feat: add rate limiting middleware and role-based access control

src/middleware/rateLimit.middleware.ts

@@ -0,0 +1,11 @@
+import rateLimit from "express-rate-limit";
+
+export const authRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: {
+    message: "Too many requests, please try again later",
+  },
+});

src/middleware/role.middleware.ts

@@ -0,0 +1,21 @@
+import type { Request, Response, NextFunction } from "express";
+
+export function requireRole(role: "admin" | "customer") {
+  return (req: Request, _res: Response, next: NextFunction) => {
+    if (!req.user) {
+      return next({
+        statusCode: 401,
+        message: "Unauthenticated",
+      });
+    }
+
+    if (req.user.role !== role) {
+      return next({
+        statusCode: 403,
+        message: "Forbidden",
+      });
+    }
+
+    next();
+  };
+}