From 533bf42ce28d5a679875afdfc52010712afcb121 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20L=C3=B3pez=20Guimaraes?= <danielectra@outlook.com>
Date: Sun, 4 Oct 2026 01:34:10 +0100
Subject: [PATCH] feat(repair-uidhmac): add ratelimit

---
 src/middleware/ratelimit.ts                  | 10 ++++++++++
 src/services/api/routes/v1/repair-uidhmac.ts |  3 ++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/middleware/ratelimit.ts b/src/middleware/ratelimit.ts
index aafe089..d304b69 100644
--- a/src/middleware/ratelimit.ts
+++ b/src/middleware/ratelimit.ts
@@ -63,3 +63,13 @@ export const nascRatelimit = ratelimit({
 	},
 	message: nascError('null')
 });
+
+export const repairUIDHMACRatelimit = ratelimit({
+	windowMs: 5 * 60 * 1000, // 5mins
+	max: 30,
+	keyGenerator: (request: express.Request): string => {
+		const pid = request.body.pid?.trim();
+
+		return String(pid);
+	}
+});
diff --git a/src/services/api/routes/v1/repair-uidhmac.ts b/src/services/api/routes/v1/repair-uidhmac.ts
index d866999..9449db9 100644
--- a/src/services/api/routes/v1/repair-uidhmac.ts
+++ b/src/services/api/routes/v1/repair-uidhmac.ts
@@ -1,6 +1,7 @@
 import express from 'express';
 import { LOG_ERROR } from '@/logger';
 import { NEXAccount } from '@/models/nex-account';
+import { repairUIDHMACRatelimit } from '@/middleware/ratelimit';
 
 const router = express.Router();
 
@@ -9,7 +10,7 @@ const router = express.Router();
  * Implementation of: https://api.pretendo.cc/v1/repair-uidhmac
  * Description: Creates a new user PNID
  */
-router.post('/', async (request: express.Request, response: express.Response): Promise<void> => {
+router.post('/', repairUIDHMACRatelimit, async (request: express.Request, response: express.Response): Promise<void> => {
 	const pid = request.body.pid?.trim(); // * This has to be forwarded since this request comes from the websites server
 	const nexPassword = request.body.password?.trim();