Rate Limiting

import { redis } from "./redis";

async function rateLimit(
  key: string,        // e.g. `rl:ip:1.2.3.4` or `rl:user:42`
  maxRequests: number, // e.g. 100
  windowSeconds: number, // e.g. 60
): Promise<{ allowed: boolean; remaining: number }> {
  const now = Date.now();
  const windowStart = now - windowSeconds * 1000;

  const pipeline = redis.pipeline();
  pipeline.zremrangebyscore(key, 0, windowStart); // drop old entries
  pipeline.zadd(key, now, `${now}-${Math.random()}`);
  pipeline.zcard(key);
  pipeline.expire(key, windowSeconds);
  const results = await pipeline.exec();

  const count = results?.[2]?.[1] as number;
  return {
    allowed: count <= maxRequests,
    remaining: Math.max(0, maxRequests - count),
  };
}

// In your API handler:
export async function POST(req: Request) {
  const ip = req.headers.get("x-forwarded-for") ?? "unknown";
  const { allowed, remaining } = await rateLimit(`rl:ip:${ip}`, 100, 60);
  if (!allowed) {
    return new Response("Too Many Requests", {
      status: 429,
      headers: { "Retry-After": "60", "X-RateLimit-Remaining": String(remaining) },
    });
  }
  // ... continue
}