Middleware

Protect routes with role-based access, rate limiting, IP filtering, and security headers.

API: requireAdmin, rateLimit, ipWhitelist, helmet

middleware.ts

// Apply secure headers and Redis-backed limits.
app.use(auth.helmet);
app.use(auth.rateLimit);

// Apply the whitelist only where your API requires it.
app.use("/internal", auth.ipWhitelist);

app.get("/admin", auth.requireAdmin, (_req, res) => {
  res.json({ message: "Admin only" });
});

Middleware	Description
auth.helmet	Sets secure HTTP response headers
auth.rateLimit	Redis-backed rate limiting per IP
auth.ipWhitelist	Restricts access to a configured list of IPs
auth.requireAdmin	Rejects requests without an admin-role JWT