feat: rate limit api routes (#336)

* feat: install rate-limiter-flexible and ioredis

* feat: setup redis client

* feat: add withRateLimit wrapper

* feat: wrap trpc endpoint in withRateLimit

* feat: wrap withRateLimit on remaining routes

* feat: exclude webhook route from rate limiting

* chore: update compose files and readme

* refactor: move into api/db packages

apps/web/src/pages/api/v1/[...trpc].ts

@@ -6,25 +6,26 @@ import { appRouter } from "@kan/api";
 import { createRESTContext } from "@kan/api/trpc";
 
 import { env } from "~/env";
+import { withRateLimit } from "@kan/api/utils/rateLimit";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse,
-) {
-  await cors(req, res);
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    await cors(req, res);
 
-  const openApiHandler = createOpenApiNextHandler({
-    router: appRouter,
-    createContext: createRESTContext,
-    onError:
-      env.NODE_ENV === "development"
-        ? ({ path, error }) => {
-            console.error(
-              `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
-            );
-          }
-        : undefined,
-  });
+    const openApiHandler = createOpenApiNextHandler({
+      router: appRouter,
+      createContext: createRESTContext,
+      onError:
+        env.NODE_ENV === "development"
+          ? ({ path, error }) => {
+              console.error(
+                `❌ REST failed on ${path ?? "<no-path>"}: ${error.message}`,
+              );
+            }
+          : undefined,
+    });
 
-  return await openApiHandler(req, res);
-}
+    return await openApiHandler(req, res);
+  },
+);