step 10.6: wip (not ticked)

src/app.js

@@ -50,6 +50,10 @@ function createApp() {
     res.sendFile(path.join(PUBLIC_DIR, 'index.html'));
   });
 
+  // General API rate limiter: 120 req/min per IP (SECURITY.md).
+  // Mounted BEFORE auth routes so it covers them too (auth-specific limiters are stricter and trigger first).
+  app.use('/api', apiLimiter);
+
   // Auth routes (public)
   app.post('/api/auth/register', registerLimiter, authRoutes.postRegister);
   app.post('/api/auth/login', loginLimiter, authRoutes.postLogin);
@@ -58,9 +62,6 @@ function createApp() {
   app.post('/api/auth/logout', requireAuth, authRoutes.postLogout);
   app.get('/api/auth/me', requireAuth, authRoutes.getMe);
 
-  // General API rate limiter (applies to all non-auth routes below)
-  app.use('/api', apiLimiter);
-
   // Character routes (require session)
   app.post('/api/character', requireAuth, characterRoutes.postCharacter);
   app.get('/api/character', requireAuth, characterRoutes.getCharacter);

src/routes/auth.js

@@ -19,20 +19,18 @@ const loginSchema = zod.strictObject({
   password: zod.string().min(1).max(72),
 });
 
-// Rate limiters — temporarily disabled for debugging
-// const registerLimiter = rateLimit({
-//   windowMs: 60 * 60 * 1000, // 1 hour
-//   max: process.env.NODE_ENV === 'test' ? 1000 : 100,
-//   message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many registration attempts. Try again later.' } },
-// });
+// Rate limiters — re-enabled (were disabled for debugging in 10.x early steps)
+const registerLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  max: process.env.NODE_ENV === 'test' ? 1000 : 100,
+  message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many registration attempts. Try again later.' } },
+});
 
-// const loginLimiter = rateLimit({
-//   windowMs: 15 * 60 * 1000, // 15 minutes
-//   max: process.env.NODE_ENV === 'test' ? 1000 : 100,
-//   message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many login attempts. Try again later.' } },
-// });
-const registerLimiter = (_req, _res, next) => next();
-const loginLimiter = (_req, _res, next) => next();
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: process.env.NODE_ENV === 'test' ? 1000 : 100,
+  message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many login attempts. Try again later.' } },
+});
 
 function wrap(fn) {
   return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);