Spec
Implement rateLimit({ windowMs, max, keyFn }) in middleware/rateLimit.js. The full contract is in the doc comment.
Why it matters: rate limiting shows up constantly, both in "build an API" tasks and in system-design follow-ups. You'll need per-key state in a closure, time math, and correct HTTP semantics (429, Retry-After).
Approach to practise:
- Read every test first and list the behaviours.
- Make the first test pass with the simplest code.
- Add behaviours one at a time, rerunning after each.