diff --git a/apps/bs_backend/index.js b/apps/bs_backend/index.js index de17154..7572985 100644 --- a/apps/bs_backend/index.js +++ b/apps/bs_backend/index.js @@ -23,16 +23,19 @@ app.use(express.json()); // }) // ); app.use(requestLogger); +const limiterForAdminAPI = limiter(50); +const limiterForEmployeeAPI = limiter(50); +const limiterForCustomerAPI = limiter(50); app.use('/api/auth', authRoutes); -app.get('/api/test1', limiter, verifyToken, authorizeRoles(['admin']), (req, res) => { +app.get('/api/test1', limiterForAdminAPI, verifyToken, authorizeRoles(['admin']), (req, res) => { res.send('Hello Admin!'); }); -app.get('/api/test2', verifyToken, authorizeRoles(['employee']), (req, res) => { +app.get('/api/test2', limiterForEmployeeAPI, verifyToken, authorizeRoles(['employee']), (req, res) => { res.send('Hello Employee!'); }); -app.get('/api/test3', verifyToken, authorizeRoles(['customer']), (req, res) => { +app.get('/api/test3', limiterForCustomerAPI, verifyToken, authorizeRoles(['customer']), (req, res) => { res.send('Hello Customer!'); }); diff --git a/apps/bs_backend/routes/auth.routes.js b/apps/bs_backend/routes/auth.routes.js index 4887138..d0db08b 100644 --- a/apps/bs_backend/routes/auth.routes.js +++ b/apps/bs_backend/routes/auth.routes.js @@ -6,8 +6,10 @@ const limiter = require('../utils/rateLimitHandler'); const router = express.Router(); -router.post('/register', limiter, validateRequest(registerValidation), register); -router.post('/login', limiter, validateRequest(loginValidation), login); +const limiterForAuth = limiter(5); + +router.post('/register', limiterForAuth, validateRequest(registerValidation), register); +router.post('/login', limiterForAuth, validateRequest(loginValidation), login); router.post('/logout', logout); // module.exports = router; diff --git a/apps/bs_backend/utils/rateLimitHandler.js b/apps/bs_backend/utils/rateLimitHandler.js index 9c06243..02985f2 100644 --- a/apps/bs_backend/utils/rateLimitHandler.js +++ b/apps/bs_backend/utils/rateLimitHandler.js @@ -2,14 +2,17 @@ const rateLimit = require('express-rate-limit'); const ErrorHandler = require('./ErrorHandler'); //Define the rate limit -const limiter = rateLimit({ - windowMs: 15 * 60 * 1000, - max: 5, - handler: (req, res, next) => { - next( - new ErrorHandler('Rate limit exceeded: Too many requests.', 429, 'REQUEST_EXCEED_ERROR', { field: 'api' }) - ); - }, -}); +const limiter = (maxRequest) => + rateLimit({ + windowMs: 15 * 60 * 1000, + max: maxRequest || 100, + handler: (req, res, next) => { + next( + new ErrorHandler('Rate limit exceeded: Too many requests.', 429, 'REQUEST_EXCEED_ERROR', { + field: 'api', + }) + ); + }, + }); module.exports = limiter;