AyrisAIandClaude Sonnet 5
1b8cfeda95
Security: - requireAdmin() session check added to every admin-only server action (previously relied only on middleware path matching, which Next.js Server Actions don't reliably respect) - Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split into an Edge-safe auth.config.ts (used by proxy.ts) and the full Prisma-backed auth.ts (route handler, server actions, server components) - Removed hardcoded fallback secret on the Instagram sync cron endpoint - Honeypot field + per-IP rate limiting on contact/business-submission forms and the analytics events endpoint Features: - AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded to only recommend isLocalApproved listings, with a deterministic link-injection fallback for anything the model doesn't format as markdown - Interactive Leaflet/OpenStreetMap view on category listing pages - Telegram notifications for new contact messages and business submissions SEO: - Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/ Twitter share images, generated via next/og (replacing default Next.js placeholders) - BreadcrumbList structured data on category and listing detail pages - Fixed two remaining raw <img> tags to use next/image Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
28 lines
897 B
TypeScript
28 lines
897 B
TypeScript
// In-memory sliding-window rate limiter. Good enough for a single-instance
|
|
// Docker deployment (Coolify) — resets on redeploy and doesn't share state
|
|
// across replicas, but that's an acceptable MVP tradeoff for abuse-throttling
|
|
// a public, unauthenticated endpoint (no external dependency like Redis needed).
|
|
const hits = new Map<string, number[]>()
|
|
|
|
export function checkRateLimit(key: string, limit: number, windowMs: number): boolean {
|
|
const now = Date.now()
|
|
const timestamps = (hits.get(key) || []).filter((t) => now - t < windowMs)
|
|
|
|
if (timestamps.length >= limit) {
|
|
hits.set(key, timestamps)
|
|
return false
|
|
}
|
|
|
|
timestamps.push(now)
|
|
hits.set(key, timestamps)
|
|
|
|
// Opportunistic cleanup so the map doesn't grow unbounded.
|
|
if (hits.size > 5000) {
|
|
for (const [k, v] of hits) {
|
|
if (v.every((t) => now - t > windowMs)) hits.delete(k)
|
|
}
|
|
}
|
|
|
|
return true
|
|
}
|