import rateLimit from "express-rate-limit";

// Credential-stuffing / brute-force guard for login: generous enough that a
// real user mistyping their password a few times never gets blocked, tight
// enough to make scripted attempts against a known email impractical.
export const loginRateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 10,
  standardHeaders: true,
  legacyHeaders: false,
  message: { message: "Too many login attempts. Please try again later." },
});

// Signup abuse guard (automated account creation, email bombing via the
// welcome/verification email, etc.) — looser than login since legitimate
// signups are one-shot, not repeated attempts.
export const signupRateLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  limit: 20,
  standardHeaders: true,
  legacyHeaders: false,
  message: { message: "Too many signup attempts. Please try again later." },
});

// Forgot-password / OTP guard — this is the sensitive one: without this, a
// 4-digit OTP (10,000 possibilities) is brute-forceable well within its
// validity window. Scoped tightly since both requesting a code and
// submitting one are low-frequency actions for a real user.
export const otpRateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 10,
  standardHeaders: true,
  legacyHeaders: false,
  message: { message: "Too many attempts. Please try again later." },
});