect(RATE_LIMIT_CONFIG.templates).toEqual({ requests: 30, window: "1m" });
+      expect(RATE_LIMIT_CONFIG.snippets).toEqual({ requests: 50, window: "1m" });
+      expect(RATE_LIMIT_CONFIG.ai).toEqual({ requests: 10, window: "1m" });
+      expect(RATE_LIMIT_CONFIG.auth).toEqual({ requests: 5, window: "1m" });
+      expect(RATE_LIMIT_CONFIG.upload).toEqual({ requests: 20, window: "1m" });
+    });
+  });
+
+  describe("Rate Limiting Middleware", () => {
+    const mockHandler = jest.fn();
+    const mockRequest = new NextRequest("http://localhost:3000/api/test", {
+      headers: {
+        "x-forwarded-for": "192.168.1.1",
+      },
+    });
+
+    beforeEach(() => {
+      mockHandler.mockClear();
+    });
+
+    it("should allow requests within rate limit", async () => {
+      const { rateLimiters } = require("../lib/rate-limit");
+      rateLimiters.default.limit.mockResolvedValue({
+        success: true,
+        limit: 100,
+        remaining: 99,
+        reset: Date.now() + 3600000,
+      });
+
+      mockHandler.mockResolvedValue(new Response("OK"));
+
+      const response = await withRateLimit(mockRequest, mockHandler, "default");
+
+      expect(rateLimiters.default.limit).toHaveBeenCalledWith("192.168.1.1:default");
+      expect(mockHandler).toHaveBeenCalledWith(mockRequest);
+      expect(response.status).toBe(200);
+    });
+
+    it("should block requests exceeding rate limit", async () => {
+      const { rateLimiters } = require("../lib/rate-limit");
+      rateLimiters.default.limit.mockResolvedValue({
+        success: false,
+        limit: 100,
+        remaining: 0,
+        reset: Date.now() + 3600000,
+      });
+
+      const response = await withRateLimit(mockRequest, mockHandler, "default");
+
+      expect(rateLimiters.default.limit).toHaveBeenCalledWith("192.168.1.1:default");
+      expect(mockHandler).not.toHaveBeenCalled();
+      expect(response.status).toBe(429);
+
+      const body = await response.json();
+      expect(body.error).toBe("Rate limit exceeded");
+    });
+
+    it("should add rate limit headers to successful responses", async () => {
+      const { rateLimiters } = require("../lib/rate-limit");
+      rateLimiters.api.limit.mockResolvedValue({
+        success: true,
+        limit: 60,
+        remaining: 59,
+        reset: Date.now() + 60000,
+      });
+
+      mockHandler.mockResolvedValue(new Response("OK"));
+
+      const response = await withRateLimit(mockRequest, mockHandler, "api");
+
+      expect(response.headers.get("X-RateLimit-Limit")).toBe("60");
+      expect(response.headers.get("X-RateLimit-Remaining")).toBe("59");
+      expect(response.headers.get("X-RateLimit-Policy")).toBe("sliding-window");
+    });
+
+    it("should handle different rate limit types", async () => {
+      const { rateLimiters } = require("../lib/rate-limit");
+      
+      // Test AI rate limiting (strictest)
+      rateLimiters.ai.limit.mockResolvedValue({
+        success: true,
+        limit: 10,
+        remaining: 9,
+        reset: Date.now() + 60000,
+      });
+
+      mockHandler.mockResolvedValue(new Response("OK"));
+
+      const response = await withRateLimit(mockRequest, mockHandler, "ai");
+
+      expect(rateLimiters.ai.limit).toHaveBeenCalledWith("192.168.1.1:ai");
+      expect(response.headers.get("X-RateLimit-Limit")).toBe("10");
+    });
+
+    it("should handle rate limiting errors gracefully", async () => {
+      const { rateLimiters } = require("../lib/rate-limit");
+      rateLimiters.default.limit.mockRejectedValue(new Error("Redis connection failed"));
+
+      mockHandler.mockResolvedValue(new Response("OK"));
+
+      const response = await withRateLimit(mockRequest, mockHandler, "default");
+
+      // Should allow request to proceed if rate limiting fails
+      expect(mockHandler).toHaveBeenCalledWith(mockRequest);
+      expect(response.status).toBe(200);
+    });
+  });
+
+  describe("IP Address Detection", () => {
+    it("should extract IP from X-Forwarded-For header", () => {
+      const { getClientIP } = require("../lib/rate-limit");
+      const request = new NextRequest("http://localhost:3000/api/test", {
+        headers: {
+          "x-forwarded-for": "192.168.1.1, 10.0.0.1",
+        },
+      });
+
+      const ip = getClientIP(request);
+      expect(ip).toBe("192.168.1.1");
+    });
+
+    it("should extract IP from X-Real-IP header", () => {
+      const { getClientIP } = require("../lib/rate-limit");
+      const request = new NextRequest("http://localhost:3000/api/test", {
+        headers: {
+          "x-real-ip": "192.168.1.2",
+        },
+      });
+
+      const ip = getClientIP(request);
+      expect(ip).toBe("192.168.1.2");
+    });
+
+    it("should fallback to default IP", () => {
+      const { getClientIP } = require("../lib/rate-limit");
+      const request = new NextRequest("http://localhost:3000/api/test");
+
+      const ip = getClientIP(request);
+      expect(ip).toBe("127.0.0.1");
+    });
+  });
+});
+
+describe("Rate Limit Error Responses", () => {
+  it("should create proper error response format", () => {
+    const { createRateLimitErrorResponse } = require("../lib/rate-limit");
+    const result = {
+      success: false,
+      limit: 10,
+      remaining: 0,
+      reset: new Date("2024-01-01T12:00:00Z").getTime(),
+    };
+
+    const response = createRateLimitErrorResponse(result);
+
+    expect(response.status).toBe(429);
+    expect(response.headers.get("X-RateLimit-Limit")).toBe("10");
+    expect(response.headers.get("X-RateLimit-Remaining")).toBe("0");
+    expect(response.headers.get("Retry-After")).toBeTruthy();
+  });
+});

app/api/ai/generate/route.ts

@@ -0,0 +1,87 @@
+import { NextRequest, NextResponse } from "next/server";
+import { rateLimitMiddleware } from "@/lib/middleware/rate-limit-middleware";
+
+// Helper function to sanitize user input
+const sanitizeInput = (input: string): string => {
+  return input.replace(/[<>'"]/g, (char) => {
+    const entities: { [key: string]: string } = {
+      '<': '&lt;',
+      '>': '&gt;',
+      "'": '&#39;',
+      '"': '&quot;'
+    };
+    return entities[char] || char;
+  }).trim().slice(0, 500); // Limit length
+};
+
+// POST /api/ai/generate - AI-powered code generation
+async function handleAIGenerate(request: NextRequest): Promise<NextResponse> {
+  try {
+    const body = await request.json();
+    const { prompt, type, language } = body;
+
+    // Validate required fields
+    if (!prompt || !type) {
+      return NextResponse.json(
+        { error: "Prompt and type are required" },
+        { status: 400 }
+      );
+    }
+
+    // Validate type
+    const supportedTypes = ["code", "template", "snippet", "documentation"];
+    if (!supportedTypes.includes(type)) {
+      return NextResponse.json(
+        { error: `Unsupported type. Supported: ${supportedTypes.join(", ")}` },
+        { status: 400 }
+      );
+    }
+
+    // Sanitize inputs
+    const sanitizedPrompt = sanitizeInput(prompt);
+    const sanitizedLanguage = language ? sanitizeInput(language) : "javascript";
+    
+    // Simulate AI generation (replace with actual AI service)
+    let generatedContent = "";
+    
+    switch (type) {
+      case "code":
+        generatedContent = `// Generated ${sanitizedLanguage} code based on: ${sanitizedPrompt}\nfunction generatedFunction() {\n  // TODO: Implement based on prompt\n  console.log("Generated from prompt");\n}`;
+        break;
+      case "template":
+        generatedContent = `<!-- Generated template for: ${sanitizedPrompt} -->\n<div class="{{className}}">\n  <h1>{{title}}</h1>\n  <p>{{description}}</p>\n</div>`;
+        break;
+      case "snippet":
+        generatedContent = `// Snippet: ${sanitizedPrompt}\nconst result = () => {\n  // Implementation here\n  return "Generated snippet";\n};`;
+        break;
+      case "documentation":
+        generatedContent = `# ${sanitizedPrompt}\n\n## Overview\nGenerated documentation for ${sanitizedPrompt}.\n\n## Usage\n\`\`\`${sanitizedLanguage}\n// Example usage\n\`\`\`\n\n## Parameters\n- param1: Description\n- param2: Description`;
+        break;
+    }
+
+    const result = {
+      id: crypto.randomUUID(),
+      prompt,
+      type,
+      language: language || "javascript",
+      content: generatedContent,
+      generatedAt: new Date().toISOString(),
+      model: "placeholder", // Update when real AI service is integrated
+    };
+
+    return NextResponse.json({
+      success: true,
+      data: result,
+      message: "Content generated successfully",
+    });
+  } catch (error) {
+    console.error("Error generating AI content:", error);
+    return NextResponse.json(
+      { error: "Failed to generate content" },
+      { status: 500 }
+    );
+  }
+}
+
+// Apply strict rate limiting for AI endpoints
+export const POST = rateLimitMiddleware.ai(handleAIGenerate);

app/api/health/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from "next/server";
+import { rateLimitMiddleware } from "@/lib/middleware/rate-limit-middleware";
+
+// GET /api/health - Health check endpoint
+async function handleHealthCheck(request: NextRequest): Promise<NextResponse> {
+  try {
+    const health = {
+      status: "healthy",
+      timestamp: new Date().toISOString(),
+      uptime: process.uptime(),
+      version: process.env.npm_package_version || "1.0.0",
+      environment: process.env.NODE_ENV || "development",
+      services: {
+        database: "connected", // Placeholder
+        redis: process.env.UPSTASH_REDIS_REST_URL ? "connected" : "disabled",
+        ai: "available", // Placeholder
+      },
+      rateLimit: {
+        enabled: true,
+        provider: process.env.UPSTASH_REDIS_REST_URL ? "redis" : "memory",
+      }
+    };
+
+    return NextResponse.json({
+      success: true,
+      data: health,
+    });
+  } catch (error) {
+    console.error("Health check error:", error);
+    return NextResponse.json(
+      { 
+        success: false,
+        status: "unhealthy",
+        error: "Health check failed",
+        timestamp: new Date().toISOString(),
+      },
+      { status: 503 }
+    );
+  }
+}
+
+// Apply default rate limiting to health check
+export const GET = rateLimitMiddleware.api(handleHealthCheck);