Rate Limiting & Validation

const API_LIMITS: Record<
  APICategory,
  { user?: RateLimitConfig; ip?: RateLimitConfig }
> = {
  upload: {
    user: { requests: 10, window: '1 h', identifier: 'user' },
    ip: { requests: 20, window: '1 h', identifier: 'ip' },
  },
  email: {
    user: { requests: 5, window: '1 h', identifier: 'user' },
    ip: { requests: 10, window: '1 h', identifier: 'ip' },
  },
  contact: {
    ip: { requests: 3, window: '1 h', identifier: 'ip' },
  },
  payments: {
    user: { requests: 20, window: '1 h', identifier: 'user' },
  },
  webhooks: {
    ip: { requests: 100, window: '1 h', identifier: 'ip' },
  },
  api: {
    user: { requests: 100, window: '1 h', identifier: 'user' },
    ip: { requests: 200, window: '1 h', identifier: 'ip' },
  },
}

export function withRateLimit(
  category: APICategory,
  handler: (request: NextRequest) => Promise<NextResponse>
): (request: NextRequest) => Promise<NextResponse> {

import { NextResponse } from 'next/server'
import { withRateLimit } from '@/lib/security/rate-limit-middleware'

export const POST = withRateLimit('upload', async (request) => {
  // This code only runs if rate limit check passes
  const formData = await request.formData()
  // ... handle upload
  return NextResponse.json({ success: true })
})

{
  "error": "Rate limit exceeded",
  "message": "Too many requests. Please try again in 45 minutes.",
  "retryAfter": "45 minutes",
  "limit": 10,
  "remaining": 0,
  "reset": 1708012800000
}

export const contactSchema = z.object({
  name: z.string().min(2, 'Name must be at least 2 characters').max(100),
  email: z.string().email('Invalid email address'),
  subject: z.string().min(3, 'Subject must be at least 3 characters').max(200),
  message: z
    .string()
    .min(10, 'Message must be at least 10 characters')
    .max(5000),
})

import { contactSchema } from '@/lib/validations/api-schemas'

export const POST = withRateLimit('contact', async (request) => {
  const body = await request.json()

  // Validate input against schema
  const result = contactSchema.safeParse(body)
  if (!result.success) {
    return NextResponse.json(
      { error: 'Validation failed', details: result.error.flatten() },
      { status: 400 }
    )
  }

  // result.data is now fully typed and validated
  const { name, email, subject, message } = result.data
  // ... send contact email
})

import {
  sanitizeFilename,
  sanitizeUrl,
  sanitizeHtml,
  sanitizeText,
} from '@/lib/security/sanitization'

// Sanitize file upload metadata
const safeName = sanitizeFilename(userProvidedFilename) // Removes path traversal
const safeUrl = sanitizeUrl(userProvidedUrl)             // Blocks javascript: URLs
const safeHtml = sanitizeHtml(userProvidedHtml)          // Strips <script> tags
const safeText = sanitizeText(userProvidedBio, 500)      // Removes control chars, limits length

import { NextRequest, NextResponse } from 'next/server'
import { withRateLimit } from '@/lib/security/rate-limit-middleware'
import { contactSchema } from '@/lib/validations/api-schemas'
import { sanitizeText, sanitizeEmail } from '@/lib/security/sanitization'

export const POST = withRateLimit('contact', async (request: NextRequest) => {
  // Layer 2: Rate limiting (handled by withRateLimit wrapper)

  // Parse request body
  const body = await request.json()

  // Layer 3: Input validation with Zod
  const result = contactSchema.safeParse(body)
  if (!result.success) {
    return NextResponse.json(
      { error: 'Validation failed', details: result.error.flatten() },
      { status: 400 }
    )
  }

  // Layer 4: Sanitization
  const name = sanitizeText(result.data.name, 100)
  const email = sanitizeEmail(result.data.email)
  const subject = sanitizeText(result.data.subject, 200)
  const message = sanitizeText(result.data.message, 5000)

  if (!email) {
    return NextResponse.json(
      { error: 'Invalid email address' },
      { status: 400 }
    )
  }

  // Business logic — all input is now validated and sanitized
  await sendContactEmail({ name, email, subject, message })

  return NextResponse.json({ success: true })
})

// In apps/boilerplate/src/lib/security/api-rate-limiter.ts

// 1. Add to the union type
export type APICategory =
  | 'upload'
  | 'email'
  | 'contact'
  | 'payments'
  | 'webhooks'
  | 'api'
  | 'search'  // New category

// 2. Add to API_LIMITS
const API_LIMITS = {
  // ... existing categories
  search: {
    user: { requests: 50, window: '1 h', identifier: 'user' },
    ip: { requests: 100, window: '1 h', identifier: 'ip' },
  },
}

export const GET = withRateLimit('search', async (request) => {
  // Search logic
})