Skip to content

fix(server): stop rate limiting page and folder reads as writes - #217

Merged
bocan merged 1 commit into
mainfrom
fix/rate-limit-page-reads
Oct 18, 2026
Merged

bocan merged 1 commit into
mainfrom
fix/rate-limit-page-reads

Conversation

@bocan

@bocan bocan commented Oct 18, 2026

Copy link
Copy Markdown
Owner

Problem

When you click around the site, it sometimes shows Failed to load pages from folder: Work.

server/src/index.ts mounted fileOperationLimiter (30 requests per minute) on all of /api/pages and /api/folders. Because of this:

  • Every read (folder list, page open, history, folder tree) used the 30-per-minute write budget.
  • Writes counted two times, because the routes also apply fileOperationLimiter.

Normal browsing got HTTP 429. The client only checks for 401, so it showed a general error.

Fix

Each route now has exactly one limiter:

Route type Limiter Limit
Reads (GET) readLimiter 120/min
Writes (POST/PUT/DELETE) fileOperationLimiter 30/min
  • Removed fileOperationLimiter from the /api/pages and /api/folders mounts.
  • Added readLimiter to GET /api/folders. It was the only route without a route-level limiter.

Testing

  • npm run build (server): passes
  • npm test (server): 106/106 pass
  • ESLint on changed files: clean

The limiters are skipped when NODE_ENV=test, so the tests do not cover the limits. To test by hand: click quickly through more than 30 folders or pages in one minute. You should not see the error.

fileOperationLimiter (30/min) was mounted on all of /api/pages and /api/folders, so every read shared the write budget and writes counted twice. Normal browsing hit 429 and the client showed 'Failed to load pages from folder'. Each route now has one limiter: readLimiter for reads, fileOperationLimiter for writes. GET /api/folders gets readLimiter, as it had no route-level limiter.
@bocan
bocan merged commit f2e16a8 into main Oct 18, 2026
4 checks passed
@bocan
bocan deleted the fix/rate-limit-page-reads branch October 18, 2026 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant