import rateLimit from 'express-rate-limit';

/** Default cap for authenticated JSON APIs (per IP, behind trust proxy). */
export const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 300,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many requests, please try again later.' },
});

/** Public tracking (opens/clicks/unsubscribe) — higher ceiling; abuse still bounded. */
export const trackLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 600,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many tracking requests from this address.' },
});

/** Bulk send, enrichment jobs, user invites — low volume, high impact. */
export const strictActionLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 20,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many high-impact actions. Please wait before retrying.' },
});

/** Campaign test send, transactional send, CSV import — moderate cap. */
export const moderateActionLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 60,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many send or import requests. Please try again later.' },
});

/** Admin user creation — very tight. */
export const inviteLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 25,
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many user invitations from this address.' },
});