feat: token bucket rate limiting + NFT tier contracts - #108
Open
Malik6828 wants to merge 1 commit into
Open
Conversation
Rate Limiting (backend)
- Add AppError, logger (pino, plain-object export for Jest), cache.service (ioredis)
- Implement rateLimit() middleware with token bucket algorithm
- Per-user tier multipliers: basic 1×, standard 2×, premium 5×, elite 10×
- Burst mode: 2× effective limit for 10-second burst windows
- Static bypass list via RATE_LIMIT_BYPASS_LIST env var
- Premium/Elite tiers bypass rate limiting entirely
- X-RateLimit-{Limit,Remaining,Reset} headers on every response
- Retry-After header + 429 AppError when limit exceeded
- Structured audit log (pino warn) for every throttled request
- Add burstLimit() and endpointLimit() convenience factories
- Per-endpoint defaults: /markets 100/min, /orders 10/sec, /auth/login 10/min
- Add error.middleware and requireAdminJwt.middleware
- All 29 middleware tests passing (rate-limit 9/9, error 12/12, adminJwt 8/8)
NFT Tier Contracts (Solidity)
- Add contracts/NFTTier.sol — ERC-721 membership tokens
- Tier 1 Basic: 10% fee discount, 1× voting power
- Tier 2 VIP: 25% fee discount, 2× voting power
- Tier 3 Elite: 50% fee discount, 5× voting power + beta market access
- mint(), upgradeTier(), downgradeTier() (admin only)
- Full ERC-721 transfer support (transferFrom, safeTransferFrom, approve, etc.)
- feeDiscountBps(), votingPower(), hasEliteAccess(), tierOf() view helpers
- One-NFT-per-wallet invariant enforced on transfer
- Update contracts/AMM.sol — integrate NFT tier fee discounts
- effectiveFeeBps(trader) computes discounted fee
- computeFee(trader, amountIn) helper
- swap() stub wires in fee discount + emits SwapExecuted with tier info
- Update contracts/Market.sol — enforce exclusive market access
- isEliteMarket mapping + createEliteMarket() / openMarketToAll() admin fns
- onlyIfAccessible(marketId) modifier gates enterMarket()
- canAccess(marketId, user) view helper for off-chain checks
Closes #rate-limiting-middleware #nft-tier-contracts
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements two related issues:
Closes #79 — NFT-Based Market Participation
File:
contracts/NFTTier.soltransferFrom,safeTransferFrom,approve,setApprovalForAll) — tradeable on OpenSea/LooksRaremint(),upgradeTier(),downgradeTier()— downgrade handled correctly (access revoked immediately)tierOf(),feeDiscountBps(),votingPower(),hasEliteAccess()contracts/AMM.sol— NFT fee discount integrationeffectiveFeeBps(trader)applies NFT discount to base feecomputeFee(trader, amountIn)helperswap()stub wires in discounted fee and emits tier infocontracts/Market.sol— Exclusive market access gatingisEliteMarketmapping +createEliteMarket()/openMarketToAll()admin functionsonlyIfAccessible(marketId)modifier gatesenterMarket()canAccess(marketId, user)view helper for off-chain checksToken Bucket Rate Limiting Middleware
File:
backend/src/middleware/rate-limit.middleware.tsINCR+ TTL/markets100/min,/orders10/sec,/auth/login10/minburstLimit()factory grants 2× the effective limitRATE_LIMIT_BYPASS_LISTenv var + premium/elite tiers never throttledX-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset+Retry-AfterheadersSupporting files:
AppError,logger,cache.service,error.middleware,requireAdminJwt.middlewareTests: 29/29 passing (rate-limit 9, error 12, requireAdminJwt 8)