karanshukla / kodamachi / 36934409514

100%

push

github

Rate limit anonymous sends per sender and recipient (#524)

* fix(server): rate limit /messages/send per sender and recipient

/messages/send takes no session, so the only limit on it was the global
100 requests a minute per IP. It now also allows 10 sends per IP per
recipient in a 10-minute window, mounted behind the same RATE_LIMIT_MAX
switch so the e2e overlay still disables it.

perIpRateLimiter moves to hono/rate-limits.ts so both limiters share the
client IP lookup.

* Allow 50 sends per recipient per 10 minutes

1068 of 1068 branches covered (100.0%)

Branch coverage included in aggregate %.

20 of 27 new or added lines in 1 file covered. (74.07%)

4623 of 4630 relevant lines covered (99.85%)

62.44 hits per line