Key the application notice per-user limit on the canonical user id
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- Half a day
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- postgresql, typescript
- Domain
- authentication, security
Research direction
Start with the applicationNoticeUserLimiter key generator in src/middleware/applicationNoticeRateLimit.ts, where the raw req.body.userId is used as the bucket key. Compare it with the user lookup that resolves the canonical user.id to see where case normalization fits. Done when case variants of one UUID share a bucket and the limiter store choice is documented or made configurable for multi-instance deployments.
Written by the indexing model from the issue text.
Description
Problem
applicationNoticeUserLimiter in src/middleware/applicationNoticeRateLimit.ts keys on the raw req.body.userId. z.uuid() accepts upper-case UUIDs and the Postgres lookup is case-insensitive, so case variants of one id get separate buckets, up to the per-client cap. Both notice limiters use the in-memory store, so each additional API instance multiplies the limits.
Fix
- key on
userId.toLowerCase(), or on the resolveduser.idafter lookup - use the shared rate-limit store when more than one instance runs
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 11h 40m
- Merged PRs (30d)
- 104
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from fells-code/seamless-auth-api
-
easy P2 v0.23
Difficulty 4/5 Over a week Newbie friendliness 8/100
fells-code/seamless-auth-api#561 ·
Maintainers usually reply within 1 day
-
epic P1 security v0.23
Difficulty 5/5 Over a week Newbie friendliness 8/100
fells-code/seamless-auth-api#558 ·
Maintainers usually reply within 1 day
-
epic P2 v0.23
Difficulty 5/5 Over a week Newbie friendliness 5/100
fells-code/seamless-auth-api#551 ·
Maintainers usually reply within 1 day
-
P2 secure v2.1
Difficulty 5/5 Over a week Newbie friendliness 25/100
fells-code/seamless-auth-api#512 ·
Maintainers usually reply within 1 day
-
P3 secure v1.0
Difficulty 3/5 1-2 days Newbie friendliness 55/100
fells-code/seamless-auth-api#439 ·
Maintainers usually reply within 1 day
All issues in fells-code/seamless-auth-api
Similar issues
-
desktop v3 windows
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
esengine/DeepSeek-Reasonix#15016 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
readest/readest#7413 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement good first issue priority: medium size: XS
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
content triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
eliasstravik/herdr-projects#788 ·