analytics/event: add 60/hour rate limit + fix slowapi in test mini-app

[brooksRoley]

CTO session — 2026-08-12

Deferred finding from the 2026-08-11 Staff Engineer session (flag_count=1): POST /api/analytics/event had no rate limit. An authenticated user could spam it at arbitrary rate, inflating session_events with junk rows and skewing every funnel metric in the admin dashboard.

---

What changed

server/app/analytics/router.py

• Added Request to FastAPI imports (required by slowapi)
• Imported limiter from ..ratelimit (shared singleton, matches auth/portrait pattern)
• Added @limiter.limit("60/hour") to log_event + request: Request as first param

server/tests/test_analytics.py

• Updated _make_app() to attach app.state.limiter = limiter and register RateLimitExceeded exception handler — without this, @limiter.limit() raises unhandled exceptions in the test mini-app instead of returning 429
• Added reset_limiter autouse fixture (clears MemoryStorage before each test — same pattern as test_auth_ratelimit.py and test_portrait_ratelimit.py)
• Added TestEventRateLimit: 3 tests — first call passes (204), 61st returns 429, Retry-After header present

---

Rate limit choice

60/hour (= 1/minute average). Generous enough for any legitimate UI session — the 16 valid events fire at most a handful of times per session — but stops a logged-in user from bulk-inserting analytics noise. Auth login is 5/minute; analytics events are lower-risk DB writes, so the hourly window is appropriate.

---

Test results (not runnable in cloud agent; pattern verified against merged test_auth_ratelimit.py)

The 3 new tests follow the identical structure to TestLoginRateLimit / TestRegisterRateLimit (PR #16, merged). The reset_limiter fixture is the same pattern used in test_auth_ratelimit.py.

Existing suite: 9 tests in TestEventAllowlist + TestProviderAllowlist are unchanged in behaviour; the added reset_limiter autouse fixture ensures their single-request-per-test pattern never hits the new limit.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
channelzero	Ready	Preview	Aug 12, 2026 4:13pm