feat: Implemented rate limiting with Upstash (#147)

package.json

@@ -41,6 +41,8 @@
     "@trpc/next": "^10.43.6",
     "@trpc/react-query": "^10.37.1",
     "@trpc/server": "^10.37.1",
+    "@upstash/ratelimit": "^1.0.0",
+    "@upstash/redis": "^1.28.1",
     "@vercel/analytics": "^1.1.1",
     "@vercel/speed-insights": "^1.0.2",
     "class-variance-authority": "^0.7.0",

src/app/dashboard/enrollments/page.tsx

@@ -55,16 +55,18 @@ export default function Enrollments() {
         })
         void refetchAllEnrollments()
         void refetchEnrollmentCount()
-        setIsBeingAdded(false)
         setDialogIsOpen(false)
+        setIsBeingAdded(false)
       },
       // Displays a toast notification when the mutation fails
       // TODO: Fetch error message from server and display it in the toast description
-      onError() {
+      onError: (e) => {
         toast({
           title: 'Error 😢',
-          description: 'Something went wrong, please try again.',
+          description: e.message,
         })
+        setDialogIsOpen(false)
+        setIsBeingAdded(false)
       },
     })
 

src/server/api/routers/enrollment.ts

@@ -1,6 +1,22 @@
+import { TRPCError } from '@trpc/server'
+import { Ratelimit } from '@upstash/ratelimit'
+import { Redis } from '@upstash/redis'
 import { z } from 'zod'
 import { createTRPCRouter, protectedProcedure } from '../trpc'
 
+// Create a new ratelimit instance, used to rate limit the APIs to 1 request per minute
+const ratelimit = new Ratelimit({
+  redis: Redis.fromEnv(),
+  limiter: Ratelimit.slidingWindow(1, '1 m'),
+  analytics: true,
+  /**
+   * Optional prefix for the keys used in redis. This is useful if you want to share a redis
+   * instance with other applications and want to avoid key collisions. The default prefix is
+   * "@upstash/ratelimit"
+   */
+  prefix: '@upstash/ratelimit',
+})
+
 export const enrollmentRouter = createTRPCRouter({
   createEnrollment: protectedProcedure
     .input(
@@ -18,6 +34,15 @@ export const enrollmentRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
+      // Rate limits the API to 1 request per minute
+      const { success } = await ratelimit.limit(ctx.session.user.id)
+      if (!success) {
+        throw new TRPCError({
+          code: 'TOO_MANY_REQUESTS',
+          message: 'You are being rate limited. Try again later.',
+        })
+      }
+
       return await ctx.prisma.enrollment.create({
         data: {
           studentId: input.studentId,