export function rateLimit(duration) {
  const lock = {};
  return (req, res, next) => {
    if (req._.user.id in lock) {
      res.status(429).send();
    } else {
      next();
      lock[req._.user.id] = true;
      setTimeout(() => delete lock[req._.user.id], 1000 * duration);
    }
  }
}

import { Router, next } from 'rxxpress';
import { throttleTime, groupBy, mergeMap } from 'rxjs/operators';

import { authenticate } from './auth';

const router = new Router();

router.all('*').pipe(
  use(authenticate()),                                  // --> conduct authentication
  groupBy(({req}) => req._.user.id),                    // --> split request stream based on user
  mergeMap(group => group.pipe(throttleTime(10000))),   // --> throttle each split stream 10 seconds, then merge them together
  next()                                                // --> pass to next handler
).subscribe();

// ...
// Rest of your API definition
// ...

export default router.core;