trails/openspec/specs/rate-limiting/spec.md at 47eb2615ec39cda83bb1d8521a085cf49ee8551b

Ullrich Schäfer 47eb2615ec

Fix high-severity spec drift across 10 specs

- rate-limiting: correct BRouter limit to 300/hour (was 60); add Overpass
  rate-limit requirement (120/min per IP)
- security-hardening: BROUTER_AUTH_TOKEN lives in secrets.app.env, not infra.env
- account-management: email-change verification does not re-auth; existing
  session stays valid
- planner-journal-handoff: full rewrite — documents the actual JWT callback
  architecture (edit-in-planner → POST /api/sessions → callback endpoint),
  token claims, notes round-trip via GPX <metadata><desc>, session lifecycle
- route-drag-reshape: rewrite to describe permanent segment midpoint handles
  (not proximity hover ghost marker); click-to-insert + waypoint drag model
- route-splitting: rewrite to match midpoint handle model; notes geometric
  midpoint placement (not cursor-snapped)
- road-type-coloring: redirect to route-coloring (all requirements already
  covered there)
- osm-tile-overlays: mark profile-aware auto-enable as not yet implemented
  (profileOverlayDefaults exported but not wired)
- osm-poi-overlays: zoom threshold is 10 not 12; user override persistence
  marked as not yet implemented
- shared-packages: add all 7 missing packages (map-core, fit, api, db, jobs,
  sentry-config, correct map description); document map vs map-core boundary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-24 11:07:03 +02:00

1.1 KiB

Raw Blame History

Purpose

Request rate limiting for Planner session creation and BRouter API calls to prevent abuse.

Requirements

Requirement: Session creation rate limit

The Planner SHALL limit session creation to 10 per IP per hour.

Scenario: Rate limit exceeded

WHEN an IP creates more than 10 sessions in one hour
THEN the server responds with 429 Too Many Requests

Requirement: BRouter call rate limit

The Planner SHALL limit route computations to 300 per session per hour (the DEFAULT_MAX_REQUESTS value in apps/planner/app/lib/rate-limit.ts).

Scenario: Routing rate limit exceeded

WHEN a session exceeds 300 BRouter calls in one hour
THEN the server responds with 429 and the client shows a "slow down" message

Requirement: Overpass API rate limit

The Planner SHALL limit Overpass API calls to 120 per IP per minute to protect the upstream service.

Scenario: Overpass rate limit exceeded

WHEN a single IP exceeds 120 Overpass requests in one minute
THEN the /api/overpass proxy responds with 429 Too Many Requests

1.1 KiB Raw Blame History