fix: add configurable request timeout middleware

src/index.ts

@@ -91,6 +91,33 @@ if (!process.env.ADMIN_API_KEY) {
 const app = express();
 const PORT = env.PORT;
 
+function parseTimeoutMs(value: string | undefined, fallback: number): number {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+const REQUEST_TIMEOUT_MS = parseTimeoutMs(process.env.REQUEST_TIMEOUT_MS, 30000);
+const ADMIN_REQUEST_TIMEOUT_MS = parseTimeoutMs(process.env.ADMIN_REQUEST_TIMEOUT_MS, 60000);
+
+function requestTimeout(timeoutMs: number) {
+  return (req: any, res: any, next: any) => {
+    if (res.locals.timeoutTimer) {
+      clearTimeout(res.locals.timeoutTimer);
+    }
+    const timer = setTimeout(() => {
+      if (!res.headersSent) {
+        res.status(408).json({ error: "request_timeout", message: "Request timed out" });
+      }
+      req.destroy();
+    }, timeoutMs);
+    res.locals.timeoutTimer = timer;
+    const clearTimer = () => clearTimeout(timer);
+    res.once("finish", clearTimer);
+    res.once("close", clearTimer);
+    next();
+  };
+}
+
 // Validate CORS origin
 function validateCorsOrigin(origin: string | undefined): string | undefined {
   if (!origin) return undefined;
@@ -137,6 +164,9 @@ app.use(
     level: parseInt(process.env.COMPRESSION_LEVEL ?? "6", 10),
   }),
 );
+app.use(requestTimeout(REQUEST_TIMEOUT_MS));
+app.use("/v1/admin", requestTimeout(ADMIN_REQUEST_TIMEOUT_MS));
+app.use("/api/admin", requestTimeout(ADMIN_REQUEST_TIMEOUT_MS));
 app.use(express.json({ limit: env.BODY_SIZE_LIMIT }));
 app.use(sanitizeInputs);
 app.use(csrfProtection);

src/lib/env.ts

@@ -1,14 +1,20 @@
 export interface Env {
   PORT: number;
   FRONTEND_URL: string;
+  REQUEST_TIMEOUT_MS: number;
+  ADMIN_REQUEST_TIMEOUT_MS: number;
 }
 
 export function initEnv(): Env {
   const port = parseInt(process.env.PORT ?? "3001", 10);
   const frontendUrl = process.env.FRONTEND_URL ?? "http://localhost:3000";
+  const requestTimeoutMs = parseInt(process.env.REQUEST_TIMEOUT_MS ?? "30000", 10);
+  const adminRequestTimeoutMs = parseInt(process.env.ADMIN_REQUEST_TIMEOUT_MS ?? "60000", 10);
 
   return {
     PORT: port,
     FRONTEND_URL: frontendUrl,
+    REQUEST_TIMEOUT_MS: requestTimeoutMs,
+    ADMIN_REQUEST_TIMEOUT_MS: adminRequestTimeoutMs,
   };
 }

src/middleware/requestTimeout.ts

@@ -0,0 +1,14 @@
+import { Request, Response, NextFunction } from 'express';
+
+const defaultTimeout = parseInt(process.env.REQUEST_TIMEOUT_MS || '30000', 10);
+const adminTimeout = parseInt(process.env.ADMIN_REQUEST_TIMEOUT_MS || '60000', 10);
+
+export default function requestTimeout(req, res, next) {
+  const timeoutMs = req.path.startsWith('/admin') ? adminTimeout : defaultTimeout;
+  const timer = setTimeout(() => {
+    if (!res.headersSent) res.status(408).json({ error: 'Request Timeout' });
+    req.destroy();
+  }, timeoutMs);
+  res.on('finish', () => clearTimeout(timer));
+  next();
+}

src/routes/admin.ts

@@ -13,6 +13,37 @@ import { timingSafeCompare } from "../lib/timing-safe";
 
 const router = Router();
 
+const ADMIN_REQUEST_TIMEOUT_MS = Number(process.env.ADMIN_REQUEST_TIMEOUT_MS ?? 60000);
+const REQUEST_TIMEOUT_MS = Number(process.env.REQUEST_TIMEOUT_MS ?? 30000);
+
+export function requestTimeoutMiddleware(timeoutMs: number = REQUEST_TIMEOUT_MS) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    let timedOut = false;
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (!res.headersSent) {
+        res.status(408).json({
+          error: { code: "request_timeout", message: "Request timed out" },
+        });
+      } else {
+        req.destroy();
+      }
+    }, timeoutMs);
+
+    res.on("finish", () => {
+      clearTimeout(timer);
+      if (timedOut) {
+        req.destroy();
+      }
+    });
+    res.on("close", () => clearTimeout(timer));
+    next();
+  };
+}
+
+router.use(requestTimeoutMiddleware(ADMIN_REQUEST_TIMEOUT_MS));
+
 // Bearer token auth — enforced when ADMIN_API_KEY env var is set
 router.use((req: Request, res: Response, next: NextFunction) => {
   const apiKey = config.ADMIN_API_KEY;