adrianbonpin/deckyvault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(security): apply tiered rate limits with scoped .group() blocks in app.ts

Browse Source
This commit is contained in:
adrianbonpin
2026-05-15 00:45:12 +08:00
parent e908880834
commit b895e8714d
1 changed files with 59 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/api/app.ts
+59 -59
View File
@@ -142,66 +142,66 @@ export const app = new Elysia({ prefix: "/api" })
error: code === "NOT_FOUND" ? "Not found" : "Internal server error", error: code === "NOT_FOUND" ? "Not found" : "Internal server error",
} }
}) })
.use(rateLimit("default")) // ── Auth routes (auth rate limit + betterAuth) ──────────────
.use(betterAuth) .group("", (app) =>
// Health app
.use(healthRoutes) .use(rateLimit("auth"))
// Users .use(betterAuth)
.use(userRoutes) .use(userRoutes)
// Profile photos .use(profilePhotoRoutes)
.use(profilePhotoRoutes) )
// Games + Versions // ── Read-heavy public routes (read rate limit) ───────────────
.use(gamesRoutes) .group("", (app) =>
.use(gameVersionsRoutes) app
.use(gameSyncRoutes) .use(rateLimit("read"))
.use(gamesListingRoutes) .use(healthRoutes)
// Hardware .use(gamesRoutes)
.use(hardwareRoutes) .use(gameVersionsRoutes)
.use(hardwareStatsRoutes) .use(gameSyncRoutes)
// Performance .use(gamesListingRoutes)
.use(performanceRoutes) .use(hardwareRoutes)
.use(performanceVerifyRoutes) .use(hardwareStatsRoutes)
.use(performanceSubmitRoutes) .use(performanceRoutes)
.use(screenshotRoutes) .use(gameStatsRoutes)
.use(reportRoutes) .use(dashboardRoutes)
.use(adminReportRoutes) .use(dashboardPublicRoutes)
.use(adminPerformanceRoutes) .use(playabilityRoutes)
.use(adminCommentRoutes) .use(steamReviewRoutes)
.use(adminStorageRoutes) .use(compareRoutes)
// Comments .use(savedGamesRoutes)
.use(commentsRoutes) .use(savedFilterRoutes)
// Steam search proxy .use(steamSearchRoutes)
.use(steamSearchRoutes) .use(searchUnifiedRoutes)
// Unified search .use(gameStubRoutes)
.use(searchUnifiedRoutes) .use(steamgridProxyRoutes)
// Game stub creation .use(gamesManualRoutes)
.use(gameStubRoutes) .use(screenshotRoutes)
// SteamGridDB proxy )
.use(steamgridProxyRoutes) // ── Write routes (write rate limit + betterAuth) ─────────────
// Game stats aggregation .group("", (app) =>
.use(gameStatsRoutes) app
// Manual game creation .use(rateLimit("write"))
.use(gamesManualRoutes) .use(betterAuth)
// Saved games .use(performanceVerifyRoutes)
.use(savedGamesRoutes) .use(performanceSubmitRoutes)
// Contact form .use(commentsRoutes)
.use(contactRoutes) .use(reportRoutes)
// Compare .use(adminReportRoutes)
.use(compareRoutes) .use(adminPerformanceRoutes)
// Playability .use(adminCommentRoutes)
.use(playabilityRoutes) .use(adminStorageRoutes)
// Steam reviews )
.use(steamReviewRoutes) // ── Strict rate limit (public forms, no auth) ───────────────
// Community suggestions .group("", (app) =>
.use(communitySuggestionRoutes) app
// Saved filters .use(rateLimit("strict"))
.use(savedFilterRoutes) .use(contactRoutes)
// Cron .use(communitySuggestionRoutes)
)
// ── Cron (no rate limit) ─────────────────────────────────────
.use(cronRoutes) .use(cronRoutes)
// Dashboard // ── Root (default rate limit) ────────────────────────────────
.use(dashboardRoutes) .use(rateLimit("default"))
.use(dashboardPublicRoutes)
// Root
.get("/", () => ({ .get("/", () => ({
name: "DeckyVault API", name: "DeckyVault API",
version: "2026.0.9", version: "2026.0.9",