feat(api): add global rate-limiting and circuit breaker for API routes (fixes #701)

[Diwakar-odds]

Summary
This PR implements a robust Edge middleware utilizing a Token Bucket rate-limiting algorithm and a Circuit Breaker pattern for external dependencies, resolving #701.

Motivation
Closes #701. The application was previously exposed to distributed brute-force attacks on NextAuth login endpoints and malicious link spamming on the api/links API. Additionally, third-party API dependencies had no fault tolerance when they experienced downtime. This PR introduces a robust lib/rate-limit.ts using Redis, and a Circuit Breaker pattern in lib/circuit-breaker.ts to fail fast and protect the application.

Changes

• Created lib/circuit-breaker.ts: Implemented an in-memory CircuitBreaker class managing CLOSED, OPEN, and HALF_OPEN states for fault tolerance.
• Created lib/rate-limit.ts: Configured Upstash Redis Ratelimit using the Token Bucket algorithm (5 requests/15m for /api/auth and 30 requests/1m for /api/links).
• Modified middleware.ts: Integrated the new Token Bucket rate-limiting logic at the edge before hitting serverless functions.
• Modified app/api/auth/[...nextauth]/route.ts: Wrapped the NextAuth handler with the Circuit Breaker to return a 503 upon failure.
• Modified app/api/links/route.ts: Wrapped Prisma DB interactions with the Circuit Breaker to prevent hanging queries.

Acceptance Criteria

• IP-based rate limiting functions correctly in middleware.ts.
• Exceeding limits returns a 429 Too Many Requests response.
• Circuit breaker wraps external API calls and returns 503 upon failure threshold.

Impact & Side Effects
No breaking changes. This ensures the service doesn't cascade failures when upstream DB or OAuth providers go down.

How to Test

• Run npm run dev with Upstash Redis credentials.
• Hit /api/auth/signin 6 times in 15 minutes to observe the 429 response.
• Temporarily change your database URL to an invalid one to trigger DB failure, hit the /api/links endpoint repeatedly, and observe the 503 fail-fast response.

Quality Checklist

• Verified local types and edge-compatibility.
• Ensured no scratch/temporary files are tracked.

[vercel]

@Diwakar-odds is attempting to deploy a commit to the vishnukothakapu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Diwakar-odds]

Hi maintainers,

Thank you for assigning me to this issue! This PR implements the requested Edge middleware rate-limiting (Token Bucket via Upstash Redis) and the Circuit Breaker pattern.

Technical Analysis & XP Label Justification:
This work directly addresses core backend architecture and resilience:

• Architectural Restructuring: Introduced a new CircuitBreaker class abstraction to handle fault tolerance. It isolates external DB/OAuth calls and correctly implements CLOSED, OPEN, and HALF_OPEN states to fail fast instead of hanging.
• Core Backend Enhancements: Integrated a Token Bucket rate limit in Edge middleware. This protects the backend API routes (/api/auth, /api/links) against brute force and link-spam DDOS attacks before they hit the serverless functions.
• Performance/Reliability: The circuit breaker actively prevents cascading failures and connection pool starvation when upstream services are degraded.

Because these changes involve core backend logic, architectural patterns (Circuit Breaker), and security/performance hardening, this PR firmly qualifies for Level 3 and good-backend.

Could you please add the ECSoC26, Level 3, good-backend, and good-pr labels to reflect this complex backend contribution?

Looking forward to your review! 🚀

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
linkid	Error		Aug 14, 2026 8:51am

[vishnukothakapu]

@Diwakar-odds , I noticed the Vercel build is failing on your feat/issue-701-rate-limiting-circuit-breaker branch.

The Prisma/database step is passing now, but the TypeScript build fails in app/api/auth/[...nextauth]/route because the GET handler is returning Promise<unknown> instead of the Response type expected by Next.js.

Just wanted to flag this so you can take a look.