init

web/lib/rate-limit.ts

@@ -0,0 +1,26 @@
+const WINDOW_MS = 60_000;
+const LIMIT = 10;
+const buckets = new Map<string, number[]>();
+
+export function resetRateLimit(): void {
+  buckets.clear();
+}
+
+/** True when the caller is still inside 10 requests per minute. */
+export function allowRequest(ip: string, now = Date.now()): boolean {
+  const fresh = (buckets.get(ip) ?? []).filter((t) => now - t < WINDOW_MS);
+  if (fresh.length >= LIMIT) {
+    buckets.set(ip, fresh);
+    return false;
+  }
+  fresh.push(now);
+  buckets.set(ip, fresh);
+  return true;
+}
+
+/** Last hop. Apache appends the real client after any address the browser sent. */
+export function clientIp(header: string | null): string {
+  if (!header) return "direct";
+  const parts = header.split(",").map((part) => part.trim()).filter(Boolean);
+  return parts[parts.length - 1] || "direct";
+}