feat: better auth rate limiting

2 files changed, 29 insertions, 2 deletions

diff --git a/packages/auth/src/keys.ts b/packages/auth/src/keys.ts
index 5dfaf0ea..3ac528f4 100644
--- a/packages/auth/src/keys.ts
+++ b/packages/auth/src/keys.ts
@@ -5,6 +5,8 @@ export const keys = () =>
   createEnv({
     server: {
       BETTER_AUTH_SECRET: z.string(),
+      UPSTASH_REDIS_REST_URL: z.string().url(),
+      UPSTASH_REDIS_REST_TOKEN: z.string(),
     },
     client: {
       NEXT_PUBLIC_BETTER_AUTH_URL: z.string().url(),
@@ -12,5 +14,7 @@ export const keys = () =>
     runtimeEnv: {
       NEXT_PUBLIC_BETTER_AUTH_URL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL,
       BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET,
+      UPSTASH_REDIS_REST_URL: process.env.UPSTASH_REDIS_REST_URL,
+      UPSTASH_REDIS_REST_TOKEN: process.env.UPSTASH_REDIS_REST_TOKEN,
     },
   });
diff --git a/packages/auth/src/server.ts b/packages/auth/src/server.ts
index 02d147e0..84b91b39 100644
--- a/packages/auth/src/server.ts
+++ b/packages/auth/src/server.ts
@@ -1,9 +1,20 @@
-import { betterAuth } from "better-auth";
+import { betterAuth, RateLimit } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { db } from "@opencut/db";
 import { keys } from "./keys";
+import { Redis } from "@upstash/redis";
 
-const { NEXT_PUBLIC_BETTER_AUTH_URL, BETTER_AUTH_SECRET } = keys();
+const {
+  NEXT_PUBLIC_BETTER_AUTH_URL,
+  BETTER_AUTH_SECRET,
+  UPSTASH_REDIS_REST_URL,
+  UPSTASH_REDIS_REST_TOKEN,
+} = keys();
+
+const redis = new Redis({
+  url: UPSTASH_REDIS_REST_URL,
+  token: UPSTASH_REDIS_REST_TOKEN,
+});
 
 export const auth = betterAuth({
   database: drizzleAdapter(db, {
@@ -19,6 +30,18 @@ export const auth = betterAuth({
   emailAndPassword: {
     enabled: true,
   },
+  rateLimit: {
+    storage: "secondary-storage",
+    customStorage: {
+      get: async (key) => {
+        const value = await redis.get(key);
+        return value as RateLimit | undefined;
+      },
+      set: async (key, value) => {
+        await redis.set(key, value);
+      },
+    },
+  },
   baseURL: NEXT_PUBLIC_BETTER_AUTH_URL,
   appName: "OpenCut",
   trustedOrigins: ["http://localhost:3000"],