feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy

src/lib/ddos.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+
+import { classifyDdos } from "@/lib/ddos";
+
+describe("classifyDdos", () => {
+	it.each([
+		["/", "pages"],
+		["/community", "pages"],
+		["/login", "auth"],
+		["/login/", "auth"],
+		["/register", "auth"],
+		["/admin", "auth"],
+		["/admin/home", "auth"],
+		["/api/auth/callback/credentials", "auth"],
+		["/api/articles/hello", "api"],
+		["/api/radio/stream", "api"],
+	])(`classifies %s as %s`, (pathname, expected) => {
+		expect(classifyDdos(pathname)).toBe(expected);
+	});
+});

src/lib/ddos.ts

@@ -0,0 +1,18 @@
+export type DdosCategory = "pages" | "api" | "auth";
+
+export function classifyDdos(pathname: string): DdosCategory {
+	if (
+		pathname === "/api/auth" ||
+		pathname.startsWith("/api/auth/") ||
+		pathname === "/login" ||
+		pathname.startsWith("/login/") ||
+		pathname === "/register" ||
+		pathname.startsWith("/register/") ||
+		pathname === "/admin" ||
+		pathname.startsWith("/admin/")
+	) {
+		return "auth";
+	}
+	if (pathname.startsWith("/api/")) return "api";
+	return "pages";
+}