Rate Limiting and Abuse Control

// 1. Login / OTP — credential stuffing and password spraying.
//    Limit per account AND per IP: an attacker spreading attempts
//    across thousands of accounts stays under a per-account limit.

// 2. Signup — fake accounts, often to farm a free tier.

// 3. Email and SMS — each send costs money, and an OTP endpoint with
//    no limit is a way to bill you for someone else's SMS.

// 4. AI endpoints — the expensive one. An unlimited Aria endpoint is
//    a free LLM proxy, and people do find them.

// 5. Password reset — enumeration plus mail cost.

// 6. Search and anything that hits the database hard.

// The economics: without a limit, one script can spend your monthly
// AI budget in an afternoon. With a limit, it cannot — which is why
// this belongs with security rather than with performance.

// Metered plan limits are a separate thing and also server-side. A
// client-side counter is a suggestion; the server's count is the
// limit. (Pro, Elite and Campus each have their own ceiling here.)

import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const limiter = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(5, '60 s'),
  prefix: 'login',
})

'use server'
export async function login(prevState, formData: FormData) {
  const email = String(formData.get('email') ?? '')
  const ip = (await headers()).get('x-forwarded-for')?.split(',')[0] ?? 'unknown'

  // per account AND per IP
  const [byEmail, byIp] = await Promise.all([
    limiter.limit(`email:${email}`),
    limiter.limit(`ip:${ip}`),
  ])
  if (!byEmail.success || !byIp.success) {
    return { error: 'Too many attempts. Try again in a minute.' }
  }
  …
}

// It MUST be a shared store. An in-memory Map resets on every cold
// start and is per-instance, so on serverless it barely limits
// anything.

// For a signed-in user, key on the user id — an IP limit punishes a
// whole college behind one NAT, which is a real scenario here.
const key = user ? `user:${user.id}` : `ip:${ip}`

// Return 429 with Retry-After from a route handler:
return new NextResponse('Too many requests', {
  status: 429,
  headers: { 'Retry-After': '60' },
})

// Edge first. Vercel's WAF, Cloudflare rules and bot protection stop
// abusive traffic before it reaches a function you pay for — cheaper
// than any application-level limit.

// A cost ceiling, not just a rate: a per-user monthly cap on AI usage
// bounds the worst case even if the rate limit is evaded.
if (await monthlyUsage(user.id) >= limitFor(user.plan)) {
  return { error: 'limit_reached' }
}

// Progressive friction rather than a hard wall:
//   attempts 1-3   allow
//   4-6            add a delay
//   7+             require a CAPTCHA
//   sustained      lock the account and email the owner

// Make the response uninformative. "Too many attempts" for both a
// wrong password and a rate limit; a distinct message tells an
// attacker which emails exist.

// Log and alert on the SHAPE of failures, not just the count:
//   a spike in 401s from one IP     -> credential stuffing
//   a spike in 429s                 -> a script, or a broken client
//   one account, many IPs           -> a shared or sold credential

// And bound the cost of a single request too: a timeout on the AI
// call, a max token count, and a maximum input size.