pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

Add per-user and global rate limiting on POST /generate #613

Open
pook wants to merge 59 commits from agent-task/611 into main
pull from: agent-task/611
merge into: pook:main
Conversation 0 Commits 59 Files changed 62 +6164 -66
pook commented 2026-04-11 05:36:07 -04:00
Owner
Copy link

Summary

  • Enhanced the existing rate limiter middleware to support per-user keying (X-User-Id header, falling back to IP) and a global request cap
  • Configured /generate/* endpoints with 10 req/min per user and 100 req/min global
  • 429 responses now include { error: "Rate limit exceeded", retryAfter: <seconds> } in the body

Changes

  • packages/api/src/middleware/rate-limit.ts — added keyGenerator and globalMax options
  • packages/api/src/index.ts — updated rate limiter config to 10/min per-user + 100/min global
  • packages/api/tests/unit/rate-limit.test.ts — 6 tests covering per-user limit, user isolation, IP fallback, global limit, response format

Test plan

  • 11 rapid requests from same user -> 429 on 11th with retryAfter in body
  • Different users tracked independently
  • Falls back to IP when no user ID header present
  • Global limit enforced across all users
  • Existing webhook rate-limit tests still pass
  • No new TypeScript errors in changed files
## Summary - Enhanced the existing rate limiter middleware to support per-user keying (`X-User-Id` header, falling back to IP) and a global request cap - Configured `/generate/*` endpoints with **10 req/min per user** and **100 req/min global** - 429 responses now include `{ error: "Rate limit exceeded", retryAfter: <seconds> }` in the body ## Changes - `packages/api/src/middleware/rate-limit.ts` — added `keyGenerator` and `globalMax` options - `packages/api/src/index.ts` — updated rate limiter config to 10/min per-user + 100/min global - `packages/api/tests/unit/rate-limit.test.ts` — 6 tests covering per-user limit, user isolation, IP fallback, global limit, response format ## Test plan - [x] 11 rapid requests from same user -> 429 on 11th with retryAfter in body - [x] Different users tracked independently - [x] Falls back to IP when no user ID header present - [x] Global limit enforced across all users - [x] Existing webhook rate-limit tests still pass - [x] No new TypeScript errors in changed files
Add per-user and global rate limiting to POST /generate endpoints
Some checks are pending
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run
Details
5cbb53f615 
Rate limiter now supports per-user keying (via X-User-Id header, falling
back to IP) with 10 req/min per user and 100 req/min global cap. The 429
response body includes a retryAfter field with seconds until reset.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat: issue #611 add-rate-limiting-middleware-on-post-api (agent task liancebot611)
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
3304176bbb
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
  • bun.lock
  • package.json
  • packages/api/src/db/schema.ts
  • packages/api/src/index.ts
  • packages/api/src/middleware/csrf.ts
  • packages/api/src/middleware/rate-limit.ts
  • packages/api/src/middleware/security-headers.ts
  • packages/api/src/routes/admin.ts
  • packages/api/src/routes/billing.ts
  • packages/api/src/routes/generate-tos.ts
  • packages/api/src/routes/generate.ts
  • packages/api/src/routes/health.ts
  • packages/api/src/routes/questionnaire.ts
  • packages/api/src/services/document-generator.ts
  • packages/api/src/services/llm.ts
  • packages/api/src/templates/index.ts
  • packages/api/tsconfig.json
  • packages/shared/src/types.ts
  • packages/web/src/app/questionnaire/page.tsx
  • packages/web/src/components/documents/DocumentList.tsx
  • packages/web/src/components/questionnaire/ReviewStep.tsx
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent-task/611:agent-task/611
git switch agent-task/611
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!613
No description provided.