feat: add rate limiting with Redis sliding window and usage metering

Author: truthixify

src/app.module.ts

@@ -5,6 +5,8 @@ import { StorageModule } from './storage/storage.module';
 import { AuthModule } from './auth/auth.module';
 import { TeamsModule } from './teams/teams.module';
 import { KeysModule } from './keys/keys.module';
+import { RateLimitModule } from './rate-limit/rate-limit.module';
+import { UsageModule } from './usage/usage.module';
 import configuration from './config/configuration';
 
 @Module({
@@ -17,6 +19,8 @@ import configuration from './config/configuration';
     AuthModule,
     TeamsModule,
     KeysModule,
+    RateLimitModule,
+    UsageModule,
     HealthModule,
   ],
 })

src/rate-limit/rate-limit.guard.ts

@@ -0,0 +1,39 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { RateLimitService } from './rate-limit.service';
+
+@Injectable()
+export class RateLimitGuard implements CanActivate {
+  constructor(private readonly rateLimitService: RateLimitService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    const response = context.switchToHttp().getResponse();
+
+    const apiKey = request.apiKey;
+    const team = request.team;
+
+    if (!apiKey || !team) return true;
+
+    const result = await this.rateLimitService.check(apiKey.id, team.plan);
+
+    response.header('X-RateLimit-Limit', String(result.limit));
+    response.header('X-RateLimit-Remaining', String(result.remaining));
+    response.header('X-RateLimit-Reset', String(result.resetAt));
+
+    if (!result.allowed) {
+      response.header('Retry-After', String(result.retryAfter));
+      throw new HttpException(
+        { error: 'Rate limit exceeded', retryAfter: result.retryAfter },
+        HttpStatus.TOO_MANY_REQUESTS,
+      );
+    }
+
+    return true;
+  }
+}

src/rate-limit/rate-limit.module.ts

@@ -0,0 +1,10 @@
+import { Module, Global } from '@nestjs/common';
+import { RateLimitService } from './rate-limit.service';
+import { RateLimitGuard } from './rate-limit.guard';
+
+@Global()
+@Module({
+  providers: [RateLimitService, RateLimitGuard],
+  exports: [RateLimitService, RateLimitGuard],
+})
+export class RateLimitModule {}

src/rate-limit/rate-limit.service.ts

@@ -0,0 +1,57 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import Redis from 'ioredis';
+
+interface RateLimitResult {
+  allowed: boolean;
+  limit: number;
+  remaining: number;
+  resetAt: number;
+  retryAfter?: number;
+}
+
+const PLAN_LIMITS: Record<string, { perMinute: number; perDay: number; perMonth: number }> = {
+  free: { perMinute: 10, perDay: 100, perMonth: 1000 },
+  pro: { perMinute: 100, perDay: 5000, perMonth: 50000 },
+  enterprise: { perMinute: 1000, perDay: -1, perMonth: -1 },
+};
+
+@Injectable()
+export class RateLimitService {
+  private redis: Redis;
+
+  constructor(private readonly config: ConfigService) {
+    this.redis = new Redis(this.config.get<string>('REDIS_URL')!);
+  }
+
+  async check(apiKeyId: string, plan: string): Promise<RateLimitResult> {
+    const limits = PLAN_LIMITS[plan] || PLAN_LIMITS.free;
+    const now = Date.now();
+    const minuteWindow = Math.floor(now / 60000);
+    const minuteKey = `ratelimit:${apiKeyId}:min:${minuteWindow}`;
+
+    const currentCount = await this.redis.incr(minuteKey);
+    if (currentCount === 1) {
+      await this.redis.expire(minuteKey, 120);
+    }
+
+    const resetAt = (minuteWindow + 1) * 60;
+
+    if (limits.perMinute !== -1 && currentCount > limits.perMinute) {
+      return {
+        allowed: false,
+        limit: limits.perMinute,
+        remaining: 0,
+        resetAt,
+        retryAfter: Math.ceil(resetAt - now / 1000),
+      };
+    }
+
+    return {
+      allowed: true,
+      limit: limits.perMinute,
+      remaining: Math.max(0, limits.perMinute - currentCount),
+      resetAt,
+    };
+  }
+}

src/usage/usage.controller.ts

@@ -0,0 +1,34 @@
+import { Controller, Get, Query, UseGuards } from '@nestjs/common';
+import { UsageService } from './usage.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { CurrentDeveloper } from '../auth/decorators/current-developer.decorator';
+
+@Controller('usage')
+@UseGuards(JwtAuthGuard)
+export class UsageController {
+  constructor(private readonly usageService: UsageService) {}
+
+  @Get('summary')
+  summary(@CurrentDeveloper() dev: { teamId: string }) {
+    return this.usageService.summary(dev.teamId);
+  }
+
+  @Get('daily')
+  daily(
+    @CurrentDeveloper() dev: { teamId: string },
+    @Query('from') from?: string,
+    @Query('to') to?: string,
+  ) {
+    return this.usageService.daily(dev.teamId, from, to);
+  }
+
+  @Get('by-key')
+  byKey(@CurrentDeveloper() dev: { teamId: string }) {
+    return this.usageService.byKey(dev.teamId);
+  }
+
+  @Get('by-endpoint')
+  byEndpoint(@CurrentDeveloper() dev: { teamId: string }) {
+    return this.usageService.byEndpoint(dev.teamId);
+  }
+}

src/usage/usage.module.ts

@@ -0,0 +1,14 @@
+import { Module, Global } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { UsageController } from './usage.controller';
+import { UsageService } from './usage.service';
+import { UsageLogEntity } from '../storage/entities/usage-log.entity';
+
+@Global()
+@Module({
+  imports: [TypeOrmModule.forFeature([UsageLogEntity])],
+  controllers: [UsageController],
+  providers: [UsageService],
+  exports: [UsageService],
+})
+export class UsageModule {}

src/usage/usage.service.ts

@@ -0,0 +1,99 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository, Between } from 'typeorm';
+import { UsageLogEntity } from '../storage/entities/usage-log.entity';
+
+interface LogEntry {
+  teamId: string;
+  apiKeyId: string;
+  endpoint: string;
+  method: string;
+  statusCode: number;
+  responseTimeMs: number;
+  tokensUsed?: number;
+}
+
+@Injectable()
+export class UsageService {
+  constructor(
+    @InjectRepository(UsageLogEntity)
+    private readonly usageRepo: Repository<UsageLogEntity>,
+  ) {}
+
+  async log(entry: LogEntry) {
+    await this.usageRepo.save(this.usageRepo.create(entry));
+  }
+
+  async summary(teamId: string) {
+    const now = new Date();
+    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+    const result = await this.usageRepo
+      .createQueryBuilder('log')
+      .select('COUNT(*)', 'totalRequests')
+      .addSelect('COALESCE(SUM(log.tokensUsed), 0)', 'totalTokens')
+      .where('log.teamId = :teamId', { teamId })
+      .andWhere('log.timestamp >= :start', { start: startOfMonth })
+      .getRawOne();
+
+    return {
+      period: { start: startOfMonth.toISOString(), end: now.toISOString() },
+      totalRequests: parseInt(result.totalRequests, 10),
+      totalTokens: parseInt(result.totalTokens, 10),
+    };
+  }
+
+  async daily(teamId: string, from?: string, to?: string) {
+    const now = new Date();
+    const start = from ? new Date(from) : new Date(now.getFullYear(), now.getMonth(), 1);
+    const end = to ? new Date(to) : now;
+
+    const results = await this.usageRepo
+      .createQueryBuilder('log')
+      .select("DATE_TRUNC('day', log.timestamp)", 'date')
+      .addSelect('COUNT(*)', 'requests')
+      .addSelect('COALESCE(SUM(log.tokensUsed), 0)', 'tokens')
+      .where('log.teamId = :teamId', { teamId })
+      .andWhere('log.timestamp BETWEEN :start AND :end', { start, end })
+      .groupBy("DATE_TRUNC('day', log.timestamp)")
+      .orderBy('date', 'ASC')
+      .getRawMany();
+
+    return results.map((r) => ({
+      date: r.date,
+      requests: parseInt(r.requests, 10),
+      tokens: parseInt(r.tokens, 10),
+    }));
+  }
+
+  async byKey(teamId: string) {
+    const now = new Date();
+    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+    return this.usageRepo
+      .createQueryBuilder('log')
+      .select('log.apiKeyId', 'apiKeyId')
+      .addSelect('COUNT(*)', 'requests')
+      .addSelect('COALESCE(SUM(log.tokensUsed), 0)', 'tokens')
+      .where('log.teamId = :teamId', { teamId })
+      .andWhere('log.timestamp >= :start', { start: startOfMonth })
+      .groupBy('log.apiKeyId')
+      .getRawMany();
+  }
+
+  async byEndpoint(teamId: string) {
+    const now = new Date();
+    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+    return this.usageRepo
+      .createQueryBuilder('log')
+      .select('log.endpoint', 'endpoint')
+      .addSelect('COUNT(*)', 'requests')
+      .addSelect('COALESCE(SUM(log.tokensUsed), 0)', 'tokens')
+      .addSelect('ROUND(AVG(log.responseTimeMs))', 'avgResponseTimeMs')
+      .where('log.teamId = :teamId', { teamId })
+      .andWhere('log.timestamp >= :start', { start: startOfMonth })
+      .groupBy('log.endpoint')
+      .getRawMany();
+  }
+}