From c9dd45de39ce354f8341d6f24a9dd281673423f7 Mon Sep 17 00:00:00 2001
From: Henry <henry_ball@hotmail.co.uk>
Date: Sun, 25 Jan 2026 21:05:25 +0000
Subject: [PATCH] feat: wrap trpc endpoint in withRateLimit

---
 apps/web/src/pages/api/trpc/[trpc].ts | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/apps/web/src/pages/api/trpc/[trpc].ts b/apps/web/src/pages/api/trpc/[trpc].ts
index 8403e9cb..532f6ac1 100644
--- a/apps/web/src/pages/api/trpc/[trpc].ts
+++ b/apps/web/src/pages/api/trpc/[trpc].ts
@@ -3,12 +3,14 @@ import { createNextApiHandler } from "@trpc/server/adapters/next";
 
 import { appRouter } from "@kan/api/root";
 import { createTRPCContext } from "@kan/api/trpc";
+import { env } from "~/env";
+import { withRateLimit } from "~/utils/rateLimit";
 
 const nextApiHandler = createNextApiHandler({
   router: appRouter,
   createContext: createTRPCContext,
   onError:
-    process.env.NODE_ENV === "development"
+    env.NODE_ENV === "development"
       ? ({ path, error }) => {
           console.error(
             `❌ tRPC failed on ${path ?? "<no-path>"}: ${error.message}`,
@@ -17,11 +19,16 @@ const nextApiHandler = createNextApiHandler({
       : undefined,
 });
 
-export default function handler(req: NextApiRequest, res: NextApiResponse) {
-  if (req.method === "OPTIONS") {
-    res.writeHead(200);
-    return res.end();
-  }
+export default withRateLimit(
+  { points: 100, duration: 60 },
+  async (req: NextApiRequest, res: NextApiResponse) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(200);
+      res.end();
+      return;
+    }
 
-  return nextApiHandler(req, res);
-}
+    const result = await nextApiHandler(req, res);
+    return result;
+  },
+);