API Rate Limiting

const rateLimit = require('express-rate-limit');

// 1. Standard API Limiter
export const apiLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes window
    max: 100, // Limit each IP to 100 requests per windowMs
    message: {
        error: 'Too many requests from this IP, please try again after 15 minutes.'
    },
    standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
    legacyHeaders: false,
});

// 2. Strict Login Limiter (Against Brute-force)
export const loginLimiter = rateLimit({
    windowMs: 60 * 1000, // 1 minute window
    max: 5, // Start blocking after 5 consecutive failed attempts
    message: {
        error: 'Too many login attempts. Account locked for 60 seconds.'
    }
});