MOPC/MOPC-Portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(finale): ceremony-day rate-limit bucket — venue NAT would 429 audience polling

Browse Source 
Requests consisting only of cheap public ceremony reads (+ token-gated vote
casts) get a 6000/min per-IP budget instead of 100/min. Vote integrity is
enforced by the token + AudienceFavoriteVote IP cap, not the rate limiter.
Found live: big-screen polling hit 429 within minutes in verification.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt
2026-06-10 18:45:15 +02:00
parent f7fdfdec9b
commit 160333c2f9
3 changed files with 80 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/app/api/trpc/[trpc]/route.ts
View File

@@ -1,7 +1,7 @@
import { fetchRequestHandler } from '@trpc/server/adapters/fetch'
import { appRouter } from '@/server/routers/_app'
import { createContext } from '@/server/context'
import { checkRateLimit } from '@/lib/rate-limit'
import { checkRateLimit, isCeremonyTraffic } from '@/lib/rate-limit'
// Allow long-running operations (AI filtering, bulk imports)
// This affects Next.js serverless functions; for self-hosted, Nginx timeout also matters
@@ -9,6 +9,9 @@ export const maxDuration = 300 // 5 minutes
const RATE_LIMIT = 100 // requests per window
const RATE_WINDOW_MS = 60 * 1000 // 1 minute
// Ceremony-day polling: whole venues share one IP (NAT) and every screen
// polls a few cheap public reads — see CEREMONY_PROCEDURES in lib/rate-limit.
const CEREMONY_RATE_LIMIT = 6000
function getClientIp(req: Request): string {
return (
@@ -20,7 +23,10 @@ function getClientIp(req: Request): string {
const handler = (req: Request) => {
const ip = getClientIp(req)
const { success, remaining, resetAt } = checkRateLimit(`trpc:${ip}`, RATE_LIMIT, RATE_WINDOW_MS)
const ceremony = isCeremonyTraffic(new URL(req.url).pathname)
const { success, remaining, resetAt } = ceremony
? checkRateLimit(`trpc-ceremony:${ip}`, CEREMONY_RATE_LIMIT, RATE_WINDOW_MS)
: checkRateLimit(`trpc:${ip}`, RATE_LIMIT, RATE_WINDOW_MS)
if (!success) {
return new Response(JSON.stringify({ error: 'Too many requests' }), {

33
src/lib/rate-limit.ts
View File

@@ -46,6 +46,39 @@ export function checkRateLimit(
return { success: true, remaining: limit - entry.count, resetAt: entry.resetAt }
}
/**
* Ceremony-day procedures: cheap, read-mostly public endpoints polled by every
* screen in the venue. Hundreds of phones share one IP behind the venue NAT,
* so the standard 100/min-per-IP budget would 429 the audience mid-vote.
* Requests consisting ONLY of these procedures get a separate, much larger
* per-IP bucket. Vote integrity is enforced server-side (token + IP cap on
* AudienceFavoriteVote), not by the rate limiter.
*/
const CEREMONY_PROCEDURES = new Set([
'liveVoting.getCeremonyState',
'liveVoting.getAudienceWindow',
'liveVoting.getAudienceContextByRound',
'liveVoting.registerAudienceVoter',
'liveVoting.castFavoriteVote',
'liveVoting.getSessionForVotingByRound',
'liveVoting.getPublicResults',
'liveVoting.getAudienceSession',
'liveVoting.getSessionForVoting',
'live.getCursor',
'live.getMyNotes',
'live.saveNote',
'live.getMyCeremonyContext',
])
/** True when every (possibly batched) procedure in the tRPC URL is ceremony traffic. */
export function isCeremonyTraffic(pathname: string): boolean {
const path = pathname.replace(/^\/api\/trpc\/?/, '')
if (!path) return false
return path
.split(',')
.every((p) => CEREMONY_PROCEDURES.has(decodeURIComponent(p)))
}
// Clean up stale entries every 5 minutes to prevent memory leaks
if (typeof setInterval !== 'undefined') {
setInterval(() => {