GrottoCenter / grottocenter-api / 25453360432

87%

push

github

refactor(rateLimit): introduce tiered rate limiting by role

Replace the binary skip/limit approach with graduated rate limits:
- Visitors: 200 req/10min (was 100 req/30s)
- Users: 400 req/10min
- Leaders: 1,000 req/10min
- Moderators: 10,000 req/10min
- Administrators: unlimited (skip)

Consolidate userDeleteRateLimit and moderatorDeleteRateLimit into a
single deleteRateLimit middleware with role-based max:
- Users: 1 DELETE/hour
- Leaders/Moderators: 20 DELETEs/hour
- Administrators: unlimited

All limits are overridable via environment variables for production
tuning.

Closes #1157

3019 of 3615 branches covered (83.51%)

Branch coverage included in aggregate %.

33 of 36 new or added lines in 1 file covered. (91.67%)

6252 of 7078 relevant lines covered (88.33%)

53.49 hits per line