Skip to content

Feature/add rate limts on reports#541

Merged
greatest0fallt1me merged 2 commits into
Predictify-org:mainfrom
Horlarmmy:feature/add-rate-limts-on-reports
Jul 26, 2026
Merged

Feature/add rate limts on reports#541
greatest0fallt1me merged 2 commits into
Predictify-org:mainfrom
Horlarmmy:feature/add-rate-limts-on-reports

Conversation

@Horlarmmy

Copy link
Copy Markdown
Contributor

Summary

Adds a per-user token-bucket rate limiter to `/api/reports` with 429 + `Retry-After` response. GrantFox FWC26 campaign (Stellar Wave).

Changes

New files

  • `src/routes/reports.ts` — Parent router with `requireAuth` + token-bucket rate limiting (60 tokens, 60s refill)
  • `tests/tokenBucketRateLimit.test.ts` — 12 unit tests for token bucket middleware
  • `tests/reportsRouter.test.ts` — 4 integration tests for parent router
  • `docs/reports-rate-limiting.md` — Full API documentation

Modified files

  • `src/routes/reports/scheduled.ts` — Removed rate limiter (now inherited from parent)
  • `src/index.ts` — Mount reportsRouter at `/api/reports`
  • `tests/scheduledReports.test.ts` — Updated for new structure

Rate limiting

  • Algorithm: Token bucket (burst-friendly)
  • Capacity: 60 tokens/user, linear refill over 60s
  • Headers: `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, `Retry-After`
  • 429 response: Standard error envelope with `rate_limit_exceeded` code
  • Audit trail: Every block logged via `createAuditLog`

Testing

  • 16 new tests, all passing
  • 0 new failures in existing test suite
  • Lint passes cleanly

Closes #499

Add a parent /api/reports router that applies per-user token-bucket rate
limiting (60 tokens, 60s refill) and requireAuth to all sub-routes.
Move rate limiting out of scheduled.ts to the parent level so future
report sub-routes inherit throttling automatically.

- Create src/routes/reports.ts parent router with factory pattern
- Remove rate limiter and requireAuth from src/routes/reports/scheduled.ts
- Update src/index.ts to mount reportsRouter at /api/reports
- Add 12 unit tests for createPerUserTokenBucketLimiter
- Add 4 integration tests for the parent reports router
- Update scheduledReports.test.ts to work without requireAuth
- Add docs/reports-rate-limiting.md with full API documentation

Closes Predictify-org#499
@drips-wave

drips-wave Bot commented Jul 26, 2026

Copy link
Copy Markdown

@Horlarmmy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@greatest0fallt1me

Copy link
Copy Markdown
Contributor

Merged via direct push to main (admin)

@greatest0fallt1me
greatest0fallt1me merged commit 1c73b32 into Predictify-org:main Jul 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add rate limit on /api/reports

2 participants