feat: make gateway rate limiter store pluggable

src/config/env.test.ts

@@ -8,9 +8,7 @@ const baseEnv = {
   METRICS_API_KEY: "test-metrics-key",
 };
 
-describe("env schema — BCRYPT_COST_FACTOR", () => {
-  // ── Unit Tests (Task 1.4) ──────────────────────────────────────────────────
-
+describe("env schema - BCRYPT_COST_FACTOR", () => {
   describe("unit tests", () => {
     it("defaults to 12 when BCRYPT_COST_FACTOR is omitted", () => {
       const result = envSchema.safeParse({ ...baseEnv });
@@ -67,10 +65,6 @@ describe("env schema — BCRYPT_COST_FACTOR", () => {
     });
   });
 
-  // ── Property-Based Tests ───────────────────────────────────────────────────
-
-  // Feature: bcrypt-cost-config, Property 1: valid cost factor parses to the correct integer
-  // Validates: Requirements 1.1, 2.1, 4.1
   it("Property 1: valid cost factor parses to the correct integer", () => {
     fc.assert(
       fc.property(fc.integer({ min: 10, max: 31 }), (n) => {
@@ -84,8 +78,6 @@ describe("env schema — BCRYPT_COST_FACTOR", () => {
     );
   });
 
-  // Feature: bcrypt-cost-config, Property 2: out-of-range values are rejected
-  // Validates: Requirements 1.2, 1.3, 5.1, 5.2
   it("Property 2: out-of-range values are rejected", () => {
     fc.assert(
       fc.property(
@@ -102,8 +94,6 @@ describe("env schema — BCRYPT_COST_FACTOR", () => {
     );
   });
 
-  // Feature: bcrypt-cost-config, Property 3: non-numeric strings are rejected
-  // Validates: Requirements 1.4, 5.3
   it("Property 3: non-numeric strings are rejected", () => {
     fc.assert(
       fc.property(

src/config/index.ts

@@ -133,6 +133,13 @@ export const config = {
     maxRequests: env.REST_RATE_LIMIT_MAX_REQUESTS,
   },
 
+  rateLimiter: {
+    maxRequests: env.RATE_LIMIT_MAX_REQUESTS,
+    windowMs: env.RATE_LIMIT_WINDOW_MS,
+    store: env.RATE_LIMIT_STORE,
+    postgresTable: env.RATE_LIMIT_PG_TABLE,
+  },
+
   sorobanRpc:
     env.SOROBAN_RPC_ENABLED && env.SOROBAN_RPC_URL
       ? {

src/index.ts

@@ -2,7 +2,7 @@ import './config/env.js'
 import express from 'express';
 import helmet from 'helmet';
 import { initializeDb, closeDb } from './db/index.js';
-import { closePgPool } from './db.js';
+import { closePgPool, pool } from './db.js';
 import { closeDbPool } from './config/health.js';
 import { disconnectPrisma } from './lib/prisma.js';
 import { errorHandler } from './middleware/errorHandler.js';

src/routes/gatewayRoutes.test.ts

@@ -6,13 +6,15 @@ import { errorHandler } from "../middleware/errorHandler.js";
 import { requestIdMiddleware } from "../middleware/requestId.js";
 
 describe("gateway route - rate limiting", () => {
+  let now = 0;
+
   beforeEach(() => {
-    jest.useFakeTimers("modern" as unknown as any);
-    jest.setSystemTime(new Date("2026-03-30T00:00:00.000Z").getTime());
+    now = new Date("2026-03-30T00:00:00.000Z").getTime();
+    jest.spyOn(Date, "now").mockImplementation(() => now);
   });
 
   afterEach(() => {
-    jest.useRealTimers();
+    jest.restoreAllMocks();
   });
 
   test("returns 429 with Retry-After when rate limited", async () => {

src/routes/gatewayRoutes.ts

@@ -58,7 +58,7 @@ export function createGatewayRouter(deps: GatewayDeps): Router {
           return;
         }
 
-        const rateResult = rateLimiter.check(apiKeyHeader);
+        const rateResult = await rateLimiter.check(apiKeyHeader);
         if (!rateResult.allowed) {
           const retryAfterSec = Math.ceil((rateResult.retryAfterMs ?? 1000) / 1000);
           res.set('Retry-After', String(retryAfterSec));

src/routes/index.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router, type RequestHandler, type Router as ExpressRouter } from 'express';
 import healthRouter from './health.js';
 import usageRouter from './usage.js';
 import billingRouter from './billing.js';

src/routes/proxyRoutes.ts

@@ -117,7 +117,7 @@ export function createProxyRouter(deps: ProxyDeps): Router {
       }
 
       // 3. Rate-limit check
-      const rateResult = rateLimiter.check(apiKeyHeader);
+      const rateResult = await rateLimiter.check(apiKeyHeader);
       if (!rateResult.allowed) {
         const retryAfterSec = Math.ceil((rateResult.retryAfterMs ?? 1000) / 1000);
         res.set('Retry-After', String(retryAfterSec));