[FEAT] Security/Reliability: Global Rate-Limiting Edge Middleware & Circuit Breaker

[Diwakar-odds]

✨ Feature Description

Create a robust Edge middleware utilizing a Token Bucket rate-limiting algorithm and a Circuit Breaker pattern for external dependencies.

🤔 Problem It Solves

The application lacks global protection against distributed brute-force attacks on NextAuth login endpoints and malicious link spamming on the api/links API. Standard Next.js route handlers are exposed to DDOS attacks. Additionally, third-party API dependencies (OAuth providers, DB) have no fault tolerance when they experience downtime.

💡 Proposed Solution

1. Build lib/rate-limit.ts using Redis to track IP requests and enforce limits (e.g., 5 login attempts per 15 mins, 30 API calls per minute).
2. Integrate this into middleware.ts to block requests at the edge before they hit serverless functions.
3. Implement a Circuit Breaker pattern (lib/circuit-breaker.ts) for external OAuth providers and DB connections to fail fast (returning 503 Service Unavailable) instead of hanging indefinitely during third-party outages.

🔄 Alternatives Considered

Using standard Vercel WAF limits is an option, but application-level Edge middleware allows us to return customized JSON responses, track limit hits in our DB, and dynamically adjust limits based on route importance.

🗂️ Files Likely Involved

• app/api/ — API routes
• Other: middleware.ts, lib/rate-limit.ts, lib/circuit-breaker.ts

📸 Mockup / Reference

N/A

🎯 Acceptance Criteria

• IP-based rate limiting functions correctly in middleware.ts.
• Exceeding limits returns a 429 Too Many Requests response.
• Circuit breaker wraps external API calls and returns 503 upon failure threshold.

🏷️ Difficulty & Labels

• good first issue — beginner friendly
• medium — requires some codebase knowledge
• hard — significant changes needed
• nsoc-26 — open for NSoC contributors

[Diwakar-odds]

Hi maintainers, I would love to be assigned to this issue! 🚀

Proposed Implementation Plan

1. Rate Limiting Engine: Implement a Token Bucket algorithm in lib/rate-limit.ts using an in-memory Map or Edge-compatible KV store.
2. Edge Middleware Integration: Update middleware.ts to match specific high-risk paths (/api/auth, /api/links) and enforce limits globally.
3. Circuit Breaker Logic: Build a class-based Circuit Breaker in lib/circuit-breaker.ts managing CLOSED, OPEN, and HALF-OPEN states for fault tolerance.

Files to be Modified

• middleware.ts
• lib/rate-limit.ts [NEW]
• lib/circuit-breaker.ts [NEW]
• app/api/auth/[...nextauth]/route.ts
• app/api/links/route.ts

Architectural Details

Edge middleware drops malicious requests before serverless cold starts occur, significantly reducing compute costs and protecting against DDOS. The circuit breaker prevents catastrophic cascading failure when upstream services fail.

I have thoroughly reviewed the CONTRIBUTING.md and understand the requirements for L3/High-XP backend tasks. I'm ready to start immediately once assigned! Please assign this to me under the ECSoC '26 program.

[sanjanavenkatesh05]

/claim