fix: improve OAuth rate limiting implementation

- Fix off-by-one error: use >= instead of > for count checks
- Add Retry-After HTTP header to 429 responses (standard approach)
- Add type declaration merging for decorator properties
- Remove as any casts from auth routes
- Document cache:10000 reasoning in comments

Author: roshankumar0036singh

apps/backend/src/plugins/oauthRateLimit.ts

@@ -1,4 +1,4 @@
-import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import fastifyPlugin from 'fastify-plugin';
 import rateLimit from '@fastify/rate-limit';
 
@@ -9,8 +9,18 @@ import rateLimit from '@fastify/rate-limit';
  * - OAuth start endpoints: 10 requests per minute per IP
  * - Uses Redis for distributed rate limiting across multiple instances
  */
+
+// Extend Fastify instance with OAuth rate limit middleware
+declare module 'fastify' {
+  interface FastifyInstance {
+    oauthCallbackRateLimit: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    oauthStartRateLimit: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+  }
+}
+
 export const oauthRateLimitPlugin = fastifyPlugin(async (app: FastifyInstance) => {
   // Rate limit for OAuth callback endpoints (stricter)
+  // cache: 10000 = in-memory LRU capacity; sufficient for per-IP tracking on typical apps
   const callbackLimiter = rateLimit.createStore({
     max: 5,
     timeWindow: '1 minute',
@@ -19,6 +29,7 @@ export const oauthRateLimitPlugin = fastifyPlugin(async (app: FastifyInstance) =
   });
 
   // Rate limit for OAuth start endpoints (moderate)
+  // cache: 10000 = in-memory LRU capacity; sufficient for per-IP tracking on typical apps
   const startLimiter = rateLimit.createStore({
     max: 10,
     timeWindow: '1 minute',
@@ -29,37 +40,42 @@ export const oauthRateLimitPlugin = fastifyPlugin(async (app: FastifyInstance) =
   // Middleware for OAuth callback rate limiting (per IP, with user-aware fallback)
   const callbackRateLimitMiddleware = async (
     request: FastifyRequest,
-    reply: any
+    reply: FastifyReply
   ) => {
     // Use user ID if authenticated, otherwise use IP
     const key = (request.user as any)?.id || request.ip;
-    const limited = await callbackLimiter.incr(key);
+    const count = await callbackLimiter.incr(key);
 
-    if (limited > 5) {
+    // incr() returns count AFTER incrementing, so >= 5 means limit exceeded
+    if (count >= 5) {
+      reply.header('Retry-After', '60');
       return reply.status(429).send({
         error: 'Too many authentication attempts. Please try again later.',
-        retryAfter: 60,
       });
     }
   };
 
   // Middleware for OAuth start rate limiting (per IP)
   const startRateLimitMiddleware = async (
     request: FastifyRequest,
-    reply: any
+    reply: FastifyReply
   ) => {
     const key = `oauth_start:${request.ip}`;
-    const limited = await startLimiter.incr(key);
+    const count = await startLimiter.incr(key);
 
-    if (limited > 10) {
+    // incr() returns count AFTER incrementing, so >= 10 means limit exceeded
+    if (count >= 10) {
+      reply.header('Retry-After', '60');
       return reply.status(429).send({
         error: 'Too many OAuth requests. Please try again later.',
-        retryAfter: 60,
       });
     }
   };
 
   // Export middleware for use in auth routes
-  app.decorate('oauthCallbackRateLimit', callbackRateLimitMiddleware);
-  app.decorate('oauthStartRateLimit', startRateLimitMiddleware);
+  app.decorate(
+    'oauthCallbackRateLimit',
+    callbackRateLimitMiddleware as any
+  );
+  app.decorate('oauthStartRateLimit', startRateLimitMiddleware as any);
 });

apps/backend/src/routes/auth.ts

@@ -28,7 +28,7 @@ export async function authRoutes(app: FastifyInstance) {
   }
 
   // GitHub OAuth start
-  app.get('/github', { preHandler: [app.oauthStartRateLimit as any] }, async (request: FastifyRequest, reply: FastifyReply) => {
+  app.get('/github', { preHandler: [app.oauthStartRateLimit] }, async (request: FastifyRequest, reply: FastifyReply) => {
     const redirectUri = `${process.env.BACKEND_URL}/auth/github/callback`;
     const clientState = (request.query as any).state || '';
     const mobileRedirectUri = (request.query as any).mobile_redirect_uri || '';
@@ -55,7 +55,7 @@ export async function authRoutes(app: FastifyInstance) {
   });
 
   // GitHub OAuth callback
-  app.get('/github/callback', { preHandler: [app.oauthCallbackRateLimit as any] }, async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
+  app.get('/github/callback', { preHandler: [app.oauthCallbackRateLimit] }, async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
     const { code, state } = request.query;
     const storedState = request.cookies?.oauth_state;
     if (!state || !storedState || state !== storedState) {
@@ -151,7 +151,7 @@ export async function authRoutes(app: FastifyInstance) {
   });
 
   // Google OAuth start
-  app.get('/google', { preHandler: [app.oauthStartRateLimit as any] }, async (request: FastifyRequest, reply: FastifyReply) => {
+  app.get('/google', { preHandler: [app.oauthStartRateLimit] }, async (request: FastifyRequest, reply: FastifyReply) => {
     const redirectUri = `${process.env.BACKEND_URL}/auth/google/callback`;
     const clientState = (request.query as any).state || '';
     const mobileRedirectUri = (request.query as any).mobile_redirect_uri || '';
@@ -180,7 +180,7 @@ export async function authRoutes(app: FastifyInstance) {
   });
 
   // Google callback
-  app.get('/google/callback', { preHandler: [app.oauthCallbackRateLimit as any] }, async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
+  app.get('/google/callback', { preHandler: [app.oauthCallbackRateLimit] }, async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
     const { code, state } = request.query;
 
     const storedState = request.cookies?.oauth_state;