node-redis-gateway

A small, production-shaped API gateway in Node.js / Express:

• API-key authentication
• Rate limiting & daily quotas, backed by Redis (pluggable store)
• Routing to downstream handlers
• an HMAC-verified webhook endpoint for signed inbound events

It is the classic gateway shape — auth → rate limit → routing → signed events — kept deliberately small and well-tested.

Design

The two pieces that carry risk are written as pure functions with no framework or I/O, so they are exhaustively unit-tested:

• src/hmac.js — constant-time HMAC-SHA256 signature verification (node:crypto).
• src/rateLimit.js — the throttle + daily-quota decision, a pure function of (record, now, policy) returning the decision and the record to persist.

Storage is an injectable interface (getJSON / setJSON): createRedisStore (ioredis) in production, createMemoryStore for tests and local dev. Express only wires these together in src/server.js.

request → apiKeyAuth → rateLimit(check) ──┬─ ok  → route handler
                                          └─ no  → 429 (+ Retry-After)

POST /webhook → express.raw → hmac.verify ──┬─ ok → handle event
                                            └─ no → 401

Run

cp .env.example .env
npm install
npm start            # uses Redis if REDIS_URL is set, else in-memory
# or
docker build -t node-redis-gateway . && docker run -p 3000:3000 node-redis-gateway

Endpoints: GET /health, GET /api/ping (auth + rate-limited), POST /webhook (HMAC).

Tests

npm test

The unit tests cover the HMAC verification (round-trip, tamper, wrong secret) and the rate-limit logic (throttle window, daily cap, day reset) — no Redis or network required (the pure logic is isolated from the Express/ioredis wiring).

License

© 2026 Flavien Verwaerde — All rights reserved. See LICENSE (proprietary, evaluation only).