middleware/securityRateLimit.js

const rateLimit = require('express-rate-limit');
const { env } = require('../configs/env');

const createLimiter = ({ windowMs, max, message }) =>
  rateLimit({
    windowMs,
    max,
    standardHeaders: true,
    legacyHeaders: false,
    message,
  });

const globalLimiter = createLimiter({
  windowMs: env.globalRateWindowMs,
  max: env.globalRateMax,
  message: 'Too many requests, please slow down.',
});

const adminApiLimiter = createLimiter({
  windowMs: env.adminApiRateWindowMs,
  max: env.adminApiRateMax,
  message: 'Too many admin API requests. Please wait a moment.',
});

const loginLimiter = createLimiter({
  windowMs: env.loginRateWindowMs,
  max: env.loginRateMax,
  message: { message: 'Too many login attempts. Try again in 15 minutes.' },
});

const clientEventLimiter = createLimiter({
  windowMs: env.clientEventRateWindowMs,
  max: env.clientEventRateMax,
  message: 'Too many analytics events. Please slow down.',
});

module.exports = {
  globalLimiter,
  adminApiLimiter,
  loginLimiter,
  clientEventLimiter,
};