feat: add ratelimiter to backend

apps/backend/package.json

@@ -29,6 +29,7 @@
     "debug": "^4.3.5",
     "fastq": "^1.17.1",
     "hono": "^4.5.1",
+    "hono-rate-limiter": "^0.4.0",
     "jose": "^5.6.3",
     "playwright-chromium": "^1.44.0",
     "rss-parser": "^3.13.0",

apps/backend/src/index.ts

@@ -2,18 +2,32 @@ import { Hono } from "hono"
 import { logger } from "hono/logger"
 import { format } from "@formkit/tempo"
 import { prettyJSON } from "hono/pretty-json"
+import { rateLimiter } from "hono-rate-limiter";
 import { type HttpBindings, serve } from "@hono/node-server"
 
 import { updateJob } from "./jobs/cron-update.js"
 import bookmark from "./routes/bookmark/index.js"
 import feed from "./routes/feed/index.js"
 import root from "./routes/root.js"
 
+const limiter = rateLimiter({
+  windowMs: 5 * 60 * 1000, // 5 minutes
+  limit: 5, // Limit each IP to 100 requests per `window`
+  standardHeaders: "draft-6", // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
+  keyGenerator: (c) => {
+    const a = c.req.header('CF-Connecting-IP') || c.req.header('X-Forwarded-For') || c.req.header('origin') || '127.0.0.1' // Method to generate custom identifiers for clients.
+    console.log('clientIp', a)
+    return a
+  }
+});
+
 const app = new Hono<{ Bindings: HttpBindings }>({ strict: false }).basePath(
   "/worker/v1",
 )
+
 app.use(logger())
 app.use(prettyJSON())
+app.use(limiter)
 
 app.route("/bookmark", bookmark)
 app.route("/feed", feed)