Merge pull request #1736 from MinitJain/fix/rate-limiter-clear

fix(api): evict only non-rate-limited entries when rate limiter map exceeds capacity

Author: richiemcilroy

apps/web/app/api/utils.ts

@@ -35,7 +35,19 @@ export const developerRateLimiter = createMiddleware(async (c, next) => {
 			if (now > v.resetAt) requestCounts.delete(k);
 		}
 		if (requestCounts.size > RATE_LIMIT_MAX_ENTRIES) {
-			requestCounts.clear();
+			for (const [k, v] of requestCounts) {
+				if (requestCounts.size <= RATE_LIMIT_MAX_ENTRIES) break;
+				if (v.count < RATE_LIMIT_MAX_REQUESTS) requestCounts.delete(k);
+			}
+			if (requestCounts.size > RATE_LIMIT_MAX_ENTRIES) {
+				const byExpiry = [...requestCounts.entries()].sort(
+					(a, b) => a[1].resetAt - b[1].resetAt,
+				);
+				for (const [k] of byExpiry) {
+					if (requestCounts.size <= RATE_LIMIT_MAX_ENTRIES) break;
+					requestCounts.delete(k);
+				}
+			}
 		}
 	}