funman300 6e6f3ef1ff feat(server): per-user rate limiting on protected sync endpoints ...

Adds a UserIdKeyExtractor that decodes the Authorization JWT to rate-limit
each user individually (falls back to client IP for unauthenticated
requests). Protected routes now throttle at 10-request burst / 1 token
per 10 s steady-state (6/min), matching the surface attack area of the
1 MB sync/push endpoint.

Also adds an integration test: sync_push_rate_limit_returns_429_on_11th_request.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-12 13:55:07 -07:00

..

server_tests.rs

feat(server): per-user rate limiting on protected sync endpoints

2026-05-12 13:55:07 -07:00