workflow-app/backend/middleware/rateLimit.js

/**
 * Rate limiting configuration module.
 * 
 * Punkt 23: User-level rate limiting for critical endpoints.
 */
const rateLimit = require('express-rate-limit');

// General API rate limit: 100 requests per minute per IP
const apiLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Zu viele Anfragen. Bitte später erneut versuchen.' },
});

// Login rate limit: 5 attempts per minute per IP (brute-force protection)
const loginLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Zu viele Anmeldeversuche. Bitte in 1 Minute erneut versuchen.' },
});

// H5: Register rate limit: 10 registrations per hour per IP (prevents account
// flooding, audit-log spam, and bcrypt CPU abuse)
const registerLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 10,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Zu viele Registrierungsversuche. Bitte später erneut versuchen.' },
});

// Punkt 23: Task creation rate limit: 20 per minute per user
const taskCreateLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 20,
  standardHeaders: true,
  legacyHeaders: false,
  skip: (req) => !req.user,
  message: { error: 'Zu viele Auftragsanfragen. Bitte später erneut versuchen.' },
});

// Punkt 23: File upload rate limit: 10 per minute per user
const uploadLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 10,
  standardHeaders: true,
  legacyHeaders: false,
  skip: (req) => !req.user,
  message: { error: 'Zu viele Upload-Anfragen. Bitte später erneut versuchen.' },
});

module.exports = { apiLimiter, loginLimiter, registerLimiter, taskCreateLimiter, uploadLimiter };