Implement tRPC query depth and complexity analysis middleware to prevent nested relational DoS

[Damola-Sodiq]

Description

Create a custom AST-parsing middleware for Fastify/tRPC to preemptively reject queries that exceed a defined computational complexity threshold.

Architecture & Context

Malicious actors can exploit deeply nested Prisma relational queries (e.g., vault -> fractions -> owners -> other_fractions) to exhaust database connections. Analyzing the query Abstract Syntax Tree (AST) before execution stops Denial of Service (DoS) attacks at the edge.

Technical Requirements

• Parse the incoming tRPC batch requests and calculate a static weight score based on table joins and requested limits.
• Reject requests exceeding the threshold with a 429 Too Many Requests error.
• Maintain a latency overhead of less than 2ms for the complexity analysis.

Acceptance Criteria

• Deeply recursive queries are blocked instantly without hitting PostgreSQL.
• Standard dashboard queries process normally without false positives.
• The complexity limits are easily configurable via environment variables.