47eb2615ec
- rate-limiting: correct BRouter limit to 300/hour (was 60); add Overpass rate-limit requirement (120/min per IP) - security-hardening: BROUTER_AUTH_TOKEN lives in secrets.app.env, not infra.env - account-management: email-change verification does not re-auth; existing session stays valid - planner-journal-handoff: full rewrite — documents the actual JWT callback architecture (edit-in-planner → POST /api/sessions → callback endpoint), token claims, notes round-trip via GPX <metadata><desc>, session lifecycle - route-drag-reshape: rewrite to describe permanent segment midpoint handles (not proximity hover ghost marker); click-to-insert + waypoint drag model - route-splitting: rewrite to match midpoint handle model; notes geometric midpoint placement (not cursor-snapped) - road-type-coloring: redirect to route-coloring (all requirements already covered there) - osm-tile-overlays: mark profile-aware auto-enable as not yet implemented (profileOverlayDefaults exported but not wired) - osm-poi-overlays: zoom threshold is 10 not 12; user override persistence marked as not yet implemented - shared-packages: add all 7 missing packages (map-core, fit, api, db, jobs, sentry-config, correct map description); document map vs map-core boundary Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
## Purpose
|
|
|
|
Request rate limiting for Planner session creation and BRouter API calls to prevent abuse.
|
|
|
|
## Requirements
|
|
|
|
### Requirement: Session creation rate limit
|
|
The Planner SHALL limit session creation to 10 per IP per hour.
|
|
|
|
#### Scenario: Rate limit exceeded
|
|
- **WHEN** an IP creates more than 10 sessions in one hour
|
|
- **THEN** the server responds with 429 Too Many Requests
|
|
|
|
### Requirement: BRouter call rate limit
|
|
The Planner SHALL limit route computations to 300 per session per hour (the `DEFAULT_MAX_REQUESTS` value in `apps/planner/app/lib/rate-limit.ts`).
|
|
|
|
#### Scenario: Routing rate limit exceeded
|
|
- **WHEN** a session exceeds 300 BRouter calls in one hour
|
|
- **THEN** the server responds with 429 and the client shows a "slow down" message
|
|
|
|
### Requirement: Overpass API rate limit
|
|
The Planner SHALL limit Overpass API calls to 120 per IP per minute to protect the upstream service.
|
|
|
|
#### Scenario: Overpass rate limit exceeded
|
|
- **WHEN** a single IP exceeds 120 Overpass requests in one minute
|
|
- **THEN** the `/api/overpass` proxy responds with 429 Too Many Requests
|