feat(security): implement Redis-backed global and route-level rate limiting (#1223)

[Francis6-git]

Summary

Closes #1223

Applies platform-wide, layered rate limiting using Redis to address unthrottled API endpoints across the backend. Integrates custom window tracking to ensure rate limits persist cleanly across horizontally scaled instances while preserving health check availability and identifying authenticated users.

Changes

1. Rate Limiting Middleware (backend/src/middleware/rateLimiter.ts)

• Added Redis-backed sliding window limiter using sorted sets (ZADD, ZCOUNT, EXPIRE).
• Configured user-aware keying strategy (user:<userId> when authenticated via optionalAuth, falling back to ip:<clientIp>).
• Routed Redis errors directly through the application's existing error handling pipeline.

2. Global & Mutating Route Protection (backend/src/app.ts)

• Mounted global baseline limiter (1,000 requests / 15 mins).
• Applied mutating route limiter (POST, PUT, PATCH, DELETE: 120 requests / 1 min).
• Explicitly exempted /health and sub-paths (*/health) from budget calculations.

3. Stricter Per-Route Limits

• Auth routes (auth.routes.ts): 30 requests / 1 min.
• IPFS uploads (ipfs.routes.ts): 20 requests / 1 min.
• Search routes (search.routes.ts): 120 requests / 1 min.

4. Response Headers & Error Consistency

• Standardized response headers for both accepted and rejected requests:

  • RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset
  • Maintained legacy X-RateLimit-* headers for backwards compatibility.

• Exceeded thresholds invoke TooManyRequestsError, matching standard application error output:

  {
    "error": {
      "code": "TOO_MANY_REQUESTS",
      "message": "Rate limit exceeded",
      "requestId": "..."
    }
  }

  Verification:

1. Unit/Integration Tests: rateLimiter.test.ts (7 passed)

• Limit enforcement & rejection limits
• RateLimit-* header verification
• IP vs. authenticated user (userId) keying strategy
• /health route exemption verification
• Redis connection/error handling

2. Linting & Hygiene:

• eslint passed on touched files
• git diff --check clean (no whitespace issues)

3. Type Checking: Confirmed no new TypeScript regressions introduced (23 pre-existing errors in unrelated modules remain unchanged).

Closes #1223

[drips-wave]

@Francis6-git Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits