Merge pull request #83 from sidclawhq/feat/redis-rate-limit

feat(api): Redis-backed rate limiting behind REDIS_URL

Author: VladUZH

apps/api/.env.example

@@ -10,6 +10,9 @@ DASHBOARD_URL=http://localhost:3000
 
 # Rate limiting (set to false for development)
 RATE_LIMIT_ENABLED=true
+# Optional: shared rate-limit state for multi-instance deployments.
+# Unset = per-process in-memory limiter (fine for a single instance).
+# REDIS_URL=redis://localhost:6379
 
 # GitHub OAuth (optional — signup via GitHub disabled if not set)
 GITHUB_CLIENT_ID=

apps/api/package.json

@@ -30,6 +30,7 @@
     "dotenv": "^16.6.1",
     "fastify": "^5",
     "fastify-plugin": "^5.1.0",
+    "ioredis": "^5.11.1",
     "openid-client": "^6.8.4",
     "pg": "^8.22.0",
     "pino": "^10.3.1",

apps/api/src/middleware/rate-limit.ts

@@ -1,5 +1,8 @@
 import fp from 'fastify-plugin';
 import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+// Importing ioredis does not open a connection — a client is only
+// constructed when REDIS_URL is configured (see createRateLimiter).
+import Redis from 'ioredis';
 
 // ─── Interfaces ──────────────────────────────────────────────────────────────
 
@@ -12,6 +15,8 @@ export interface RateLimitResult {
 
 export interface RateLimiter {
   check(key: string, limit: number, windowSeconds: number): Promise<RateLimitResult>;
+  /** Clear all window state. Used by tests. */
+  reset(): void | Promise<void>;
 }
 
 // ─── In-Memory Implementation ────────────────────────────────────────────────
@@ -57,6 +62,72 @@ export class InMemoryRateLimiter implements RateLimiter {
   }
 }
 
+// ─── Redis Implementation ────────────────────────────────────────────────────
+
+interface RedisMultiChain {
+  incr(key: string): RedisMultiChain;
+  expire(key: string, seconds: number, nx: 'NX'): RedisMultiChain;
+  exec(): Promise<unknown>;
+}
+
+export interface RedisLike {
+  multi(): RedisMultiChain;
+  ttl(key: string): Promise<number>;
+}
+
+/**
+ * Redis-backed fixed-window rate limiter for multi-instance deployments.
+ * Enabled by setting REDIS_URL. Uses INCR + EXPIRE NX so all instances share
+ * one window per key.
+ *
+ * Degrades rather than breaks: if Redis is unreachable, falls back to the
+ * per-process in-memory limiter (weaker isolation, but requests keep flowing
+ * and abuse is still bounded per instance) and logs the failure at most once
+ * per minute.
+ */
+export class RedisRateLimiter implements RateLimiter {
+  private readonly fallback = new InMemoryRateLimiter();
+  private lastErrorLogAt = 0;
+
+  // Structural type covering the slice of ioredis the limiter uses; kept
+  // loose so tests can supply an in-process fake without a Redis server.
+  constructor(private readonly redis: RedisLike) {}
+
+  async check(key: string, limit: number, windowSeconds: number): Promise<RateLimitResult> {
+    const now = Math.floor(Date.now() / 1000);
+    const redisKey = `ratelimit:${key}:${Math.floor(now / windowSeconds)}`;
+    try {
+      const results = (await this.redis
+        .multi()
+        .incr(redisKey)
+        // NX: only set the TTL when the key has none — first request in the
+        // window owns the expiry; later requests must not extend it.
+        .expire(redisKey, windowSeconds, 'NX')
+        .exec()) as Array<[Error | null, unknown]> | null;
+      if (!results) throw new Error('redis MULTI aborted');
+      const [incrErr, count] = results[0]!;
+      if (incrErr) throw incrErr;
+      const used = Number(count);
+      return {
+        allowed: used <= limit,
+        limit,
+        remaining: Math.max(0, limit - used),
+        resetAt: (Math.floor(now / windowSeconds) + 1) * windowSeconds,
+      };
+    } catch (error) {
+      if (now - this.lastErrorLogAt >= 60) {
+        this.lastErrorLogAt = now;
+        console.error('Rate limiter: Redis unavailable, using in-memory fallback:', error instanceof Error ? error.message : error);
+      }
+      return this.fallback.check(key, limit, windowSeconds);
+    }
+  }
+
+  reset(): void {
+    this.fallback.reset();
+  }
+}
+
 // ─── Rate Limit Tiers ────────────────────────────────────────────────────────
 
 export interface RateLimitTier {
@@ -80,7 +151,22 @@ export function getEndpointCategory(method: string, url: string): 'evaluate' | '
 
 // ─── Fastify Plugin ──────────────────────────────────────────────────────────
 
-export const rateLimiter = new InMemoryRateLimiter();
+function createRateLimiter(): RateLimiter {
+  const redisUrl = process.env['REDIS_URL'];
+  if (!redisUrl) return new InMemoryRateLimiter();
+  const client = new Redis(redisUrl, {
+    // Never let a slow Redis stall requests: short timeouts, no retry queue.
+    connectTimeout: 2000,
+    commandTimeout: 1000,
+    maxRetriesPerRequest: 1,
+    enableOfflineQueue: false,
+    lazyConnect: false,
+  });
+  console.log('Rate limiter: using Redis backend');
+  return new RedisRateLimiter(client);
+}
+
+export const rateLimiter = createRateLimiter();
 
 async function rateLimitPluginImpl(app: FastifyInstance) {
   app.addHook('onRequest', async (request: FastifyRequest, reply: FastifyReply) => {

apps/api/src/middleware/redis-rate-limit.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect, vi } from 'vitest';
+import { RedisRateLimiter } from './rate-limit.js';
+
+/** Minimal in-process fake of the Redis commands the limiter uses. */
+function fakeRedis(initial: Record<string, number> = {}) {
+  const store = new Map<string, number>(Object.entries(initial));
+  return {
+    store,
+    multi() {
+      const ops: Array<() => [null, unknown]> = [];
+      const chain = {
+        incr: (key: string) => {
+          ops.push(() => {
+            const next = (store.get(key) ?? 0) + 1;
+            store.set(key, next);
+            return [null, next];
+          });
+          return chain;
+        },
+        expire: (_key: string, _s: number, _nx: 'NX') => {
+          ops.push(() => [null, 1]);
+          return chain;
+        },
+        exec: async () => ops.map((op) => op()),
+      };
+      return chain;
+    },
+    ttl: async () => 60,
+  };
+}
+
+describe('RedisRateLimiter', () => {
+  it('counts across calls and enforces the limit', async () => {
+    const limiter = new RedisRateLimiter(fakeRedis());
+    const first = await limiter.check('tenant:read', 2, 60);
+    expect(first).toMatchObject({ allowed: true, remaining: 1 });
+    await limiter.check('tenant:read', 2, 60);
+    const third = await limiter.check('tenant:read', 2, 60);
+    expect(third.allowed).toBe(false);
+    expect(third.remaining).toBe(0);
+  });
+
+  it('keys are shared state — a second limiter over the same store sees the count', async () => {
+    const redis = fakeRedis();
+    const a = new RedisRateLimiter(redis);
+    const b = new RedisRateLimiter(redis);
+    await a.check('k', 2, 60);
+    await b.check('k', 2, 60);
+    const result = await b.check('k', 2, 60);
+    expect(result.allowed).toBe(false);
+  });
+
+  it('falls back to in-memory when Redis errors, and requests keep flowing', async () => {
+    const broken = {
+      multi() {
+        return {
+          incr: () => broken.multi(),
+          expire: () => broken.multi(),
+          exec: async () => {
+            throw new Error('ECONNREFUSED');
+          },
+          // satisfy the structural chain type
+        } as never;
+      },
+      ttl: async () => -1,
+    };
+    const spy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const limiter = new RedisRateLimiter(broken as never);
+    const first = await limiter.check('k', 1, 60);
+    expect(first.allowed).toBe(true);
+    const second = await limiter.check('k', 1, 60);
+    expect(second.allowed).toBe(false); // in-memory fallback still enforces
+    expect(spy).toHaveBeenCalledTimes(1); // error logged once, not per request
+    spy.mockRestore();
+  });
+
+  it('reset clears the fallback state', async () => {
+    const limiter = new RedisRateLimiter(fakeRedis());
+    limiter.reset();
+    const result = await limiter.check('k', 5, 60);
+    expect(result.allowed).toBe(true);
+  });
+});