src/middleware/rateLimiters.js

const rateLimit = require("express-rate-limit");

// General API traffic
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 300,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: "Too many requests, please try again later." },
});

// Tight limits on auth endpoints to blunt credential stuffing / brute force
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 10,
  standardHeaders: true,
  legacyHeaders: false,
  skipSuccessfulRequests: true,
  message: { error: "Too many attempts. Please wait a few minutes and try again." },
});

// Checkout/order creation limiter to prevent order-spam / enumeration
const orderLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  limit: 20,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: "Too many order attempts. Please try again later or contact support." },
});

// Voucher codes are bearer credentials, so redemption attempts are rate
// limited per client the same way login attempts are, to blunt brute
// forcing/guessing of codes.
const voucherRedeemLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 15,
  standardHeaders: true,
  legacyHeaders: false,
  skipSuccessfulRequests: true,
  message: { error: "Too many voucher attempts. Please wait a few minutes and try again." },
});

module.exports = { apiLimiter, authLimiter, orderLimiter, voucherRedeemLimiter };