adrianbonpin/deckyvault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(security): apply tiered rate limits with scoped .group() blocks in app.ts

Browse Source
This commit is contained in:
adrianbonpin
2026-05-15 00:45:12 +08:00
parent e908880834
commit b895e8714d
1 changed files with 59 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/api/app.ts
+40 -40
View File
@@ -142,66 +142,66 @@ export const app = new Elysia({ prefix: "/api" })
error: code === "NOT_FOUND" ? "Not found" : "Internal server error", error: code === "NOT_FOUND" ? "Not found" : "Internal server error",
} }
}) })
.use(rateLimit("default")) // ── Auth routes (auth rate limit + betterAuth) ──────────────
.group("", (app) =>
app
.use(rateLimit("auth"))
.use(betterAuth) .use(betterAuth)
// Health
.use(healthRoutes)
// Users
.use(userRoutes) .use(userRoutes)
// Profile photos
.use(profilePhotoRoutes) .use(profilePhotoRoutes)
// Games + Versions )
// ── Read-heavy public routes (read rate limit) ───────────────
.group("", (app) =>
app
.use(rateLimit("read"))
.use(healthRoutes)
.use(gamesRoutes) .use(gamesRoutes)
.use(gameVersionsRoutes) .use(gameVersionsRoutes)
.use(gameSyncRoutes) .use(gameSyncRoutes)
.use(gamesListingRoutes) .use(gamesListingRoutes)
// Hardware
.use(hardwareRoutes) .use(hardwareRoutes)
.use(hardwareStatsRoutes) .use(hardwareStatsRoutes)
// Performance
.use(performanceRoutes) .use(performanceRoutes)
.use(gameStatsRoutes)
.use(dashboardRoutes)
.use(dashboardPublicRoutes)
.use(playabilityRoutes)
.use(steamReviewRoutes)
.use(compareRoutes)
.use(savedGamesRoutes)
.use(savedFilterRoutes)
.use(steamSearchRoutes)
.use(searchUnifiedRoutes)
.use(gameStubRoutes)
.use(steamgridProxyRoutes)
.use(gamesManualRoutes)
.use(screenshotRoutes)
)
// ── Write routes (write rate limit + betterAuth) ─────────────
.group("", (app) =>
app
.use(rateLimit("write"))
.use(betterAuth)
.use(performanceVerifyRoutes) .use(performanceVerifyRoutes)
.use(performanceSubmitRoutes) .use(performanceSubmitRoutes)
.use(screenshotRoutes) .use(commentsRoutes)
.use(reportRoutes) .use(reportRoutes)
.use(adminReportRoutes) .use(adminReportRoutes)
.use(adminPerformanceRoutes) .use(adminPerformanceRoutes)
.use(adminCommentRoutes) .use(adminCommentRoutes)
.use(adminStorageRoutes) .use(adminStorageRoutes)
// Comments )
.use(commentsRoutes) // ── Strict rate limit (public forms, no auth) ───────────────
// Steam search proxy .group("", (app) =>
.use(steamSearchRoutes) app
// Unified search .use(rateLimit("strict"))
.use(searchUnifiedRoutes)
// Game stub creation
.use(gameStubRoutes)
// SteamGridDB proxy
.use(steamgridProxyRoutes)
// Game stats aggregation
.use(gameStatsRoutes)
// Manual game creation
.use(gamesManualRoutes)
// Saved games
.use(savedGamesRoutes)
// Contact form
.use(contactRoutes) .use(contactRoutes)
// Compare
.use(compareRoutes)
// Playability
.use(playabilityRoutes)
// Steam reviews
.use(steamReviewRoutes)
// Community suggestions
.use(communitySuggestionRoutes) .use(communitySuggestionRoutes)
// Saved filters )
.use(savedFilterRoutes) // ── Cron (no rate limit) ─────────────────────────────────────
// Cron
.use(cronRoutes) .use(cronRoutes)
// Dashboard // ── Root (default rate limit) ────────────────────────────────
.use(dashboardRoutes) .use(rateLimit("default"))
.use(dashboardPublicRoutes)
// Root
.get("/", () => ({ .get("/", () => ({
name: "DeckyVault API", name: "DeckyVault API",
version: "2026.0.9", version: "2026.0.9",