Fixed Themes not showing

src/app/api/auth/login/route.ts

@@ -12,16 +12,34 @@ import {
   setSessionContext,
   SESSION_COOKIE,
 } from "@/lib/auth"
+import { checkRateLimit } from "@/lib/rate-limit"
 
-function jsonResponse(data: unknown, status: number) {
+function jsonResponse(data: unknown, status: number, headers?: Record<string, string>) {
   return new Response(JSON.stringify(data), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...headers },
   })
 }
 
 export async function POST(request: NextRequest) {
   try {
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    const rateCheck = checkRateLimit(`login:${ipAddress}`, 10, 60000)
+    if (!rateCheck.allowed) {
+      return jsonResponse(
+        { error: "Too many login attempts. Try again in 60 seconds." },
+        429,
+        {
+          "Retry-After": String(Math.ceil((rateCheck.resetAt - Date.now()) / 1000)),
+          "X-RateLimit-Remaining": "0",
+        },
+      )
+    }
+
     const { email, username, password } = await request.json()
 
     const credential = email || username
@@ -40,11 +58,6 @@ export async function POST(request: NextRequest) {
       )
     }
 
-    const ipAddress =
-      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
-      request.headers.get("x-real-ip") ||
-      "127.0.0.1"
-
     const userAgent = request.headers.get("user-agent") || null
 
     // Try to find user by email first, then by username