Rate Limit API Calls

[nik-dange]

Description

Closes #349

Changes

• Added rate limiter middleware that applies to all routes

Type of Change

• [ ] Patch (non-breaking change/bugfix)
• [x] Minor (non-breaking change which adds functionality)
• [ ] Major (fix or feature that would cause existing functionality to not work as expected)
• [ ] Documentation (A change to a README/description)
• [ ] Continuous Integration/DevOps Change (Related to deployment steps, continuous integration workflows, linting, etc.)
• [ ] Other: (Fill In)

If you've selected Patch, Minor, or Major as your change type, make sure to bump the version before merging in package.json!

Testing

I have tested that my changes fully resolve the linked issue ...

• [ ] locally.
• [ ] on the testing API/testing database.
• [ ] with appropriate Postman routes. Screenshots are included below.

Checklist

• [ ] I have performed a self-review of my own code.
• [ ] I have followed the style guidelines of this project.
• [ ] I have appropriately edited the API version in the package.json file.
• [ ] My changes produce no new warnings.

Screenshots

Please include a screenshot of your Postman testing passing successfully.

[github-actions[bot]]

Thanks for contributing! If you've made changes to the API's functionality, please make sure to bump the package version—see this guide to semantic versioning for details—and document those changes as appropriate.

[nik-dange]

Regarding the numbers:

What do we want for max requests in a certain time frame, specifically for Express Check-in & User Login? Do we also want to look at rate limiting other routes (while maybe not necessary, would be nice since the code exists)?

[farisashai]

does this rate limit all event related endpoints on the api? If so, can you check with alex and Sean if it breaks the portal ui in any way from something simple like refreshing the events page nonstop

[nik-dange]

Oops, ignore line 14 in RateLimiter.ts + any changes in EventController.ts for now; that was just me experimenting with various ways of applying different limits to different endpoints. In theory, we can customize the numbers for different endpoints, or not limit any endpoints at all (in the case of something like fetching events, if it messes with the UI)

[nik-dange]

Accidentally included a bunch of other changes in this PR–nuking it for a cleaner one