Implement API Rate Limiting & Throttling

[akargi]

Overview

Implement comprehensive rate limiting and throttling mechanisms to protect the API from abuse, ensure fair resource distribution, and maintain system stability under high load.

Description

The API needs protection against rate abuse and DDoS attacks while fairly allocating resources among users. Different endpoints and user types require different rate limits.

Requirements

• Per-user rate limiting (tier-based: free, premium, enterprise)
• Per-endpoint rate limits with different thresholds
• IP-based rate limiting for unauthenticated requests
• Sliding window rate limiting algorithm
• Redis-backed rate limit state management
• Configurable rate limit quotas per API tier
• Rate limit headers in responses (X-RateLimit-*)
• Graceful degradation with 429 status codes
• Admin endpoint for rate limit configuration
• Rate limit bypass for critical system operations

Acceptance Criteria

• Rate limiting guard implemented in NestJS middleware
• Redis store configured for distributed rate limit tracking
• Free tier: 100 requests/minute, Premium: 1000/minute, Enterprise: unlimited
• Rate limit info returned in response headers
• 429 status code returned when limit exceeded with retry-after header
• Sliding window algorithm passes edge case tests
• Admin endpoint allows runtime rate limit adjustment
• Unit tests validate limit enforcement (>80% coverage)
• E2E tests simulate multiple concurrent users
• Performance: rate limit check adds <10ms latency
• Integration tests with Redis for distributed scenarios