Merge pull request #737 from ugoocreates-pixel/feature/issue-045-fingerprint-ratelimit

Feature/issue 045 fingerprint ratelimit

Author: greatest0fallt1me

src/config/env-schema.ts

@@ -85,6 +85,10 @@ const baseSchema = z.object({
   INVITES_RATE_LIMIT_CAPACITY: z.coerce.number().int().positive().default(60),
   INVITES_RATE_LIMIT_WINDOW_MS: z.coerce.number().int().positive().default(60_000),
 
+  // ── Fingerprint rate limiting (per user, token bucket) ────────
+  FINGERPRINT_RATE_LIMIT_CAPACITY: z.coerce.number().int().positive().default(60),
+  FINGERPRINT_RATE_LIMIT_WINDOW_MS: z.coerce.number().int().positive().default(60_000),
+
   // ── Settle confirmer ──────────────────────────────────────
   SETTLE_CONFIRMER_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(5_000),
   SETTLE_CONFIRMER_CONFIRMATION_LEDGERS: z.coerce.number().int().positive().default(2),

src/middleware/rateLimit.ts

@@ -378,3 +378,12 @@ export const webhooksRateLimiter = createPerUserTokenBucketLimiter({
   refillWindowMs: env.WEBHOOKS_RATE_LIMIT_WINDOW_MS,
   keyGenerator: getUserRateKey,
 });
+
+/**
+ * Pre-configured per-user rate limiter for `/api/fingerprint` route.
+ */
+export const fingerprintRateLimiter = createPerUserTokenBucketLimiter({
+  capacity: env.FINGERPRINT_RATE_LIMIT_CAPACITY,
+  refillWindowMs: env.FINGERPRINT_RATE_LIMIT_WINDOW_MS,
+  keyGenerator: getUserRateKey,
+});

src/routes/fingerprint.ts

@@ -27,6 +27,7 @@
 
 import { Router, type Request, type Response, type NextFunction } from "express";
 import { buildFingerprintInputs, computeFingerprint } from "../middleware/fingerprint";
+import { fingerprintRateLimiter } from "../middleware/rateLimit";
 import { getCorrelationId } from "../middleware/correlation";
 import { logger } from "../config/logger";
 import { getRequestId } from "../lib/requestContext";
@@ -42,6 +43,7 @@ export const fingerprintRouter = Router();
  */
 fingerprintRouter.get(
   "/",
+  fingerprintRateLimiter,
   (req: Request, res: Response, next: NextFunction): void => {
     const correlationId = getCorrelationId() ?? "unknown";
     const reqId = getRequestId() ?? "unknown";

tests/fingerprint.test.ts

@@ -430,6 +430,25 @@ describe("GET /api/fingerprint", () => {
     ]);
     expect(r1.body.fingerprint).toBe(r2.body.fingerprint);
   });
+
+  it("enforces per-user token-bucket rate limit with 429 and Retry-After", async () => {
+    const app = createApp();
+    const limit = 60; // default FINGERPRINT_RATE_LIMIT_CAPACITY
+    const isolatedIp = "9.9.9.9";
+
+    // Exhaust the rate limit for this IP
+    for (let i = 0; i < limit; i++) {
+      await request(app).get("/api/fingerprint").set("x-forwarded-for", isolatedIp);
+    }
+
+    // The 61st request should be blocked
+    const res = await request(app).get("/api/fingerprint").set("x-forwarded-for", isolatedIp);
+    
+    expect(res.status).toBe(429);
+    expect(res.headers["retry-after"]).toBeDefined();
+    expect(res.body.error).toBeDefined();
+    expect(res.body.error.code).toBe("rate_limit_exceeded");
+  });
 });
 
 // ── 35: fingerprintMiddleware error handling ────────────────────────────