I put in a limiter for the login using express-rate-limit but added in the server/libs/ folder here https://github.com/advplyr/audiobookshelf/blob/master/server/libs/expressRateLimit/index.js

Is this a library we could use instead? If we can use express-rate-limit then we can pull it out of the libs folder and add it to the package.json instead.

The limiter library adds an additional dependency just-performance that seems unnecessary at a quick glance.

I don't think express-rate-limit will work. Being express middleware it expects to receive request and response objects. The use case of each is different. express-rate-limit throttles incoming requests while limiter intends to assist in managing outgoing requests.

Could the throttleIt package work instead as a wrapper around existing functions?

https://github.com/sindresorhus/throttleit/blob/main/index.js

I don't think so. It appears throttleIt is for synchronous functions. But, the same author does have an async throttling package: p-throttle. I'll swap out limiter and see how well it works.

@advplyr Any other concerns with this PR?

This is working well in my tests. Thanks!