feat: add rate limit on /api/proxy

[Kaycee276]

Title

feat: Add per-user token-bucket rate limit on /api/proxy

Description

This PR implements a per-user token-bucket rate limiting mechanism for the /api/proxy routes as outlined for the GrantFox FWC26 campaign. This enhancement ensures secure and controlled access to proxy endpoints by throwing a 429 Too Many Requests error and supplying a Retry-After header when clients exceed their quota.

Key Changes

• Rate Limit Middleware (src/middleware/rateLimit.ts):
  • Created createProxyRateLimitMiddleware leveraging the TokenBucketRateLimiter.
  • Determines the limiting identity based on a fallback cascade: API Key userId -> Request userId -> Client IP.
  • Returns a standard TooManyRequestsError envelope along with calculated Retry-After response headers.
  • Includes structured warning logs enriched with requestId and retryAfterMs.
• Route Integration (src/routes/proxyRoutes.ts):
  • Injected proxyRateLimit across all proxy route handlers (GET, POST, PATCH, DELETE, etc.).
  • Positioned the rate limiter immediately before the idempotency layer to protect downstream processing.
• Types Update (src/types/gateway.ts):
  • Added optional proxyRateLimit request handler to ProxyDeps allowing for injected mocks during tests.
• Tests (src/middleware/rateLimit.test.ts):
  • (Previously authored) unit tests covering key extraction fallbacks, API Key record scenarios, token bucket capacities, and the 429 status code outputs.

Quality Assurance & Security

• Algorithm: Implements the efficient token-bucket algorithm allowing for controlled bursts while strictly capping overages.
• Input Boundaries: Rate limiting identities are carefully extracted securely from validated tokens/API keys preventing limit bypasses.
• Logging: Integrated standard logger.warn for tracking rate-limit thresholds with correlation IDs attached.

Closes #950

[drips-wave]

@Kaycee276 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

LGTM 🙌