stephen/apartment-dashboard-api
1
0
Fork 0
Code Issues 1 Pull Requests Actions Releases Wiki Activity

SCRAPE-22: Implement rate limiting for trigger endpoint #26

Merged
stephen merged 1 commits from scraper/rate-limit into dev 2026-02-06 23:17:57 -07:00
Conversation 0 Commits 1 Files Changed 2 +241
stephen commented 2026-02-06 23:16:16 -07:00
Owner
Copy Link

Add per-user rate limiting to POST /api/admin/scraper/run (5 req/hr per admin). Returns 429 with Retry-After header when exceeded. In-memory tracking via Map keyed by user ID. Rate limit checked before mutex. Scheduled runs not counted. 6 new tests, 87 total scraperRoutes tests passing.

Add per-user rate limiting to POST /api/admin/scraper/run (5 req/hr per admin). Returns 429 with Retry-After header when exceeded. In-memory tracking via Map keyed by user ID. Rate limit checked before mutex. Scheduled runs not counted. 6 new tests, 87 total scraperRoutes tests passing.
stephen added 1 commit 2026-02-06 23:16:16 -07:00
Add per-user rate limiting to scraper trigger endpoint
All checks were successful
CI/CD Pipeline - Apartment API / Lint & Test (pull_request) Successful in 43s
Details
CI/CD Pipeline - Apartment API / Send Webhook Notification (pull_request) Successful in 2s
Details
CI/CD Pipeline - Apartment API / Build & Push Image (pull_request) Has been skipped
Details
CI/CD Pipeline - Apartment API / Deploy to Production (pull_request) Has been skipped
Details
CI/CD Pipeline - Apartment API / Scan Dependencies (pull_request) Successful in 13s
Details
a05c844b93 
Implement rate limiting for POST /api/admin/scraper/run with a cap of
5 requests per hour per admin user. When exceeded, the endpoint returns
429 Too Many Requests with a Retry-After header indicating seconds
until the window resets.

Rate limit tracking uses an in-memory Map keyed by user ID. The check
runs before the mutex check so rate-limited users get a 429 rather
than a misleading 409 conflict. Scheduled/cron-triggered runs are not
counted against any user's limit.

Adds 6 new tests covering: allow up to 5 requests, reject 6th with
429, Retry-After header presence, per-user isolation, window expiry
reset, and rate-limit-before-mutex ordering.
stephen merged commit e654d59fea into dev 2026-02-06 23:17:57 -07:00
stephen deleted branch scraper/rate-limit 2026-02-06 23:17:57 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
stephen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: stephen/apartment-dashboard-api#26
No description provided.
Delete Branch "scraper/rate-limit"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?