import type { NextFunction, Request, Response } from "express";
import rateLimit from "express-rate-limit";
import { config } from "../config.js";

/** Abuse throttling protects exposed deployments; local dev/test runs from loopback are exempt. */
const isLocalLoopback = (req: Request): boolean => req.ip === "127.0.0.1" || req.ip === "::1" || req.ip === "::ffff:127.0.0.1";
const skipInLocalDev = (req: Request): boolean => !config.isProduction && isLocalLoopback(req);

export const loginLimiter = rateLimit({
  windowMs: config.loginRate.windowMinutes * 60_000,
  limit: config.loginRate.max,
  skip: skipInLocalDev,
  standardHeaders: "draft-8",
  legacyHeaders: false,
  skipSuccessfulRequests: true,
  message: { error: "محاولات كثيرة جدًا — حاول مرة أخرى لاحقًا" },
});

export const globalLimiter = rateLimit({
  windowMs: 60_000,
  limit: 300,
  skip: skipInLocalDev,
  standardHeaders: "draft-8",
  legacyHeaders: false,
  message: { error: "طلبات كثيرة جدًا" },
});