feat: add rate limiting to product create, update, and delete endpoints

[swetalin-10]

Fixes #329

Problem

The POST /api/products, PUT /api/products/:id, PATCH /api/products/:id/restock, and DELETE /api/products/:id endpoints had no rate limiting. While they are protected by authMiddleware and adminMiddleware, a compromised admin token or a brute-force scenario could still allow mass creation, bulk updates, or rapid deletion of products without any throttling.

Solution

Added three new rate limiters in BACKEND/middleware/rateLimiter.js following the exact same pattern as the existing auth limiters, and wired them into BACKEND/routes/product.route.js.

Limiter	Endpoint(s)	Window	Max requests
productCreateLimiter	POST /api/products	1 hour	30
productUpdateLimiter	PUT /api/products/:id, PATCH /api/products/:id/restock	1 hour	60
productDeleteLimiter	DELETE /api/products/:id	1 hour	20

Delete has the tightest limit since it's the most destructive operation.

Changes

BACKEND/middleware/rateLimiter.js — added three new exported limiters:

export const productCreateLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 30,
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    success: false,
    message: "Too many product creation requests. Please try again after 1 hour.",
  },
});

export const productUpdateLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 60,
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    success: false,
    message: "Too many product update requests. Please try again after 1 hour.",
  },
});

export const productDeleteLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 20,
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    success: false,
    message: "Too many product deletion requests. Please try again after 1 hour.",
  },
});

BACKEND/routes/product.route.js — imported and applied the limiters before auth checks (so the rate limit fires before any token validation overhead):

+ import { productCreateLimiter, productUpdateLimiter, productDeleteLimiter } from "../middleware/rateLimiter.js";

- router.post("/", authMiddleware, adminMiddleware, upload.single("image"), handleUploadError, createProduct);
+ router.post("/", productCreateLimiter, authMiddleware, adminMiddleware, upload.single("image"), handleUploadError, createProduct);

- router.put("/:id", authMiddleware, adminMiddleware, upload.single("image"), handleUploadError, updateProduct);
+ router.put("/:id", productUpdateLimiter, authMiddleware, adminMiddleware, upload.single("image"), handleUploadError, updateProduct);

- router.patch("/:id/restock", authMiddleware, adminMiddleware, restockProduct);
+ router.patch("/:id/restock", productUpdateLimiter, authMiddleware, adminMiddleware, restockProduct);

- router.delete("/:id", authMiddleware, adminMiddleware, deleteProduct);
+ router.delete("/:id", productDeleteLimiter, authMiddleware, adminMiddleware, deleteProduct);

Full diff: swetalin-10@71bc954

No breaking changes

• GET endpoints are untouched
• Existing auth/checkout rate limiters are untouched
• Limits are generous enough not to affect normal admin workflows

[vercel]

@swetalin-10 is attempting to deploy a commit to the niharika-mente's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Aamod007]

LGTM