archetech / archon / 33913456181

87%

push

github

fix(drawbridge): Rate-limit the public proxy routes, not just /didcomm (#1046)

* fix(drawbridge): Rate-limit the public proxy routes, not just /didcomm

The public passthroughs are unauthenticated by design -- a universal
resolver does not speak L402, a DIDComm sender must reach a stranger's
mailbox, and a name claim proves DID control rather than presenting a
macaroon. The paid path's limiter keys on the macaroon's DID and so
cannot apply to any of them, which left the upstream's own limits as the
only bound. Herald has none, and PUT /names/api/name makes it issue a
credential and consume a name from a namespace that never refills.

Each surface now carries a bucket on the middleware /didcomm already
used: one shared read budget for Herald reads, conformant resolution and
the invoice endpoint; a larger one for the explorer, whose page load is
dozens of asset requests; and a tight write budget for Herald, chosen
per request by method since Herald is fronted by two mounts.

The byte budgets are now optional, so a surface that stores nothing
upstream configures a request count alone.

Closes #979

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GYGMfX3foBcVqP7AQNXjWj

* fix(drawbridge): Stop a refused source from draining the shared budget

A request refused by its per-source bucket was still charged to the
global one, so a single source could be held at its own ceiling and go
on spending the budget that is meant to hold when sources are shared --
denying names, DID resolution and invoices to every other client. The
global bucket is now charged only for requests that reach the upstream.

Half a deposit configuration silently downgraded deposits to the
request-count bucket, switching off the byte budget while looking
configured; the byte budgets, and isDeposit without them, are now
refused at construction.

The route-coverage guard matched only single-quoted app.use/app.get, so
a route added as app.... (continued)

3918 of 4500 branches covered (87.07%)

Branch coverage included in aggregate %.

23 of 23 new or added lines in 1 file covered. (100.0%)

8541 of 8965 relevant lines covered (95.27%)

716.89 hits per line