From 8f2477b25e6bcd4aa52f22e06f31f27f7bd6f865 Mon Sep 17 00:00:00 2001
From: andwati <andwatiian@gmail.com>
Date: Mon, 12 Jan 2026 23:39:05 +0300
Subject: [PATCH] feat: add rate limiting middleware and role-based access
 control

---
 src/middleware/rateLimit.middleware.ts | 11 +++++++++++
 src/middleware/role.middleware.ts      | 21 +++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/src/middleware/rateLimit.middleware.ts b/src/middleware/rateLimit.middleware.ts
index e69de29..efa9534 100644
--- a/src/middleware/rateLimit.middleware.ts
+++ b/src/middleware/rateLimit.middleware.ts
@@ -0,0 +1,11 @@
+import rateLimit from "express-rate-limit";
+
+export const authRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: {
+    message: "Too many requests, please try again later",
+  },
+});
diff --git a/src/middleware/role.middleware.ts b/src/middleware/role.middleware.ts
index e69de29..47ac54e 100644
--- a/src/middleware/role.middleware.ts
+++ b/src/middleware/role.middleware.ts
@@ -0,0 +1,21 @@
+import type { Request, Response, NextFunction } from "express";
+
+export function requireRole(role: "admin" | "customer") {
+  return (req: Request, _res: Response, next: NextFunction) => {
+    if (!req.user) {
+      return next({
+        statusCode: 401,
+        message: "Unauthenticated",
+      });
+    }
+
+    if (req.user.role !== role) {
+      return next({
+        statusCode: 403,
+        message: "Forbidden",
+      });
+    }
+
+    next();
+  };
+}