From 83171090a0ff9cb9aeca3c1f91edff769076a5a7 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 19:26:29 +0000 Subject: state: limit refused writes per user A write every node would refuse is rolled back by forking the document at the heads before it, under the write lock, at a cost that grows with the document's history. A user could ask for such writes in a loop. Count each user's refused writes over the last minute. Past --refused-writes-per-minute (default 10), its writes are answered 429 without being tried, until the oldest refusal leaves the minute. --- src/api/mod.rs | 1 + 1 file changed, 1 insertion(+) (limited to 'src/api') diff --git a/src/api/mod.rs b/src/api/mod.rs index 43d3c20..0dde808 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -341,6 +341,7 @@ pub(crate) fn store_status(error: StoreError, context: &str) -> ApiError { StoreError::Rejoining => StatusCode::SERVICE_UNAVAILABLE, StoreError::UnknownPolicy(_) => StatusCode::CONFLICT, StoreError::Refused(_) => StatusCode::FORBIDDEN, + StoreError::TooManyRefused => StatusCode::TOO_MANY_REQUESTS, other => { error!(error = %format!("{other:#}"), "{context}"); return StatusCode::INTERNAL_SERVER_ERROR.into(); -- cgit v1.3.1