Skip to content

feat: Add user-scoped rate limiting with separate tiers for authenticated/unauthenticated users#926

Open
ykargeee-bit wants to merge 5 commits into
rinafcode:mainfrom
ykargeee-bit:feat/rateLimit
Open

feat: Add user-scoped rate limiting with separate tiers for authenticated/unauthenticated users#926
ykargeee-bit wants to merge 5 commits into
rinafcode:mainfrom
ykargeee-bit:feat/rateLimit

Conversation

@ykargeee-bit

Copy link
Copy Markdown

Closes #851

  • Add UNAUTHENTICATED tier with stricter rate limits (5/min, 30/hr, 100/day)
  • Use user:{id} as rate-limit key for authenticated requests
  • Fall back to ip:{address} for unauthenticated requests
  • Add comprehensive tests verifying key generation and quota separation
  • Ensure users on same IP have independent rate limits
  • Update logging terminology for consistency"

Closes #852

Implement comprehensive worker health monitoring system:
- Redis heartbeat tracking for all workers with 2x threshold TTL
- 60s scheduled stall detector that checks Redis heartbeats
- Emit 'worker.stalled' event when a worker exceeds stall threshold (default 300s)
- Add Prometheus counter 'worker_restarts_total{worker_name}' for restart tracking
- Graceful worker restart that maintains pool size and proper ConfigService injection
- Align all worker constructors to require ConfigService as first parameter
- Meets acceptance criteria: stalled workers restart within 2x threshold window
…ated/unauthenticated users

>> - Add UNAUTHENTICATED tier with stricter rate limits (5/min, 30/hr, 100/day)
>> - Use user:{id} as rate-limit key for authenticated requests
>> - Fall back to ip:{address} for unauthenticated requests
>> - Add comprehensive tests verifying key generation and quota separation
>> - Ensure users on same IP have independent rate limits
>> - Update logging terminology for consistency"
@drips-wave

drips-wave Bot commented Jun 28, 2026

Copy link
Copy Markdown

@ykargeee-bit Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add request body size limit enforcement to prevent memory exhaustion Add rate limiting scoped by authenticated user ID in addition to IP address

1 participant