feat: rate limiting

app/Providers/AppServiceProvider.php

@@ -8,8 +8,11 @@ use App\Mail\VerifyAccount;
 use App\Models\User;
 use Illuminate\Auth\Notifications\ResetPassword;
 use Illuminate\Auth\Notifications\VerifyEmail;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 use Spatie\Health\Checks\Checks\DatabaseCheck;
@@ -38,6 +41,8 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        $this->configureRateLimiting();
+
         if ($this->app->environment('production')) {
             URL::forceScheme('https');
         }
@@ -102,4 +107,66 @@ class AppServiceProvider extends ServiceProvider
 
         ]);
     }
+
+    private function configureRateLimiting(): void
+    {
+        RateLimiter::for('auth', fn (Request $request): array => [
+            Limit::perMinute(20)->by('ip:'.$request->ip()),
+            Limit::perMinute(5)->by($this->loginRateLimitKey($request)),
+        ]);
+
+        RateLimiter::for(
+            'account-action',
+            fn (Request $request): Limit => Limit::perMinute(5)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for(
+            'content-write',
+            fn (Request $request): Limit => Limit::perMinute(30)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for(
+            'engagement',
+            fn (Request $request): Limit => Limit::perMinute(60)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for('ai-analysis', fn (Request $request): array => [
+            Limit::perMinute(5)->by('minute:'.$this->userRateLimitKey($request)),
+            Limit::perHour(30)->by('hour:'.$this->userRateLimitKey($request)),
+        ]);
+
+        RateLimiter::for(
+            'external-service',
+            fn (Request $request): Limit => Limit::perMinute(10)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for(
+            'device-token',
+            fn (Request $request): Limit => Limit::perMinute(30)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for(
+            'notifications',
+            fn (Request $request): Limit => Limit::perMinute(3)->by($this->userRateLimitKey($request))
+        );
+
+        RateLimiter::for(
+            'reports',
+            fn (Request $request): Limit => Limit::perMinute(10)->by($this->userRateLimitKey($request))
+        );
+    }
+
+    private function loginRateLimitKey(Request $request): string
+    {
+        $email = strtolower((string) $request->input('email', ''));
+
+        return $email !== '' ? 'email:'.$email : 'ip:'.$request->ip();
+    }
+
+    private function userRateLimitKey(Request $request): string
+    {
+        $userId = $request->user()?->getAuthIdentifier();
+
+        return $userId !== null ? 'user:'.$userId : 'ip:'.$request->ip();
+    }
 }