[Backend] — Per-Endpoint Rate Limit Tiers

[Olowodarey]

Labels: backend, enhancement, auth, security

Problem

Rate limiting is uniform, so cheap read endpoints and expensive write endpoints share the same budget, either over-restricting reads or under-protecting writes.

Requirements

1. Support configurable rate-limit tiers assignable per route.
2. Apply distinct limits per authenticated user/API key and tier.
3. Return standard rate-limit headers on responses.
4. Make tier limits configurable via env/config.

Acceptance Criteria

• Different routes enforce their assigned tier limits.
• Rate-limit headers reflect remaining quota.
• Limits are configurable without code changes.
• Tests cover under-limit, at-limit, and over-limit behavior.

Files

backend/src/auth/rate-limit.service.ts, backend/src/common/guards, backend/src/config

[morelucks]

@morelucks has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello,

I’m a smart contract and full-stack developer interested in contributing to this issue.

I have experience contributing through OnlyDust and have participated in Drips Wave 1, Wave 2, Wave 5, as well as the GrantFox beta campaign.

My technical background includes Rust, Soroban, Cairo, Solidity, and TypeScript, with a focus on building secure, scalable, and maintainable blockchain applications.

Based on the scope of this issue, I’m confident I can deliver a complete and well-tested solution within 24 hours of assignment. I prioritize clean code, clear documentation, and efficient implementation.

I’d appreciate the opportunity to contribute and help move this issue forward.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @morelucks to this issue.

[AlphaMaleBaDI]

@AlphaMaleBaDI has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I am highly interested in contributing to the Per-Endpoint Rate Limit Tiers task for the InsightArena project. I have extensive experience in backend systems architecture, specifically in designing and implementing robust rate-limiting mechanisms that maintain system stability while ensuring fair API usage.

Relevant Experience and Technical Approach:

• Rate Limiting Proficiency: I have successfully implemented multi-tier rate limiting using Redis and custom middleware in high-throughput Node.js/Go environments. I understand the complexities of token bucket and sliding window algorithms to handle burst traffic effectively.
• Scalability focus: My background includes building middleware that operates with sub-millisecond latency, ensuring that rate-limiting logic does not become a bottleneck for the backend services.
• Infrastructure Familiarity: I am comfortable working with distributed systems and can ensure that the tiered limits are consistently applied across multiple microservices or endpoints as required by the Stellar Wave specifications.
• Clean Code and Testing: I prioritize writing modular, well-documented code with comprehensive test coverage, ensuring the new rate-limiting logic is maintainable and resistant to edge-case failures.

I am eager to apply these skills to help optimize the API performance for InsightArena and am ready to dive into the codebase immediately. Thank you for your consideration.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AlphaMaleBaDI to this issue.

[Emmanuellsensai]

@Emmanuellsensai has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I'd like to work on this.

Plan:

1. Create tiered configuration in backend/src/config (e.g., tier definitions for read/write/admin with specific rate limits).
2. Enhance rate-limit.service.ts to read tier assignments per route and apply the appropriate limits based on authenticated user/API key.
3. Add rate-limit middleware in backend/src/common/guards to intercept requests, check remaining quota per tier, and return standard rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset).
4. Wire tier assignments to specific routes (e.g., GET endpoints use read tier, POST/DELETE use write tier).
5. Add tests covering under-limit, at-limit, and over-limit scenarios for each tier.

I'll wait for assignment before opening a PR.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Emmanuellsensai to this issue.

[bright5455]

@bright5455 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainers,

I’d like to be assigned to this issue.

I have experience building secure backend APIs with NestJS, Express, PostgreSQL, and Prisma, and I’ve implemented authentication, request throttling, and middleware for production applications. I understand that applying the same rate limit across all endpoints is inefficient because lightweight read operations and resource-intensive write operations have different security and performance requirements.

How I’ll implement this
• Review the existing rate-limiting implementation to understand how limits are currently applied.
• Introduce configurable rate-limit tiers that can be assigned to endpoints based on their behaviour (e.g. read, write, authentication, and admin routes).
• Update the middleware/guard to resolve and enforce the appropriate tier for each endpoint while preserving the current API behaviour.
• Keep the configuration centralized so new endpoints can easily be assigned to an existing or new tier without code duplication.
• Add comprehensive tests covering each tier, ensuring correct limits are enforced and preventing regressions.
• Validate that the implementation is backward-compatible, well documented, and satisfies all acceptance criteria before submitting the PR.

This approach improves security by protecting sensitive endpoints more aggressively while allowing higher throughput for lightweight read operations, resulting in better performance and flexibility.

I’d appreciate the opportunity to work on this issue and contribute a clean, maintainable, and well-tested solution. Thank you for your consideration.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @bright5455 to this issue.

[nayt9]

@nayt9 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello sir , my name is Nathan. I’m smart contract developer, and I’d love to contribute to this project. I’m comfortable working with modern frontend tools and blockchain technologies, and I can deliver tasks quickly often within 24 hours.
Please let me know how I can get started or if there are any issues suitable for a first contribution.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nayt9 to this issue.

[AJ0070]

@AJ0070 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Could you please assign this to me? I would like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AJ0070 to this issue.

[abdullahilateefat03-boop]

@abdullahilateefat03-boop has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello maintainers,
I’m interested in taking up this issue. I have experience in Full-stack web development. After reviewing the issue requirements, I believe I can implement a proper solution and follow the project guidelines.
Kindly assign the issue to me.
Thanks.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abdullahilateefat03-boop to this issue.

[Danitello123]

@Danitello123 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Good day maintainer
Please kindly assign me this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Danitello123 to this issue.

[OmniZlatoon]

@OmniZlatoon has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Good day sir, Ready to deliver the task A.S.A.P. Gone through the issue and to be honest, i can work the task with the right tools at hand. please assign me maintainer . My eta is 5 hours

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OmniZlatoon to this issue.

[chi797]

@chi797 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Good day maintainer
Please kindly assign me this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @chi797 to this issue.