backend/middleware/rateLimit.js

const buckets = new Map();

export function rateLimitMiddleware(req, res, next) {
  const limitPerMinute = Number(process.env.RATE_LIMIT_PER_MINUTE ?? 0);
  if (!limitPerMinute) return next();

  const key = req.ip ?? "unknown";
  const now = Date.now();
  const windowMs = 60_000;

  const bucket = buckets.get(key) ?? { count: 0, resetAt: now + windowMs };
  if (now > bucket.resetAt) {
    bucket.count = 0;
    bucket.resetAt = now + windowMs;
  }

  bucket.count += 1;
  buckets.set(key, bucket);

  if (bucket.count > limitPerMinute) {
    res.status(429).json({ error: "rate_limited" });
    return;
  }

  next();
}