PR for Implement Rate Limiting and Abuse Prevention

[clintjeff2]

Implement Rate Limiting for PDF Generation API

Closes #16

Overview

This PR implements comprehensive rate limiting for the PDF generation endpoint to prevent abuse and ensure fair usage across all users.

Features Added

Rate Limiting

• Limit: 20 requests per minute per user/IP
• Response: HTTP 429 Too Many Requests when limit exceeded
• Headers: Standard rate limit headers (X-RateLimit-*) included in responses
• Tracking: Prioritizes user ID over IP address for authenticated requests

Violation Logging

• All rate limit violations are logged to database with detailed metadata
• Tracks user ID, IP address, user agent, and request patterns
• Enables audit and analysis of potential abuse attempts

Configuration

• Fully configurable through environment variables
• PDF_RATE_LIMIT_WINDOW_MS: Time window (default: 60000ms)
• PDF_RATE_LIMIT_MAX_REQUESTS: Max requests per window (default: 20)
• PDF_RATE_LIMIT_TRACK_BY_USER: Enable user-based tracking (default: true)

Analytics & Monitoring

• New endpoint: GET /pdf/analytics/rate-limits for violation statistics
• Track violations by user and IP address
• Monitor recent violations and patterns
• Integration with existing PDF analytics system

Implementation Details

New Files

• src/pdf/services/rate-limit.service.ts - Core rate limiting logic
• src/pdf/guards/rate-limit.guard.ts - NestJS guard for route protection
• src/pdf/tasks/rate-limit-cleanup.task.ts - Cleanup expired entries

Modified Files

• src/pdf/controllers/pdf.controller.ts - Added rate limiting and analytics
• src/pdf/pdf.module.ts - Integrated new services and dependencies
• prisma/schema.prisma - Added RateLimitViolation model
• .env.development & .env.example - Added configuration variables

Database Changes

-- New table for tracking rate limit violations
CREATE TABLE rate_limit_violation (
  id VARCHAR PRIMARY KEY,
  user_id VARCHAR REFERENCES user(id),
  ip_address VARCHAR(45),
  user_agent VARCHAR(255),
  endpoint VARCHAR(100),
  request_count INTEGER,
  window_start TIMESTAMP,
  violated_at TIMESTAMP DEFAULT NOW()
);

Usage Example

# Normal request (within limits)
curl -H "Authorization: Bearer <token>" \
     -X POST /pdf/generate \
     -d '{"html": "<h1>Test</h1>"}'

# Response headers include:
# X-RateLimit-Limit: 20
# X-RateLimit-Remaining: 19
# X-RateLimit-Reset: 2024-01-01T12:01:00.000Z

# When limit exceeded:
# HTTP 429 Too Many Requests
# {
#   "error": "Too Many Requests",
#   "message": "PDF generation rate limit exceeded. Please wait before making another request.",
#   "rateLimitInfo": {
#     "limit": 20,
#     "remaining": 0,
#     "resetTime": "2024-01-01T12:01:00.000Z",
#     "retryAfter": 45
#   }
# }

[clintjeff2]

Hello @yusuftomilola, please review and merge. Opened this over 5 days ago.