Fix captive portal purchase throttling

public/engine.js

@@ -41,6 +41,7 @@
   let selectedPlanPrice = null;
   let pollTimer         = null;
   let currentReference  = null;
+  let purchaseInFlight  = false;
 
   // ── Plan selection ────────────────────────────────────────────────────────
   const planRadios = document.querySelectorAll('input[name="plan"]');
@@ -89,6 +90,7 @@
   // ── Pay button ────────────────────────────────────────────────────────────
   if (payBtn) {
     payBtn.addEventListener('click', async () => {
+      if (purchaseInFlight) return;
       clearError('select-error');
       const phone = phoneInput?.value?.trim();
       if (!selectedPlanId) return showError('select-error', 'Please select a plan.');
@@ -96,6 +98,7 @@
         return showError('select-error', 'Enter a valid phone number.');
       }
 
+      purchaseInFlight = true;
       payBtn.disabled = true;
       showScreen('waiting');
 
@@ -109,6 +112,7 @@
 
         if (!res.ok || !data.reference) {
           showScreen('select');
+          purchaseInFlight = false;
           payBtn.disabled = false;
           return showError('select-error', data.error || 'Purchase failed. Try again.');
         }
@@ -117,6 +121,7 @@
         startPolling(data.reference);
       } catch (err) {
         showScreen('select');
+        purchaseInFlight = false;
         payBtn.disabled = false;
         showError('select-error', 'Network error. Please try again.');
       }
@@ -133,6 +138,7 @@
       attempts++;
       if (attempts > MAX) {
         clearInterval(pollTimer);
+        purchaseInFlight = false;
         showScreen('select');
         if (payBtn) payBtn.disabled = false;
         showError('select-error', 'Payment timed out. Please try again.');
@@ -148,6 +154,7 @@
           await authorizeWithCode(data.code);
         } else if (data.status === 'failed') {
           clearInterval(pollTimer);
+          purchaseInFlight = false;
           showScreen('select');
           if (payBtn) payBtn.disabled = false;
           showError('select-error', 'Payment was declined. Please try again.');
@@ -161,6 +168,7 @@
   if (cancelBtn) {
     cancelBtn.addEventListener('click', () => {
       clearInterval(pollTimer);
+      purchaseInFlight = false;
       showScreen('select');
       if (payBtn) payBtn.disabled = false;
     });
@@ -177,6 +185,7 @@
       const data = await res.json();
 
       if (!res.ok || !data.success) {
+        purchaseInFlight = false;
         showScreen('select');
         if (payBtn) payBtn.disabled = false;
         showError('select-error', data.error || 'Authorization failed. Enter your code manually.');
@@ -185,6 +194,7 @@
 
       showSuccess(data);
     } catch (err) {
+      purchaseInFlight = false;
       // Show code entry as fallback so guest can manually enter
       showCodeEntry(code);
     }

src/middleware/rateLimiter.js

@@ -1,5 +1,9 @@
 const rateLimit = require('express-rate-limit');
 
+function normalizePhone(value) {
+  return String(value || '').replace(/\D/g, '');
+}
+
 // Tenant login — 5 failed attempts per 15 min per IP
 const loginLimiter = rateLimit({
   windowMs:         15 * 60 * 1000,
@@ -25,6 +29,11 @@ const purchaseLimiter = rateLimit({
   max:      5,
   standardHeaders: true,
   legacyHeaders:   false,
+  keyGenerator: req => {
+    const siteId = req.params?.siteId || 'unknown-site';
+    const phone = normalizePhone(req.body?.phone) || req.ip || 'unknown-phone';
+    return `${siteId}:${phone}`;
+  },
   message: { error: 'Too many purchase attempts. Please wait before trying again.' },
 });