Function enforceIpRateLimit

apps/sim/lib/core/rate-limiter/route-helpers.ts:62–73

(
  bucketName: string,
  request: NextRequest,
  config: TokenBucketConfig = DEFAULT_PUBLIC_IP_ROUTE_LIMIT
)

 * `X-Forwarded-For: unknown` spoofing.
 */
export async function enforceIpRateLimit(
  bucketName: string,
  request: NextRequest,
  config: TokenBucketConfig = DEFAULT_PUBLIC_IP_ROUTE_LIMIT
): Promise<NextResponse | null> {
  const ip = getClientIp(request)
  const key = `route:${bucketName}:ip:${ip}`
  const { allowed, resetAt } = await rateLimiter.checkRateLimitDirect(key, config)
  if (allowed) return null
  logger.warn('IP rate limit exceeded', { bucket: bucketName, ip })
  return buildRateLimitResponse(resetAt)
}

/**
 * Apply a per-user limit when a userId is present, else fall back to per-IP.