Function checkRateLimit

website/api/lib/security.js:66–90

(ip, now = Date.now())

}

function checkRateLimit(ip, now = Date.now()) {
  cleanupExpiredEntries(now);
  const { windowMs, maxRequests } = getRateLimitConfig();

  const existing = ipRateLimits.get(ip);
  if (!existing) {
    ipRateLimits.set(ip, { count: 1, windowStart: now });
    return { allowed: true, remaining: maxRequests - 1, retryAfterSeconds: 0 };
  }

  if (now - existing.windowStart >= windowMs) {
    ipRateLimits.set(ip, { count: 1, windowStart: now });
    return { allowed: true, remaining: maxRequests - 1, retryAfterSeconds: 0 };
  }

  if (existing.count >= maxRequests) {
    const retryAfterMs = windowMs - (now - existing.windowStart);
    const retryAfterSeconds = Math.max(1, Math.ceil(retryAfterMs / 1000));
    return { allowed: false, remaining: 0, retryAfterSeconds };
  }

  existing.count += 1;
  ipRateLimits.set(ip, existing);
  return { allowed: true, remaining: maxRequests - existing.count, retryAfterSeconds: 0 };
}

function checkRepoCooldown(repoKey, now = Date.now()) {
  cleanupExpiredEntries(now);