Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[kimi-task] [enhancement] Add rate limiting middleware for Matrix API endpoints #683

New Issue
Closed
opened 2026-03-21 03:12:14 +00:00 by kimi · 1 comment
kimi commented 2026-03-21 03:12:14 +00:00
Collaborator
Copy Link

Epic: Matrix Unification

Task

Add simple rate limiting to the /api/matrix/* endpoints to prevent abuse when deployed publicly.

Files

  • src/dashboard/middleware/rate_limit.py — NEW: simple in-memory rate limiter
  • src/dashboard/app.py — apply rate limiter to /api/matrix/* routes
  • tests/unit/test_rate_limit.py — NEW: test rate limiting behavior

Acceptance Criteria

  • RateLimiter class with configurable requests_per_minute per IP
  • Default: 30 requests/minute for /api/matrix/* endpoints
  • Returns 429 Too Many Requests when exceeded
  • In-memory (dict), no external dependencies
  • Cleanup of stale entries every 60 seconds
  • tox -e unit passes
  • tox -e lint passes

Context

When the Matrix becomes the public frontend at alexanderwhitestone.com,
the API endpoints need basic DoS protection. This is a simple in-memory rate limiter;
Redis-backed can come later if needed.

## Epic: Matrix Unification ## Task Add simple rate limiting to the /api/matrix/* endpoints to prevent abuse when deployed publicly. ## Files - src/dashboard/middleware/rate_limit.py — NEW: simple in-memory rate limiter - src/dashboard/app.py — apply rate limiter to /api/matrix/* routes - tests/unit/test_rate_limit.py — NEW: test rate limiting behavior ## Acceptance Criteria - [ ] RateLimiter class with configurable requests_per_minute per IP - [ ] Default: 30 requests/minute for /api/matrix/* endpoints - [ ] Returns 429 Too Many Requests when exceeded - [ ] In-memory (dict), no external dependencies - [ ] Cleanup of stale entries every 60 seconds - [ ] tox -e unit passes - [ ] tox -e lint passes ## Context When the Matrix becomes the public frontend at alexanderwhitestone.com, the API endpoints need basic DoS protection. This is a simple in-memory rate limiter; Redis-backed can come later if needed.
kimi self-assigned this 2026-03-21 03:12:14 +00:00
kimi commented 2026-03-21 16:22:58 +00:00
Author
Collaborator
Copy Link

PR created: http://143.198.27.163:3000/rockachopa/Timmy-time-dashboard/pulls/746

Summary of Changes

New Files

  • src/dashboard/middleware/rate_limit.py - RateLimiter class and RateLimitMiddleware
  • tests/unit/test_rate_limit.py - 30 test cases covering all functionality

Modified Files

  • src/dashboard/middleware/__init__.py - Export new rate limiting classes
  • src/dashboard/app.py - Apply middleware to /api/matrix/* routes

Implementation Details

  • RateLimiter class: Tracks requests per IP using deque for O(1) popleft operations
  • Sliding window: 60-second window with automatic cleanup every 60 seconds
  • Proxy support: Respects X-Forwarded-For and X-Real-IP headers
  • 429 Response: Returns proper Retry-After header when rate limited
  • No external dependencies: Pure in-memory implementation

Verification

  • tox -e unit passes (2620 passed, 1 skipped)
  • tox -e lint passes (all checks clean)
  • tox -e pre-push passes (full CI gate)
PR created: http://143.198.27.163:3000/rockachopa/Timmy-time-dashboard/pulls/746 ## Summary of Changes ### New Files - `src/dashboard/middleware/rate_limit.py` - RateLimiter class and RateLimitMiddleware - `tests/unit/test_rate_limit.py` - 30 test cases covering all functionality ### Modified Files - `src/dashboard/middleware/__init__.py` - Export new rate limiting classes - `src/dashboard/app.py` - Apply middleware to `/api/matrix/*` routes ## Implementation Details - **RateLimiter class**: Tracks requests per IP using `deque` for O(1) popleft operations - **Sliding window**: 60-second window with automatic cleanup every 60 seconds - **Proxy support**: Respects `X-Forwarded-For` and `X-Real-IP` headers - **429 Response**: Returns proper `Retry-After` header when rate limited - **No external dependencies**: Pure in-memory implementation ## Verification - `tox -e unit` passes (2620 passed, 1 skipped) - `tox -e lint` passes (all checks clean) - `tox -e pre-push` passes (full CI gate)
kimi closed this issue 2026-03-21 16:23:17 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees kimi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#683
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?