import { rateLimit, type Context, type Next } from "@wrnexus/core";

// Scoped rate limiting: throttle POST /api/login to blunt brute-force attempts.
// The limiter keeps per-IP counters; other routes pass straight through.
const loginLimiter = rateLimit({
  max: 5,
  windowMs: 60_000,
  message: "Too many login attempts. Please wait a minute and try again.",
});

export default async function ratelimit(ctx: Context, next: Next) {
  if (ctx.url.pathname === "/api/login" && ctx.req.method === "POST") {
    return loginLimiter(ctx, next);
  }
  return next();
}