fix(auth): rate limit profile updates by aadityakumarsah · Pull Request #313 · modelence/modelence

aadityakumarsah · 2026-07-18T09:30:26Z

Summary

add per-user limits for profile updates (30 per 15 minutes; 200 per day)
expose auth.rateLimits.updateProfile for configuration overrides
validate profile updates and handle availability before consuming the quota
add coverage for defaults, overrides, validation failures, and successful updates

This branch was rebuilt from current main and contains only the profile-update rate-limit change.

Testing

npm run lint:check
npm run build
npm test

Note

Low Risk
Scoped to profile update mutation with conservative defaults; quota is not consumed on validation failures, limiting user impact.

Overview
Adds per-user rate limiting on profile updates so abusive or automated updateProfile traffic is capped like other auth actions.

Default limits are 30 updates per 15 minutes and 200 per day per user, registered on the auth module’s rate-limit rules. Apps can tune them via auth.rateLimits.updateProfile using the same override/merge behavior as other auth buckets.

handleUpdateProfile now calls consumeRateLimit with bucket updateProfile only when there is a non-empty update to persist—after field validation, the optional validateProfileUpdate hook, and handle uniqueness checks—so invalid or rejected requests do not burn quota. Tests cover defaults, overrides, and when the limit is (not) consumed.

^{Reviewed by Cursor Bugbot for commit 1af3bfb. Bugbot is set up for automated code reviews on this repo. Configure here.}

AtulYadav25 · 2026-07-19T08:25:00Z

 }

-export async function handleUpdateProfile(props: Args, { user }: Context) {
+export async function handleUpdateProfile(props: Args, { user, connectionInfo }: Context) {


Unused connectionInfo

AtulYadav25 · 2026-07-19T08:26:08Z

  });
 }

+import { consumeRateLimit } from '../rate-limit/rules';


Please move the import statement to the top, follow clean code

AtulYadav25 · 2026-07-19T08:26:32Z


-export async function createGuestUser() {
-  // TODO: add rate-limiting and captcha handling
+import { Context } from '../methods/types';


Please move import statement to the top

omegascorp · 2026-07-22T11:57:20Z

@aadityakumarsah why do we need a rate limit on sessionInit? This basically means that when a lot of users visit from the same IP, it will start blocking them. Example of a false positive failure: a large company is using a product built on Modelence, and hundreds of users are visiting from the same corporate IP

aadityakumarsah · 2026-07-22T12:59:03Z

@omegascorp You are right. sessionInit is the wrong place for an IP-based rate limit: clients behind corporate/carrier NATs could be blocked, and the session is already created before the handler runs, so it does not reliably cap session creation. I removed the sessionInit limiter and its configuration while resolving the branch conflicts. The remaining profile-update limit is keyed by authenticated user ID, not IP.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e1d197e. Configure here.}

omegascorp · 2026-07-22T13:30:58Z

@aadityakumarsah this branch seems to have the same issue as the other branches - it has unrelated changes

AtulYadav25 reviewed Jul 19, 2026

View reviewed changes