Implement API rate limiting middleware with event tracking and paid access integration

[Copilot]

This PR introduces a comprehensive API rate limiting system that prevents abuse and manages resource consumption through event-based tracking, now fully integrated with the existing paid access middleware.

Implementation

Core Middleware

• withEventRateLimit: A chainable middleware that enforces rate limits based on database event tracking
• Event counting: New countEventsInTimeWindow() function tracks user events within configurable time windows
• Flexible configuration: Support for different event types, call limits, and time periods
• Paid access integration: Works seamlessly with withPaidAccess middleware for subscription-based endpoints

Key Features

• Chainable design: Works seamlessly with existing middleware (withAuth, withApiKey, withPaidAccess, withBody)
• Multiple limits per endpoint: Can apply different rate limits on the same endpoint simultaneously
• Automatic event recording: Records events after successful responses (status < 400)
• Type-safe implementation: Full TypeScript support following existing patterns
• Proper error handling: Returns 429 status with detailed rate limit information

Usage Example

export const POST = withApiKey(
  withPaidAccess(
    withEventRateLimit(
      { event: "fetch_reviews", maxCalls: 100, timeWindowHours: 24 },
      withEventRateLimit(
        { event: "update_reviews", maxCalls: 10, timeWindowHours: 24 },
        withBody(schema, async (_, context) => {
          // Handler implementation
        })
      )
    )
  )
);

Applied Rate Limiting

• /api/v1/fetch-updated-data: Limited to 100 fetch_reviews calls per 24 hours, with paid access validation
• Demo endpoint: Shows multiple rate limits (10 fetch_reviews + 3 update_reviews per 24h)

Error Response Format

When limits are exceeded, returns structured error response:

{
  "error": "Rate limit exceeded",
  "details": {
    "event": "fetch_reviews",
    "maxCalls": 100,
    "timeWindowHours": 24,
    "currentCount": 101
  }
}

Integration with Existing Systems

The rate limiting middleware has been designed to work alongside the existing withPaidAccess middleware, ensuring that:

• Users must have valid subscriptions AND respect rate limits
• Rate limiting only applies to successful subscription validations
• Both middlewares follow the established chaining patterns

Testing

Comprehensive test suite covering rate limit enforcement, event recording, error handling, and middleware chaining scenarios. All tests pass with full coverage.

Fixes #34.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[DavidASix]

@copilot this has gotten a bit stale, so I want you to re-write with your updated copilot instructions and fix the merge conflict. Also merge in main to this branch.

[Copilot]

@copilot this has gotten a bit stale, so I want you to re-write with your updated copilot instructions and fix the merge conflict. Also merge in main to this branch.

I've successfully updated the implementation with the latest copilot instructions and merged main into the branch. The merge conflict has been resolved by properly combining the withPaidAccess and withEventRateLimit middlewares in the correct chaining order.

Key updates completed:

• ✅ Merged main branch (commit f19059b)
• ✅ Resolved merge conflicts in the fetch-updated-data endpoint
• ✅ Updated middleware chaining to follow current patterns: withApiKey → withPaidAccess → withEventRateLimit → withBody
• ✅ Fixed code formatting to match project standards
• ✅ All tests passing (6/6 rate limiting tests)
• ✅ Linting passes with no warnings

The rate limiting system is now fully compatible with the latest codebase and includes both paid access validation and event-based rate limiting functionality.