code-block

import { error } from "./http";
const LIMIT = 5;
const WINDOW_MS = 60 * 60 * 1000;
/* One row per IP, per hour */
export async function checkRateLimit(db: D1Database, ip: string) {
  const hour = Math.floor(Date.now() / WINDOW_MS);
  const row = await db
    .prepare("SELECT hits FROM rate_limits WHERE ip = ? AND hour = ?")
    .bind(ip, hour)
    .first<{ hits: number }>();
  if ((row?.hits ?? 0) >= LIMIT) {
    return error(429, "Slow down, try again in an hour");
  }
  await db
    .prepare("INSERT INTO rate_limits VALUES (?, ?, 1) ON CONFLICT DO UPDATE SET hits = hits + 1")
    .bind(ip, hour)
    .run();
  return null;
}