From 5e2b07e518629a0fefa95ca5f99b60b7dab6bf7c Mon Sep 17 00:00:00 2001
From: Maze Winther <mazewinther@gmail.com>
Date: Sat, 2 Aug 2025 17:33:23 +0200
Subject: [PATCH] feat: better auth rate limiting

---
 packages/auth/src/keys.ts   |  4 ++++
 packages/auth/src/server.ts | 27 +++++++++++++++++++++++++--
 tsconfig.json               |  4 +++-
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/packages/auth/src/keys.ts b/packages/auth/src/keys.ts
index 5dfaf0ea..3ac528f4 100644
--- a/packages/auth/src/keys.ts
+++ b/packages/auth/src/keys.ts
@@ -5,6 +5,8 @@ export const keys = () =>
   createEnv({
     server: {
       BETTER_AUTH_SECRET: z.string(),
+      UPSTASH_REDIS_REST_URL: z.string().url(),
+      UPSTASH_REDIS_REST_TOKEN: z.string(),
     },
     client: {
       NEXT_PUBLIC_BETTER_AUTH_URL: z.string().url(),
@@ -12,5 +14,7 @@ export const keys = () =>
     runtimeEnv: {
       NEXT_PUBLIC_BETTER_AUTH_URL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL,
       BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET,
+      UPSTASH_REDIS_REST_URL: process.env.UPSTASH_REDIS_REST_URL,
+      UPSTASH_REDIS_REST_TOKEN: process.env.UPSTASH_REDIS_REST_TOKEN,
     },
   });
diff --git a/packages/auth/src/server.ts b/packages/auth/src/server.ts
index 02d147e0..84b91b39 100644
--- a/packages/auth/src/server.ts
+++ b/packages/auth/src/server.ts
@@ -1,9 +1,20 @@
-import { betterAuth } from "better-auth";
+import { betterAuth, RateLimit } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { db } from "@opencut/db";
 import { keys } from "./keys";
+import { Redis } from "@upstash/redis";
 
-const { NEXT_PUBLIC_BETTER_AUTH_URL, BETTER_AUTH_SECRET } = keys();
+const {
+  NEXT_PUBLIC_BETTER_AUTH_URL,
+  BETTER_AUTH_SECRET,
+  UPSTASH_REDIS_REST_URL,
+  UPSTASH_REDIS_REST_TOKEN,
+} = keys();
+
+const redis = new Redis({
+  url: UPSTASH_REDIS_REST_URL,
+  token: UPSTASH_REDIS_REST_TOKEN,
+});
 
 export const auth = betterAuth({
   database: drizzleAdapter(db, {
@@ -19,6 +30,18 @@ export const auth = betterAuth({
   emailAndPassword: {
     enabled: true,
   },
+  rateLimit: {
+    storage: "secondary-storage",
+    customStorage: {
+      get: async (key) => {
+        const value = await redis.get(key);
+        return value as RateLimit | undefined;
+      },
+      set: async (key, value) => {
+        await redis.set(key, value);
+      },
+    },
+  },
   baseURL: NEXT_PUBLIC_BETTER_AUTH_URL,
   appName: "OpenCut",
   trustedOrigins: ["http://localhost:3000"],
diff --git a/tsconfig.json b/tsconfig.json
index 9647394a..04ab0f5e 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,5 +1,7 @@
 {
   "compilerOptions": {
-    "strictNullChecks": true
+    "strictNullChecks": true,
+    "moduleResolution": "bundler",
+    "module": "esnext"
   }
 }