feat(mist): phase 7 — rate limiting audit for /api/mists/* endpoints
rate_limits.py: - Add MIST_UPDATE_LIMIT = '30/minute' (handle-keyed; content write = new commit) - Add MIST_DELETE_LIMIT = '10/minute' (handle-keyed; destructive, rarely frequent) - Add MIST_READ_LIMIT = '120/minute' (IP-keyed; public reads, anti-scraping guard)
mists.py: - Import MIST_UPDATE_LIMIT, MIST_DELETE_LIMIT, MIST_READ_LIMIT - Add @limiter.limit(MIST_UPDATE_LIMIT, key_func=get_msign_handle) to update_mist - Add @limiter.limit(MIST_DELETE_LIMIT, key_func=get_msign_handle) to delete_mist (also adds request: Request param required by slowapi) - Add @limiter.limit(MIST_READ_LIMIT) to explore_mists, get_mist, list_mist_forks, list_owner_mists, get_mist_embed (adds request: Request param to list_mist_forks which lacked it)
POST /api/mists and POST /api/mists/{id}/fork were already limited.
All 98 mist-domain tests pass (phases 1-7).
0 comments
muse hub commit comment sha256:98670919a6561ac805da53299aa519b05a7729f601350b7f6b3de6362560009b --body "your comment"
No comments yet. Be the first to start the discussion.