/** Rate limit: max requests per IP in the time window */
export const RATE_LIMIT = 3;
export const RATE_WINDOW_MS = 15 * 60 * 1000; // 15 min
export const hits = new Map<string, { count: number; reset: number }>();

export function isRateLimited(ip: string): boolean {
  const now = Date.now();
  const entry = hits.get(ip);
  if (!entry || now > entry.reset) {
    hits.set(ip, { count: 1, reset: now + RATE_WINDOW_MS });
    return false;
  }
  entry.count++;
  return entry.count > RATE_LIMIT;
}

export function sanitize(value: unknown): string {
  if (value === null || value === undefined) return "";
  if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return "";
  return String(value).trim().slice(0, 2000);
}

export function isValidEmail(email: string): boolean {
  if (email.length > 254) return false;
  const at = email.indexOf("@");
  if (at <= 0 || at !== email.lastIndexOf("@")) return false;
  const local = email.slice(0, at);
  const domain = email.slice(at + 1);
  const dot = domain.lastIndexOf(".");
  if (dot <= 0 || dot === domain.length - 1) return false;
  return /^[^\s@]+$/.test(local) && /^[^\s@]+$/.test(domain);
}