feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy

src/env.ts

@@ -100,6 +100,12 @@ const schema = z
 		// Redis — strongly recommended in production (required for multi-instance).
 		// Without it, rate limits / shared caches are in-process only.
 		REDIS_URL: z.string().optional(),
+		// App-layer anti-DDoS gate (proxy rate limiter). On by default in
+		// production; set to "false" or "0" to disable without removing it.
+		ANTI_DDOS_ENABLED: z
+			.string()
+			.optional()
+			.transform((value) => value !== "false" && value !== "0"),
 		// Logging level.
 		LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).optional(),
 		APP_VERSION: z.string().optional(),

src/lib/ddos.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+
+import { classifyDdos } from "@/lib/ddos";
+
+describe("classifyDdos", () => {
+	it.each([
+		["/", "pages"],
+		["/community", "pages"],
+		["/login", "auth"],
+		["/login/", "auth"],
+		["/register", "auth"],
+		["/admin", "auth"],
+		["/admin/home", "auth"],
+		["/api/auth/callback/credentials", "auth"],
+		["/api/articles/hello", "api"],
+		["/api/radio/stream", "api"],
+	])(`classifies %s as %s`, (pathname, expected) => {
+		expect(classifyDdos(pathname)).toBe(expected);
+	});
+});

src/lib/ddos.ts

@@ -0,0 +1,18 @@
+export type DdosCategory = "pages" | "api" | "auth";
+
+export function classifyDdos(pathname: string): DdosCategory {
+	if (
+		pathname === "/api/auth" ||
+		pathname.startsWith("/api/auth/") ||
+		pathname === "/login" ||
+		pathname.startsWith("/login/") ||
+		pathname === "/register" ||
+		pathname.startsWith("/register/") ||
+		pathname === "/admin" ||
+		pathname.startsWith("/admin/")
+	) {
+		return "auth";
+	}
+	if (pathname.startsWith("/api/")) return "api";
+	return "pages";
+}

src/proxy.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getToken } from "next-auth/jwt";
 import { env } from "@/env";
 import { buildContentSecurityPolicy, createCspNonce } from "@/lib/csp";
+import { ddosRejected, enforceDdosRateLimit } from "@/lib/ddos-guard";
 import { shouldRedirectAdminRequest } from "@/lib/proxy-access";
 
 const SECURITY_HEADERS: Record<string, string> = {
@@ -14,13 +15,25 @@ const SECURITY_HEADERS: Record<string, string> = {
 };
 
 export const proxy = async (req: import("next/server").NextRequest) => {
-	const token = await getToken({
+	const decision = await enforceDdosRateLimit(req);
+	if (decision.limited) {
+		return ddosRejected(decision.retryAfterSeconds);
+	}
+
+	const pathname = req.nextUrl.pathname;
+
+	// Only /admin needs a real session token for the redirect guard; skipping
+	// JWT decoding on every other request keeps the proxy cheap under load.
+	const adminPath = pathname === "/admin" || pathname.startsWith("/admin/");
+	const token = adminPath
+		? await getToken({
 				req,
 				secret: env.AUTH_SECRET,
 				secureCookie: true,
-	});
+			})
+		: null;
 
-	if (shouldRedirectAdminRequest(req.nextUrl.pathname, token)) {
+	if (shouldRedirectAdminRequest(pathname, token)) {
 		return NextResponse.redirect(new URL("/login", req.url));
 	}
 
@@ -28,7 +41,7 @@ export const proxy = async (req: import("next/server").NextRequest) => {
 	const csp = buildContentSecurityPolicy(nonce);
 
 	const headers = new Headers(req.headers);
-	headers.set("x-pathname", req.nextUrl.pathname);
+	headers.set("x-pathname", pathname);
 	headers.set("x-nonce", nonce);
 
 	// A client may supply this legacy derived header; no consumer should trust it.
@@ -54,5 +67,7 @@ export const proxy = async (req: import("next/server").NextRequest) => {
 };
 
 export const config = {
-	matcher: ["/((?!api|_next/static|_next/image|assets|favicon.ico).*)"],
+	matcher: [
+		"/((?!_next/static|_next/image|assets|favicon.ico|swf|nitro-assets|imaging).*)",
+	],
 };