[kimi] Add rate limiting middleware for Matrix API endpoints (#683) #746

kimi · 2026-03-21T16:22:45Z

kimi commented

2026-03-21 16:22:45 +00:00

Fixes #683

Summary

Added simple in-memory rate limiting to the /api/matrix/* endpoints to prevent abuse when deployed publicly.

Changes

New Files

src/dashboard/middleware/rate_limit.py - RateLimiter class and RateLimitMiddleware
tests/unit/test_rate_limit.py - Comprehensive test coverage

Modified Files

src/dashboard/middleware/__init__.py - Export new rate limiting classes
src/dashboard/app.py - Apply middleware to /api/matrix/* routes

Features

RateLimiter class with configurable requests_per_minute per IP (default: 30)
Returns 429 Too Many Requests when limit exceeded with Retry-After header
In-memory storage using deque for efficient timestamp tracking
Automatic cleanup of stale entries every 60 seconds
Respects X-Forwarded-For and X-Real-IP headers for proxied requests
Applied only to /api/matrix/* endpoints via path prefix matching

Testing

All existing tests pass (2620 passed, 1 skipped)
New tests cover:
- Rate limiting per IP (independent limits)
- Window sliding behavior
- Cleanup of stale entries
- IP extraction from various headers
- Middleware path matching
- 429 response when rate limited

Acceptance Criteria

RateLimiter class with configurable requests_per_minute per IP
Default: 30 requests/minute for /api/matrix/* endpoints
Returns 429 Too Many Requests when exceeded
In-memory (dict), no external dependencies
Cleanup of stale entries every 60 seconds
tox -e unit passes
tox -e lint passes

Fixes #683 ## Summary Added simple in-memory rate limiting to the `/api/matrix/*` endpoints to prevent abuse when deployed publicly. ## Changes ### New Files - `src/dashboard/middleware/rate_limit.py` - RateLimiter class and RateLimitMiddleware - `tests/unit/test_rate_limit.py` - Comprehensive test coverage ### Modified Files - `src/dashboard/middleware/__init__.py` - Export new rate limiting classes - `src/dashboard/app.py` - Apply middleware to `/api/matrix/*` routes ## Features - **RateLimiter class** with configurable `requests_per_minute` per IP (default: 30) - Returns **429 Too Many Requests** when limit exceeded with `Retry-After` header - **In-memory storage** using `deque` for efficient timestamp tracking - **Automatic cleanup** of stale entries every 60 seconds - Respects `X-Forwarded-For` and `X-Real-IP` headers for proxied requests - Applied only to `/api/matrix/*` endpoints via path prefix matching ## Testing - All existing tests pass (2620 passed, 1 skipped) - New tests cover: - Rate limiting per IP (independent limits) - Window sliding behavior - Cleanup of stale entries - IP extraction from various headers - Middleware path matching - 429 response when rate limited ## Acceptance Criteria - [x] RateLimiter class with configurable requests_per_minute per IP - [x] Default: 30 requests/minute for /api/matrix/* endpoints - [x] Returns 429 Too Many Requests when exceeded - [x] In-memory (dict), no external dependencies - [x] Cleanup of stale entries every 60 seconds - [x] tox -e unit passes - [x] tox -e lint passes

kimi added 1 commit 2026-03-21 16:22:45 +00:00

feat: add rate limiting middleware for Matrix API endpoints

Tests / lint (pull_request) Has been cancelled

Details

Tests / test (pull_request) Has been cancelled

Details

56720da82f

Add RateLimiter class and RateLimitMiddleware for in-memory rate limiting
of /api/matrix/* endpoints with the following features:

- Configurable requests_per_minute per IP (default: 30)
- Returns 429 Too Many Requests when exceeded with Retry-After header
- In-memory storage using deque for efficient timestamp tracking
- Automatic cleanup of stale entries every 60 seconds
- Respects X-Forwarded-For and X-Real-IP headers for proxied requests

Files added/modified:
- src/dashboard/middleware/rate_limit.py (new)
- src/dashboard/middleware/__init__.py (export new classes)
- src/dashboard/app.py (apply middleware to /api/matrix/* routes)
- tests/unit/test_rate_limit.py (comprehensive tests)

Fixes #683

kimi referenced this pull request

2026-03-21 16:22:58 +00:00

[kimi-task] [enhancement] Add rate limiting middleware for Matrix API endpoints #683

kimi merged commit dc9f0c04eb into main

2026-03-21 16:23:17 +00:00

kimi deleted branch kimi/issue-683

2026-03-21 16:23:17 +00:00

kimi referenced this issue from a commit

2026-03-21 16:23:17 +00:00

[kimi] Add rate limiting middleware for Matrix API endpoints (#683) (#746)

Sign in to join this conversation.