"Added express-rate-limit package and implemented rate limiting for admin API login attempts"

package.json

@@ -97,6 +97,7 @@
     "expr-eval": "^2.0.2",
     "express": "^4.19.2",
     "express-async-handler": "^1.2.0",
+    "express-rate-limit": "^7.2.0",
     "express-static-gzip": "2.1.7",
     "fs-extra": "11.2.0",
     "js-yaml": "^4.1.0",

server/admin.api.js

@@ -1,29 +1,39 @@
 const HomebrewModel = require('./homebrew.model.js').model;
 const router = require('express').Router();
 const Moment = require('moment');
-//const render = require('vitreum/steps/render');
 const templateFn = require('../client/template.js');
 const zlib = require('zlib');
+const rateLimit = require('express-rate-limit');
+
+// Define rate limiter options
+const loginLimiter = rateLimit({
+    windowMs: 24 * 60 * 60 * 1000, // 24 hours window
+    max: 10, // limit each IP to 10 requests per windowMs
+    message: "Too many login attempts from this IP, please try again later"
+});
 
 process.env.ADMIN_USER = process.env.ADMIN_USER || 'admin';
 process.env.ADMIN_PASS = process.env.ADMIN_PASS || 'password3';
 
 const mw = {
-	adminOnly : (req, res, next)=>{
+    adminOnly: [
-		if(!req.get('authorization')){
+        loginLimiter,
-			return res
+        (req, res, next) => {
-				.set('WWW-Authenticate', 'Basic realm="Authorization Required"')
+            if (!req.get('authorization')) {
-				.status(401)
+                return res
-				.send('Authorization Required');
+                    .set('WWW-Authenticate', 'Basic realm="Authorization Required"')
-		}
+                    .status(401)
-		const [username, password] = Buffer.from(req.get('authorization').split(' ').pop(), 'base64')
+                    .send('Authorization Required');
-			.toString('ascii')
+            }
-			.split(':');
+            const [username, password] = Buffer.from(req.get('authorization').split(' ').pop(), 'base64')
-		if(process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password){
+                .toString('ascii')
-			return next();
+                .split(':');
-		}
+            if (process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password) {
-		return res.status(401).send('Access denied');
+                return next();
-	}
+            }
+            return res.status(401).send('Access denied');
+        }
+    ]
 };
 
 const junkBrewPipeline = [