From 83171090a0ff9cb9aeca3c1f91edff769076a5a7 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 19:26:29 +0000 Subject: state: limit refused writes per user A write every node would refuse is rolled back by forking the document at the heads before it, under the write lock, at a cost that grows with the document's history. A user could ask for such writes in a loop. Count each user's refused writes over the last minute. Past --refused-writes-per-minute (default 10), its writes are answered 429 without being tried, until the oldest refusal leaves the minute. --- docs/access.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 782724a..9d38bd5 100644 --- a/docs/access.md +++ b/docs/access.md @@ -266,7 +266,10 @@ stays as it is, wherever it comes from later (a joining node catching up, say). A node judges each change it makes the same way before it leaves, its own writes and those through the API alike: one every node would refuse is rolled back, never -written, and the request refused (`403`, saying why). So a write the API's checks let +written, and the request refused (`403`, saying why). A rollback costs a copy of the +document, so a user with more than ten such writes within a minute +(`--refused-writes-per-minute`) has its writes answered `429`, untried, until the +oldest leave the minute. So a write the API's checks let through (they look at the path asked for, the rules at everything the change does) can't cut its node off. -- cgit v1.3.1