decentraland / profile-images / 31802451387

89%

push

github

feat: externalize rate limit configuration (#165)

* feat: per-pointer rate limiting to throttle repeated renders

Adds a 300-second per-pointer rate limit that caps how often any wallet
can trigger a re-render, regardless of visual changes. Rate-limited
messages are left in the SQS queue for redelivery rather than deleted,
so legitimate updates are deferred, not discarded. This closes the gap
where the existing dedup only catches stale entity timestamps — the
attacker bypasses it by deploying unique entity IDs with minimal visual
differences (~1,500/min). A new `pointer_rate_limited_count` metric
tracks suppression volume.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: prune window uses max of dedup and rate-limit windows, remove unused type member

Use Math.max(DEFAULT_POINTER_DEDUP_WINDOW_SECONDS, DEFAULT_POINTER_RATE_LIMIT_SECONDS)
for pruning so entries aren't removed before the rate-limit window expires if
the constants diverge. Remove unused 'pointer_rate_limited' from ValidationError
type to fix Prettier lint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add message_validation_result_total metric with result labels

Replace pointer_rate_limited_count with message_validation_result_total
counter labeled by result (valid, rate_limited, stale_pointer, stale_in_batch,
undefined_body, invalid_json, invalid_entity_type). Gives full visibility
into every validation outcome for Grafana dashboarding.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: read rate limit configuration from environment variables

Remove hardcoded rate limit constants and read POINTER_DEDUP_WINDOW_SECONDS
and POINTER_RATE_LIMIT_SECONDS from config at startup. Actual values are
set in the service definition (private repo).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: format rate limit config test

* fix: provide test rate limit config

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

234 of 288 branches covered (81.25%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 2 files covered. (100.0%)

591 of 636 relevant lines covered (92.92%)

25.81 hits per line