Merge pull request #9 from Mra1k3r0/master

fix(proxy): rate limiter no longer blocks auth

Author: mrepol742

app/lib/proxy/headless-browser-check.ts

@@ -1,17 +1,20 @@
 import { NextResponse } from "next/server";
 
-export default function HeadlessBrowserCheck(req: Request) {
-  const ua = req.headers.get("user-agent") || "";
-  const headlessPatterns = [
-    "HeadlessChrome",
-    "PhantomJS",
-    "SlimerJS",
-    "Puppeteer",
-    "Playwright",
-    "Chrome-Lighthouse",
-  ];
+const HEADLESS_PATTERNS = [
+  "HeadlessChrome",
+  "PhantomJS",
+  "SlimerJS",
+  "Puppeteer",
+  "Playwright",
+  "Chrome-Lighthouse",
+] as const;
 
-  const isHeadless = headlessPatterns.some((p) =>
+// block bots, pass through real browsers
+export default function HeadlessBrowserCheck(
+  req: Request,
+): NextResponse | undefined {
+  const ua = req.headers.get("user-agent") ?? "";
+  const isHeadless = HEADLESS_PATTERNS.some((p) =>
     ua.toLowerCase().includes(p.toLowerCase()),
   );
 
@@ -24,4 +27,6 @@ export default function HeadlessBrowserCheck(req: Request) {
       },
     );
   }
+
+  return undefined;
 }

app/lib/proxy/rate-limiter.ts

@@ -1,41 +1,42 @@
 import { NextRequest, NextResponse } from "next/server";
 import { checkRateLimit } from "../rate-limit";
 
-export default function RateLimiter(request: NextRequest) {
-  if (/api\//.test(request.nextUrl.pathname)) {
-    const forwardedFor = request.headers.get("x-forwarded-for");
-    const ip = forwardedFor?.split(",")[0] || "unknown";
-    const origin = request.headers.get("origin");
-
-    const allowedOrigins =
-      process.env.NODE_ENV === "development"
-        ? [/^http:\/\/localhost:\d+$/, /^http:\/\/127\.0\.0\.1:\d+$/]
-        : [/^https?:\/\/devpulse-waka\.vercel\.app(:\d+)?$/];
-
-    const isAllowed1 =
-      !origin || allowedOrigins.some((pattern) => pattern.test(origin));
-
-    if (!isAllowed1) {
-      return NextResponse.json(
-        { error: "Hehe you're going too far naah..." },
-        { status: 403 },
-      );
-    }
-
-    const maxRequest = /api\/(login|signup)/.test(request.nextUrl.pathname)
-      ? 5
-      : 10;
-
-    const window = /api\/(login|signup)/.test(request.nextUrl.pathname)
-      ? 60 * 60 * 1000
-      : 5 * 60 * 1000;
-
-    const isAllowed = checkRateLimit(ip, maxRequest, window);
-
-    if (!isAllowed) {
-      return NextResponse.json({ error: "Too many requests" }, { status: 429 });
-    }
+export default function RateLimiter(
+  request: NextRequest,
+): NextResponse | undefined {
+  if (!/api\//.test(request.nextUrl.pathname)) {
+    return undefined;
   }
 
-  return NextResponse.next();
+  const forwardedFor = request.headers.get("x-forwarded-for");
+  const ip = forwardedFor?.split(",")[0]?.trim() || "unknown";
+  const origin = request.headers.get("origin");
+
+  const allowedOrigins =
+    process.env.NODE_ENV === "development"
+      ? [/^http:\/\/localhost:\d+$/, /^http:\/\/127\.0\.0\.1:\d+$/]
+      : [/^https?:\/\/devpulse-waka\.vercel\.app(:\d+)?$/];
+
+  const isOriginAllowed =
+    !origin || allowedOrigins.some((pattern) => pattern.test(origin));
+
+  if (!isOriginAllowed) {
+    return NextResponse.json(
+      { error: "Hehe you're going too far naah..." },
+      { status: 403 },
+    );
+  }
+
+  const isAuthEndpoint = /api\/(login|signup)/.test(request.nextUrl.pathname);
+  const maxRequests = isAuthEndpoint ? 5 : 10;
+  const windowMs = isAuthEndpoint ? 60 * 60 * 1000 : 5 * 60 * 1000;
+
+  const withinLimit = checkRateLimit(ip, maxRequests, windowMs);
+
+  if (!withinLimit) {
+    return NextResponse.json({ error: "Too many requests" }, { status: 429 });
+  }
+
+  // let it through so auth still runs
+  return undefined;
 }

app/lib/rate-limit.ts

@@ -1,3 +1,4 @@
+// in-memory so on serverless each instance has its own count (redis/kv if you need it shared)
 const ipRequests: Record<string, { count: number; firstRequest: number }> = {};
 
 export function checkRateLimit(ip: string, maxRequests: number, rateLimitWindow: number): boolean {
@@ -11,13 +12,12 @@ export function checkRateLimit(ip: string, maxRequests: number, rateLimitWindow:
   const data = ipRequests[ip];
   if (now - data.firstRequest < rateLimitWindow) {
     if (data.count >= maxRequests) {
-      return false; // ❌ over the limit
+      return false;
     }
     data.count++;
     return true;
   }
 
-  // reset window
   ipRequests[ip] = { count: 1, firstRequest: now };
   return true;
 }

proxy.ts

@@ -5,13 +5,14 @@ import RateLimiter from "./app/lib/proxy/rate-limiter";
 
 const env = process.env.NODE_ENV;
 
+// headless → rate limit → auth; only return when we block or redirect
 export async function proxy(req: NextRequest) {
   const headlessResponse = headlessBrowserCheck(req);
   if (headlessResponse) return headlessResponse;
 
   if (env === "production") {
-    const rateLimiter = RateLimiter(req);
-    if (rateLimiter) return rateLimiter;
+    const rateLimitResponse = RateLimiter(req);
+    if (rateLimitResponse) return rateLimitResponse;
   }
 
   const authResponse = await auth(req);