mirror of
https://github.com/documenso/documenso.git
synced 2026-06-22 04:12:06 +10:00
Lucas Smith
653ab3678a
Replace hono-rate-limiter with a Prisma/PostgreSQL bucketed counter approach that works correctly across multiple instances without sticky sessions. - Add RateLimit model with composite PK (key, action, bucket) and atomic upsert - Create rate limit factory with window parsing, bucket computation, and fail-open - Define auth-tier and API-tier rate limit instances - Add Hono middleware, rateLimitResponse helper, and tRPC assertRateLimit helper - Wire rate limit headers through AppError constructor (was declared but never assigned) - Apply rate limits to auth routes (email-password, passkey), tRPC routes (2FA email, link org account), API routes, and file upload endpoints - Add cleanup cron job for expired rate limit rows (batched delete every 15 min) - Remove hono-rate-limiter dependency
14 lines
394 B
SQL
14 lines
394 B
SQL
-- CreateTable
|
|
CREATE TABLE "RateLimit" (
|
|
"key" TEXT NOT NULL,
|
|
"action" TEXT NOT NULL,
|
|
"bucket" TIMESTAMP(3) NOT NULL,
|
|
"count" INTEGER NOT NULL DEFAULT 1,
|
|
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
|
|
CONSTRAINT "RateLimit_pkey" PRIMARY KEY ("key","action","bucket")
|
|
);
|
|
|
|
-- CreateIndex
|
|
CREATE INDEX "RateLimit_createdAt_idx" ON "RateLimit"("createdAt");
|