Rate limiting by IP + user (Express)

                  import type { RequestHandler } from 'express';

type Bucket = { count: number; resetAt: number };
const buckets = new Map<string, Bucket>();

export function rateLimit(opts: { windowMs: number; max: number; key: (req: any) => string }): RequestHandler {
  return (req, res, next) => {
    const now = Date.now();
    const key = opts.key(req);
    const b = buckets.get(key);

    if (!b || b.resetAt <= now) {
      buckets.set(key, { count: 1, resetAt: now + opts.windowMs });
      res.setHeader('x-ratelimit-remaining', String(opts.max - 1));
      return next();
    }

    b.count += 1;
    const remaining = Math.max(0, opts.max - b.count);
    res.setHeader('x-ratelimit-remaining', String(remaining));
    res.setHeader('x-ratelimit-reset', String(Math.ceil((b.resetAt - now) / 1000)));

    if (b.count > opts.max) {
      return res.status(429).json({ error: 'RATE_LIMITED' });
    }

    next();
  };
}