3 free scans/day, admin bypass, improved caching

- Rate limit: 3 scans/day (was 10/hour), 24hr TTL
- Admin wallet gets unlimited scans
- Scan cache: 30min TTL (was 5min)
- DexScreener cache: 2hr TTL (was 1hr)
- Fix safety net adding wallet address as token when deployer
  route receives a wallet address instead of a token

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jpatching

backend/src/middleware/auth.ts

@@ -31,9 +31,9 @@ export function requireAuth(req: Request, res: Response, next: NextFunction): vo
   if (!checkRateLimit(wallet)) {
     const remaining = getRemainingScans(wallet);
     res.status(429).json({
-      error: 'Rate limit exceeded. Max 10 scans per hour.',
+      error: 'Daily scan limit reached. 3 free scans per day.',
       remaining,
-      retry_after: '1 hour',
+      retry_after: '24 hours',
     });
     return;
   }

backend/src/routes/deployer.ts

@@ -15,7 +15,7 @@ import { TTLCache } from '../services/cache';
 import type { DeployerScan, DeployerToken, FundingInfo, ScanEvidence, ScanConfidence, ScanUsage } from '../types';
 
 const router = Router();
-const scanCache = new TTLCache<DeployerScan>(300); // 5 min TTL
+const scanCache = new TTLCache<DeployerScan>(1800); // 30 min TTL — saves Helius + DexScreener calls
 
 router.get('/:token_address', async (req: Request, res: Response) => {
   const token_address = req.params.token_address as string;
@@ -52,8 +52,10 @@ router.get('/:token_address', async (req: Request, res: Response) => {
     // Step 3: Find all tokens this deployer created via Pump.fun
     const deployerTokenMints = await findDeployerTokens(deployerWallet);
 
-    // Safety net: always include the scanned token if not already found
-    if (!deployerTokenMints.includes(token_address)) {
+    // Safety net: include the scanned token if not already found,
+    // but only if the deployer is DIFFERENT from the token address.
+    // (If they're the same, the user entered a wallet address, not a token.)
+    if (deployerWallet !== token_address && !deployerTokenMints.includes(token_address)) {
       deployerTokenMints.unshift(token_address);
     }
 

backend/src/routes/wallet.ts

@@ -14,7 +14,7 @@ import { TTLCache } from '../services/cache';
 import type { DeployerScan, DeployerToken, FundingInfo, ScanEvidence, ScanConfidence, ScanUsage } from '../types';
 
 const router = Router();
-const walletCache = new TTLCache<DeployerScan>(300);
+const walletCache = new TTLCache<DeployerScan>(1800); // 30 min TTL
 
 router.get('/:wallet_address', async (req: Request, res: Response) => {
   const wallet_address = req.params.wallet_address as string;

backend/src/services/auth.ts

@@ -4,9 +4,14 @@ import bs58 from 'bs58';
 import { TTLCache } from './cache';
 
 const nonceCache = new TTLCache<string>(300); // 5min TTL for nonces
-const usageCache = new TTLCache<number>(3600); // 1hr window for rate limiting
+const usageCache = new TTLCache<number>(86400); // 24hr window for rate limiting
 
-const MAX_SCANS_PER_HOUR = 10;
+const MAX_SCANS_PER_DAY = 3;
+
+// Wallets exempt from rate limits (admin/dev wallets)
+const UNLIMITED_WALLETS = new Set([
+  '5rSwWRfqGvnQaiJpW3sb3YKLbxtjVxgc4yrvrHNeNwE2',
+]);
 
 function getJwtSecret(): string {
   const secret = process.env.JWT_SECRET;
@@ -64,8 +69,14 @@ export function verifyToken(token: string): string | null {
 
 /** Check if a wallet has remaining rate limit */
 export function checkRateLimit(wallet: string): boolean {
+  if (UNLIMITED_WALLETS.has(wallet)) return true;
   const usage = usageCache.get(wallet) || 0;
-  return usage < MAX_SCANS_PER_HOUR;
+  return usage < MAX_SCANS_PER_DAY;
+}
+
+/** Check if a wallet has unlimited access */
+export function isUnlimited(wallet: string): boolean {
+  return UNLIMITED_WALLETS.has(wallet);
 }
 
 /** Increment scan usage for a wallet */
@@ -77,7 +88,7 @@ export function incrementUsage(wallet: string): void {
 /** Get remaining scans for a wallet */
 export function getRemainingScans(wallet: string): number {
   const usage = usageCache.get(wallet) || 0;
-  return Math.max(0, MAX_SCANS_PER_HOUR - usage);
+  return Math.max(0, MAX_SCANS_PER_DAY - usage);
 }
 
 /** Get current usage count for a wallet */
@@ -86,4 +97,4 @@ export function getUsageCount(wallet: string): number {
 }
 
 /** The max scans per hour constant */
-export const SCANS_LIMIT = MAX_SCANS_PER_HOUR;
+export const SCANS_LIMIT = MAX_SCANS_PER_DAY;

backend/src/services/dexscreener.ts

@@ -4,8 +4,8 @@ import { TTLCache } from './cache';
 const DEXSCREENER_API = 'https://api.dexscreener.com/latest/dex';
 const ALIVE_LIQUIDITY_THRESHOLD = 100; // USD
 
-// Cache token status for 1 hour to avoid redundant DexScreener calls
-const dexCache = new TTLCache<TokenStatus>(3600);
+// Cache token status for 2 hours to reduce DexScreener API calls
+const dexCache = new TTLCache<TokenStatus>(7200);
 
 interface TokenStatus {
   alive: boolean;
@@ -81,7 +81,7 @@ export async function bulkCheckTokens(
     try {
       const res = await fetch(`${DEXSCREENER_API}/tokens/${joined}`);
       if (!res.ok) {
-        batch.forEach(addr => results.set(addr, { alive: false, liquidity: 0, volume24h: 0, name: '', symbol: '', pairCreatedAt: null }));
+        // Don't cache HTTP errors — leave tokens out of results for retry
         continue;
       }
 
@@ -129,11 +129,8 @@ export async function bulkCheckTokens(
         dexCache.set(addr, status);
       }
     } catch {
-      batch.forEach(addr => {
-        const dead = { alive: false, liquidity: 0, volume24h: 0, name: '', symbol: '', pairCreatedAt: null };
-        results.set(addr, dead);
-        dexCache.set(addr, dead);
-      });
+      // Don't cache error results — leave errored tokens out of results
+      // so they're retried next request and not falsely marked as dead
     }
 
     // Small delay between batches to avoid rate limiting