feat: smart email-to-office with rate limiting (3/week, 30min cooldown)

backend/src/routes/timesheets.js

@@ -14,6 +14,24 @@ const router = express.Router();
 
 router.use(authenticate);
 
+// ─────────────── Email Rate Limiter ───────────────
+const emailRateLimit = new Map(); // timesheetId -> { count, lastSentAt }
+const MAX_EMAILS = 3;
+const COOLDOWN_MS = 30 * 60 * 1000; // 30 min
+
+function checkEmailLimit(id) {
+  const now = Date.now();
+  const r = emailRateLimit.get(id) || { count: 0, lastSentAt: 0 };
+  const cooldownMs = Math.max(0, r.lastSentAt + COOLDOWN_MS - now);
+  return { allowed: cooldownMs === 0 && r.count < MAX_EMAILS, cooldownMs, count: r.count };
+}
+function recordEmailSent(id) {
+  const r = emailRateLimit.get(id) || { count: 0, lastSentAt: 0 };
+  emailRateLimit.set(id, { count: r.count + 1, lastSentAt: Date.now() });
+}
+
+
+
 /**
  * Compute Monday of the week for a given date
  */