boba/LoVisual
1
0
Fork 0
Code Issues Pull requests Releases 1 Wiki Activity Actions

fix: CI workflow, password reset flow, health/limits in services, session refactor, dead mixin stub cleanup

Browse source
This commit is contained in:
loki5512344 2026-10-09 19:21:17 +02:00
parent 45dd592c40
commit f4e15b45c9
Signed by: boba
GPG key ID: 253067914055423B
95 changed files with 899 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

21
backend/gateway/src/rate_limit/rules.rs
View file

@ -46,6 +46,20 @@ pub fn rules() -> Vec<Rule> {
vec![
rule(Method::POST, "/auth/login", Quota::per_minute(n(5)), Ip),
rule(Method::POST, "/auth/register", Quota::per_hour(n(3)), Ip),
// Same threat as register: each accepted request sends an email, so
// the mailer must not be usable as a spam cannon.
rule(
Method::POST,
"/auth/forgot-password",
Quota::per_hour(n(3)),
Ip,
),
rule(
Method::POST,
"/auth/reset-password",
Quota::per_minute(n(10)),
Ip,
),
rule(Method::POST, "/auth/refresh", Quota::per_minute(n(30)), Ip),
rule(Method::POST, "/device/code", Quota::per_minute(n(10)), Ip),
// The mod polls every 2–3 s for up to 10 min: 10/min would break linking.
@ -61,7 +75,12 @@ pub fn rules() -> Vec<Rule> {
rule(Method::POST, "/avatars", Quota::per_hour(n(5)), Account),
rule(Method::GET, "/showcase*", Quota::per_minute(n(60)), Ip),
// The mod syncs menu presence about 3 times a second while a menu is open.
rule(Method::POST, "/presence/*", Quota::per_second(n(6)), Account),
rule(
Method::POST,
"/presence/*",
Quota::per_second(n(6)),
Account,
),
]
}