/***********************************************************************************************************************************************************************
 * File Name: rateLimiter.middleware.js
 * Type of Program: Middleware
 * Description: Express-rate-limit configurations for different route tiers.
 *              - globalLimiter      → applied to ALL routes (1000 req / 15 min)
 *              - authLimiter        → applied to login/register (20 req / 15 min)
 *              - otpLimiter         → applied to OTP send/verify (5 req / 15 min)
 *              - sensitiveOpsLimiter → password change, account delete (10 req / hour)
 * Author: rgrgogu
 * Date Created: Oct. 6, 2025
 ***********************************************************************************************************************************************************************
 * HOW TO USE:
 *   const { authLimiter } = require('../middleware/rateLimiter.middleware');
 *   router.post('/login', authLimiter, loginHandler);
 ***********************************************************************************************************************************************************************/
const rateLimit = require('express-rate-limit');

const windowMs15 = 15 * 60 * 1000; // 15 minutes

/** Applied globally in server.js */
const globalLimiter = rateLimit({
  windowMs: windowMs15,
  max: 1000,
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 'error', message: 'Too many requests, please try again later.' },
});

/** Login & register routes */
const authLimiter = rateLimit({
  windowMs: windowMs15,
  max: 20,
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 'error', message: 'Too many auth attempts. Please wait 15 minutes.' },
});

/** OTP send / verify */
const otpLimiter = rateLimit({
  windowMs: windowMs15,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 'error', message: 'Too many OTP requests. Please wait 15 minutes.' },
});

/** Password change, account delete */
const sensitiveOpsLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 10,
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 'error', message: 'Too many sensitive operations. Please wait 1 hour.' },
});

/** Admin routes — tighter than global */
const adminLimiter = rateLimit({
  windowMs: windowMs15,
  max: 200,
  standardHeaders: true,
  legacyHeaders: false,
  message: { status: 'error', message: 'Too many admin requests. Please wait 15 minutes.' },
});

module.exports = { globalLimiter, authLimiter, otpLimiter, sensitiveOpsLimiter, adminLimiter };