shivam + claude changes

middleware.ts

@@ -3,16 +3,15 @@ import type { NextRequest } from 'next/server';
 
 const RATE_LIMIT_WINDOW = 60 * 1000; // 1 minute
 const MAX_REQUESTS = 100; // 100 requests per window
+const CLEANUP_THRESHOLD = 500;
 
 const ipMap = new Map<string, { count: number; expires: number }>();
 
 export function middleware(request: NextRequest) {
-    // Simple in-memory rate limiting implementation
-    // Note: specific to a single instance container. For distributed, use Redis.
-    const ip = request.headers.get('x-forwarded-for') || 'unknown';
+    const forwarded = request.headers.get('x-forwarded-for');
+    const ip = forwarded ? forwarded.split(',')[0].trim() : 'unknown';
     const now = Date.now();
 
-    // Logging Stub: In future, this will push to a DB service
     console.log(`[${new Date().toISOString()}] Request to ${request.nextUrl.pathname} from ${ip}`);
 
     const record = ipMap.get(ip);
@@ -26,8 +25,8 @@ export function middleware(request: NextRequest) {
         }
     }
 
-    // Cleanup old entries occasionally (naive approach for this scale)
-    if (ipMap.size > 1000) {
+    // Cleanup old entries probabilistically (1-in-10 requests)
+    if (ipMap.size > CLEANUP_THRESHOLD && Math.random() < 0.1) {
         for (const [key, val] of ipMap.entries()) {
             if (now > val.expires) {
                 ipMap.delete(key);
@@ -39,5 +38,5 @@ export function middleware(request: NextRequest) {
 }
 
 export const config = {
-    matcher: '/:path*',
+    matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico)$).*)'],
 };