Cả project của bạn, ngay trong trình duyệt.

import type { NextFunction, Request, Response } from 'express';

const WINDOW_MS = 60_000;
const LIMIT = 60;

const hits = new Map<string, { count: number; resetAt: number }>();

export function rateLimit(req: Request, res: Response, next: NextFunction) {
  const key = req.header('x-api-key') ?? req.ip ?? 'anonymous';
  const now = Date.now();
  const entry = hits.get(key);

  if (!entry || entry.resetAt <= now) {
    hits.set(key, { count: 1, resetAt: now + WINDOW_MS });
    return next();
  }

  if (entry.count >= LIMIT) {
    const seconds = Math.ceil((entry.resetAt - now) / 1000);
    res.setHeader('Retry-After', String(seconds));
    return res.status(429).json({ error: 'rate_limited' });
  }

  entry.count += 1;
  next();
}