Rate Limit

1import "server-only"
2 
3// In-memory, per-instance limiter — imperfect across multiple serverless
4// replicas (each has its own memory), but a real floor against naive
5// scraping/abuse with zero new infra. For a stronger guarantee, put the
6// route behind Vercel Firewall or Cloudflare Rate Limiting too — this is
7// meant as defense in depth, not a replacement for that.
8const hits = new Map<string, { count: number; resetAt: number }>()
9 
10// Sweep expired entries occasionally so `hits` doesn't grow unbounded
11// across the life of a warm instance.
12let lastSweep = Date.now()
13function sweep(now: number) {
14  if (now - lastSweep < 60_000) return
15  lastSweep = now
16  for (const [key, entry] of hits) {
17    if (now > entry.resetAt) hits.delete(key)
18  }
19}
20 
21export function isRateLimited(key: string, { windowMs = 60_000, max = 20 } = {}): boolean {
22  const now = Date.now()
23  sweep(now)
24 
25  const entry = hits.get(key)
26  if (!entry || now > entry.resetAt) {
27    hits.set(key, { count: 1, resetAt: now + windowMs })
28    return false
29  }
30 
31  entry.count++
32  return entry.count > max
33}