Rate limit register and unregister

[juanfradb]

Summary

• add a dedicated per-IP limiter for /api/register and /api/unregister
• keep the register/unregister bucket separate from /api/notify
• add cleanup for the new keyed limiter
• update route tests and docs for the new rate-limit behavior

Security validation

Source/sink/control: unauthenticated /api/register and /api/unregister could be called repeatedly from one client IP and churn or grow the in-memory TokenStore without an HTTP rate limit. Both routes now share a per-IP limiter with 120/min and burst 100, while /api/health, /api/info, and /api/status remain unwrapped.

Original issue no longer reproduces:

• 100 /api/register requests from one IP produces 429

• 100 /api/unregister requests from one IP produces 429

• /api/health, /api/info, and /api/status still do not 429 under tested bursts

Refs #7

Tests

• cargo test rate_limited_after_hundred -- --nocapture
• cargo test other_endpoints_not_rate_limited_under_burst -- --nocapture
• cargo test health_endpoint_not_rate_limited_1000_burst -- --nocapture
• cargo test
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• git diff --check

Summary by CodeRabbit

• New Features

  • Added per-IP rate limiting for /api/register and /api/unregister (120 requests/minute, burst 100), returning HTTP 429 with retry guidance when limits are exceeded.
  • Rate-limited requests may return HTTP 500 when the client IP cannot be determined.

• Documentation

  • API reference updated to describe rate limiting across registration, unregistration, and notification endpoints.
  • Architecture and configuration documentation now detail endpoint-specific limits and middleware behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a362f1bd-81b4-4b78-87e8-9d0d6e6345a7

📥 Commits

Reviewing files that changed from the base of the PR and between 3671b48 and e2766de.

📒 Files selected for processing (1)

• CLAUDE.md

---

Walkthrough

This PR adds a separate per-IP limiter for /api/register and /api/unregister. The limiter uses 120 requests per minute with a burst of 100. Actix middleware, production wiring, test support, tests, and documentation now cover the new behavior.

Changes

Register Endpoint Rate Limiting

Layer / File(s)	Summary
Rate Limiter Type & Configuration src/api/rate_limit.rs	Adds RegisterIpLimiter and the REGISTER_IP_RATE_PER_MIN and REGISTER_IP_BURST constants.
Middleware Implementation src/api/rate_limit.rs	Extracts the client IP, checks the register limiter, returns 429 on rejection, and returns 500 on wiring or extraction failure.
Server Initialization & Cleanup src/main.rs	Creates the register limiter, configures cleanup, logs its settings, and registers it in Actix application state.
Test Infrastructure & Quota src/api/test_support.rs	Adds the register test quota and wires the limiter into test components and applications.
Route Middleware Wiring src/api/routes.rs	Applies the register middleware to /api/register and /api/unregister.
Rate Limiting Test Cases src/api/routes.rs	Verifies 429 responses after burst exhaustion for both endpoints.
Existing Test Updates - IP Header Addition src/api/routes.rs	Adds Fly-Client-IP to register and unregister test requests.
Structural Test Comments & Whitelist Matrix src/api/routes.rs	Updates structural test assumptions and supplies the register limiter in the whitelist matrix.
API & Configuration Documentation docs/api.md, docs/architecture.md, docs/configuration.md, CLAUDE.md	Documents limiter scope, response codes, middleware wiring, and fail-closed behavior.

Estimated code review effort: 3 (Moderate) | ~22 minutes

Poem

A rabbit checks each register gate,
With tokens counted at a steady rate.
Register and notify now part ways,
Clear limits guide their traffic days.
A burst is spent, then 429 sings.
The limiter keeps its separate springs. 🐰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding rate limiting to the /api/register and /api/unregister endpoints, which is the primary focus of the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[AndreaDiazCorreia]

Nice work, the implementation looks solid and covers the acceptance criteria from #7. Just one thing before merging: could you update CLAUDE.md to mention that /api/register and /api/unregister can now return 429 with the shared rate_limited_response body? Same style as the 403 whitelist exception that's already documented there. The absolute upper bound on TokenStore from the issue is a different threat model (botnet/multi-IP), so probably better as a separate follow-up. Otherwise LGTM.

[AndreaDiazCorreia]

@juanfradb Are you still working on this?

[AndreaDiazCorreia]

Keeping this one open. Unlike the other four in the batch, there is no code blocker here: the implementation is correct, it merges cleanly on current main, and the full test suite passes. The only item left is documentation — CLAUDE.md constraint 3 declares the /api/register and /api/unregister bodies byte-identical to the pre-1.1 fixtures, and this PR introduces two new response shapes on those endpoints: the 429 with the shared rate_limited_response body, and the 500 fail-closed path when the per-IP key cannot be extracted. I will land that note on our side so this can merge without further work from you.

[AndreaDiazCorreia]

ack