john-okeefe
1a769783dc
Phase 2 Week 6: Device Authentication & Rate Limiting
Implement per-device authentication with rate limiting and permissions.
Device Rate Limiter (device_rate_limiter.go):
- DeviceRateLimiter: Track requests per device and request type
- CheckRateLimit: Verify device hasn't exceeded limits
- GetRemainingRequests: Return remaining request quota
- Reset: Clear rate limit data for specific device
- cleanupOldEntries: Remove stale entries automatically
- Request Types: sync, progress, metadata
- Rate Limits:
* Sync requests: 60/minute
* Progress updates: 120/minute (page turns)
* Metadata requests: 30/minute
Device Auth Middleware Updates:
- Add rateLimiter to DeviceAuthMiddleware
- Check rate limits during authentication
- Return 429 Too Many Requests when limits exceeded
- Set rate limit headers:
* X-RateLimit-Limit: Request limit
* X-RateLimit-Remaining: Quota remaining
* X-RateLimit-Reset: Reset time
- getRequestType: Determine request type from URL path
Request Type Detection:
- /progress endpoints → progress type (120/min)
- /metadata, /library endpoints → metadata type (30/min)
- All other sync endpoints → sync type (60/min)
Benefits:
- Prevent device abuse and DoS attacks
- Fair resource allocation across devices
- Higher limits for frequent operations (page turns)
- Lower limits for expensive operations (metadata)
- Automatic cleanup of stale data
- Per-device isolation (one device can't affect others)
Integration with Device Auth:
- Rate limit check happens after token validation
- Before processing actual sync request
- Returns standard HTTP 429 with retry info
- Works seamlessly with existing device middleware
Device revocation still available via:
- DELETE /api/devices/:id endpoint
- Sets auth_token to NULL
- Disables sync_enabled flag
2026-01-30 16:47:29 -05:00
..
2026-01-30 16:45:10 -05:00
2026-01-30 16:45:10 -05:00
2026-01-30 16:45:10 -05:00
2026-01-30 16:47:29 -05:00
2026-01-30 13:51:52 -05:00
2026-01-30 16:13:10 -05:00
2026-01-30 13:52:01 -05:00