8

dist/app.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const app_config_1 = require("./config/app.config");
 const logger_middleware_1 = require("./middleware/logger.middleware");
 const error_middleware_1 = require("./middleware/error.middleware");
+const rateLimit_middleware_1 = require("./middleware/rateLimit.middleware");
 const api_routes_1 = require("./routes/api.routes");
 // Repositories
 const fileTaskRepository_1 = require("./repositories/fileStorage/fileTaskRepository");
@@ -29,6 +30,7 @@ const admin_controller_1 = require("./controllers/admin.controller");
 function createApp() {
     const app = (0, express_1.default)();
     // Middleware
+    app.use(rateLimit_middleware_1.globalRateLimiter);
     app.use(express_1.default.json());
     app.use(express_1.default.urlencoded({ extended: true }));
     app.use(logger_middleware_1.requestLogger);

dist/middleware/rateLimit.middleware.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.strictActionRateLimiter = exports.globalRateLimiter = void 0;
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+/**
+ * General application rate limiter to suppress bot scanning volume and protect endpoints.
+ * Allows legitimate dashboard background polling (every ~3s = 60 req/min) while blocking aggressive scanners.
+ */
+exports.globalRateLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    limit: 500, // Limit each IP to 500 requests per 15-minute window
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: {
+        status: 429,
+        error: 'Too Many Requests',
+        message: 'Rate limit exceeded. Please slow down your requests and try again later.',
+    },
+});
+/**
+ * Strict rate limiter for sensitive state-modifying endpoints (e.g., worker shutdown, task reset/generation).
+ */
+exports.strictActionRateLimiter = (0, express_rate_limit_1.default)({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    limit: 30, // Limit each IP to 30 administrative actions per 15-minute window
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: {
+        status: 429,
+        error: 'Too Many Requests',
+        message: 'Rate limit exceeded for administrative actions. Please try again later.',
+    },
+});

dist/routes/api.routes.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApiRouter = createApiRouter;
 const express_1 = require("express");
+const rateLimit_middleware_1 = require("../middleware/rateLimit.middleware");
 function createApiRouter(healthController, adminController) {
     const router = (0, express_1.Router)();
     // Health check
@@ -11,8 +12,9 @@ function createApiRouter(healthController, adminController) {
     router.get('/workers', adminController.getWorkers);
     router.get('/tasks', adminController.getTasks);
     router.get('/dataset/rows', adminController.getDatasetRows);
-    router.post('/tasks/create', adminController.createTask);
-    router.post('/tasks/reset', adminController.resetTasks);
-    router.post('/shutdown-worker', adminController.shutdownWorker);
+    // Sensitive administrative POST actions protected by strict rate limit
+    router.post('/tasks/create', rateLimit_middleware_1.strictActionRateLimiter, adminController.createTask);
+    router.post('/tasks/reset', rateLimit_middleware_1.strictActionRateLimiter, adminController.resetTasks);
+    router.post('/shutdown-worker', rateLimit_middleware_1.strictActionRateLimiter, adminController.shutdownWorker);
     return router;
 }

package-lock.json

@@ -11,6 +11,7 @@
       "dependencies": {
         "ejs": "^3.1.10",
         "express": "^4.21.2",
+        "express-rate-limit": "^8.6.0",
         "mime-types": "^2.1.35",
         "multer": "^1.4.5-lts.1",
         "ws": "^8.18.0"
@@ -719,6 +720,48 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "8.6.0",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.0.tgz",
+      "integrity": "sha512-XKJXDsASUOo0LLtFwW5hCcQGH0N4WQc/Rn8/Pvoia+TJFOkkFPvrtW9lZOeeNcxQJspvOIERMwiRLsVFlhHEkA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
+    "node_modules/express-rate-limit/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/express-rate-limit/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/filelist": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
@@ -990,6 +1033,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",

package.json

@@ -20,6 +20,7 @@
   "dependencies": {
     "ejs": "^3.1.10",
     "express": "^4.21.2",
+    "express-rate-limit": "^8.6.0",
     "mime-types": "^2.1.35",
     "multer": "^1.4.5-lts.1",
     "ws": "^8.18.0"

src/app.ts

@@ -3,6 +3,7 @@ import path from 'path';
 import { CONFIG } from './config/app.config';
 import { requestLogger } from './middleware/logger.middleware';
 import { errorHandler } from './middleware/error.middleware';
+import { globalRateLimiter } from './middleware/rateLimit.middleware';
 import { createApiRouter } from './routes/api.routes';
 
 // Repositories
@@ -45,6 +46,7 @@ export function createApp(): AppContext {
   const app = express();
 
   // Middleware
+  app.use(globalRateLimiter);
   app.use(express.json());
   app.use(express.urlencoded({ extended: true }));
   app.use(requestLogger);

src/middleware/rateLimit.middleware.ts

@@ -0,0 +1,32 @@
+import rateLimit from 'express-rate-limit';
+
+/**
+ * General application rate limiter to suppress bot scanning volume and protect endpoints.
+ * Allows legitimate dashboard background polling (every ~3s = 60 req/min) while blocking aggressive scanners.
+ */
+export const globalRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  limit: 500, // Limit each IP to 500 requests per 15-minute window
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  message: {
+    status: 429,
+    error: 'Too Many Requests',
+    message: 'Rate limit exceeded. Please slow down your requests and try again later.',
+  },
+});
+
+/**
+ * Strict rate limiter for sensitive state-modifying endpoints (e.g., worker shutdown, task reset/generation).
+ */
+export const strictActionRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  limit: 30, // Limit each IP to 30 administrative actions per 15-minute window
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  message: {
+    status: 429,
+    error: 'Too Many Requests',
+    message: 'Rate limit exceeded for administrative actions. Please try again later.',
+  },
+});

src/routes/api.routes.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import { HealthController } from '../controllers/health.controller';
 import { AdminController } from '../controllers/admin.controller';
+import { strictActionRateLimiter } from '../middleware/rateLimit.middleware';
 
 export function createApiRouter(
   healthController: HealthController,
@@ -16,9 +17,12 @@ export function createApiRouter(
   router.get('/workers', adminController.getWorkers);
   router.get('/tasks', adminController.getTasks);
   router.get('/dataset/rows', adminController.getDatasetRows);
-  router.post('/tasks/create', adminController.createTask);
-  router.post('/tasks/reset', adminController.resetTasks);
-  router.post('/shutdown-worker', adminController.shutdownWorker);
+
+  // Sensitive administrative POST actions protected by strict rate limit
+  router.post('/tasks/create', strictActionRateLimiter, adminController.createTask);
+  router.post('/tasks/reset', strictActionRateLimiter, adminController.resetTasks);
+  router.post('/shutdown-worker', strictActionRateLimiter, adminController.shutdownWorker);
 
   return router;
 }
+