mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
9ccd309dbc
New leads/v1 sebuf service with two POST RPCs:
- SubmitContact → /api/leads/v1/submit-contact
- RegisterInterest → /api/leads/v1/register-interest
Handler logic ported 1:1 from api/contact.js + api/register-interest.js:
- Turnstile verification (desktop sources bypass, preserved)
- Honeypot (website field) silently accepts without upstream calls
- Free-email-domain gate on SubmitContact (422 ApiError)
- validateEmail (disposable/offensive/typo-TLD/MX) on RegisterInterest
- Convex writes via ConvexHttpClient (contactMessages:submit, registerInterest:register)
- Resend notification + confirmation emails (HTML templates unchanged)
Shared helpers moved to server/_shared/:
- turnstile.ts (getClientIp + verifyTurnstile)
- email-validation.ts (disposable/offensive/MX checks)
Rate limits preserved via ENDPOINT_RATE_POLICIES:
- submit-contact: 3/hour per IP (was in-memory 3/hr)
- register-interest: 5/hour per IP (was in-memory 5/hr; desktop
sources previously capped at 2/hr via shared in-memory map —
now 5/hr like everyone else, accepting the small regression in
exchange for Upstash-backed global limiting)
Callers updated:
- pro-test/src/App.tsx contact form → new submit-contact path
- src-tauri/sidecar/local-api-server.mjs cloud-fallback rewrites
/api/register-interest → /api/leads/v1/register-interest when
proxying; keeps local path for older desktop builds
- src/services/runtime.ts isKeyFreeApiTarget allows both old and
new paths through the WORLDMONITOR_API_KEY-optional gate
Tests:
- tests/contact-handler.test.mjs rewritten to call submitContact
handler directly; asserts on ValidationError / ApiError
- tests/email-validation.test.mjs + tests/turnstile.test.mjs
point at the new server/_shared/ modules
Deleted: api/contact.js, api/register-interest.js, api/_ip-rate-limit.js,
api/_turnstile.js, api/_email-validation.js, api/_turnstile.test.mjs.
Manifest entries removed (58 → 56). Docs updated (api-platform,
api-commerce, usage-rate-limits).
Verified: npm run typecheck + typecheck:api + lint:api-contract
(88 files / 56 entries) + lint:boundaries pass; full test:data
(5852 tests) passes; make generate is zero-diff.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
79 lines
2.8 KiB
Plaintext
79 lines
2.8 KiB
Plaintext
---
|
|
title: "Rate Limits"
|
|
description: "Per-endpoint, per-key, and per-IP rate limits across the WorldMonitor API surface."
|
|
---
|
|
|
|
Rate limits are enforced at the Vercel Edge runtime using Upstash Redis sliding-window counters. All limits are **sliding 60-second windows** unless noted.
|
|
|
|
## Default public API rate limit
|
|
|
|
| Scope | Limit | Window |
|
|
|-------|-------|--------|
|
|
| Per IP (default) | **600 requests** | 60 s |
|
|
|
|
Applies to all `/api/*` routes that don't have a stricter override. Implemented by `api/_rate-limit.js` / `api/_ip-rate-limit.js`.
|
|
|
|
## MCP server
|
|
|
|
| Scope | Limit | Window |
|
|
|-------|-------|--------|
|
|
| Per API key (MCP tools) | **60 requests** | 60 s |
|
|
|
|
See [MCP](/mcp) for details.
|
|
|
|
## OAuth endpoints
|
|
|
|
| Endpoint | Limit | Window | Scope |
|
|
|----------|-------|--------|-------|
|
|
| `POST /api/oauth/register` | 5 | 60 s | Per IP |
|
|
| `GET /api/oauth/authorize` | 10 | 60 s | Per IP |
|
|
| `POST /api/oauth/token` | 10 | 60 s | Per IP |
|
|
|
|
Matches the implementations in `api/oauth/{register,authorize,token}.js`.
|
|
|
|
Exceeding any of these during the OAuth flow will cause the MCP client to fail the connection handshake — wait 60 s and retry.
|
|
|
|
## Write endpoints
|
|
|
|
| Endpoint | Limit | Window | Scope |
|
|
|----------|-------|--------|-------|
|
|
| `POST /api/scenario/v1/run` | 10 | 60 s | Per user |
|
|
| `POST /api/scenario/v1/run` (queue depth) | 100 in-flight | — | Global |
|
|
| `POST /api/leads/v1/register-interest` | 5 | 60 min | Per IP + Turnstile (desktop sources bypass Turnstile) |
|
|
| `POST /api/leads/v1/submit-contact` | 3 | 60 min | Per IP + Turnstile |
|
|
|
|
Other write endpoints (`/api/brief/share-url`, `/api/notification-channels`, `/api/create-checkout`, `/api/customer-portal`, etc.) fall back to the default per-IP limit above.
|
|
|
|
## Bootstrap / health
|
|
|
|
These are cached aggressively and have no custom limit beyond the default:
|
|
|
|
- `GET /api/bootstrap` — `s-maxage=30`
|
|
- `GET /api/health` — `s-maxage=15`
|
|
- `GET /api/version` — `s-maxage=60`
|
|
|
|
## Response when limited
|
|
|
|
HTTP 429 with:
|
|
|
|
```
|
|
Retry-After: <seconds>
|
|
Content-Type: application/json
|
|
|
|
{ "error": "Rate limit exceeded" }
|
|
```
|
|
|
|
## Retry guidance
|
|
|
|
- Respect `Retry-After`. Don't pound on a 429.
|
|
- For batch work, pace yourself: at 600 req/min/IP the default gives you ~10 req/s headroom.
|
|
- For MCP, 60/min is generous for conversational use but tight for scripted batch fetches — prefer the REST API for batch.
|
|
- Spurious 429s often mean you're sharing an egress IP (corporate proxy, CI runner). Contact support for a per-key limit bump if needed.
|
|
|
|
## Hard caps (not soft limits)
|
|
|
|
- Webhook callback URLs must be HTTPS (except localhost).
|
|
- `api/download` file sizes capped at ~50 MB per request.
|
|
- `POST /api/scenario/v1/run` globally pauses new jobs when the pending queue exceeds **100** — returns 429 with `Retry-After: 30`.
|
|
- `api/v2/shipping/webhooks` TTL is **30 days** — re-register to extend.
|