Harden claim API rate limiting #6

Merged

backmeupplz merged 1 commit from codex/bdt-kaneo-9 into main

2026-05-25 19:53:51 +00:00

backmeupplz commented

2026-05-25 19:40:33 +00:00

(Migrated from github.com)

Summary

Move claim API rate limiting into a testable backend module.
Use Bun's remote socket IP by default, with normalized proxy-header parsing only when TRUST_PROXY_HEADERS=true.
Evict expired identities and cap active key storage to prevent unbounded limiter growth.
Document the proxy trust deployment assumption in README and .env.example.

Validation

bun run check
bun run test
bun run build

Manual QA

Manual QA: not required. This is a backend limiter parsing/storage change covered by unit tests and repo-wide type/test/build validation.

## Summary - Move claim API rate limiting into a testable backend module. - Use Bun's remote socket IP by default, with normalized proxy-header parsing only when `TRUST_PROXY_HEADERS=true`. - Evict expired identities and cap active key storage to prevent unbounded limiter growth. - Document the proxy trust deployment assumption in README and `.env.example`. ## Validation - bun run check - bun run test - bun run build ## Manual QA Manual QA: not required. This is a backend limiter parsing/storage change covered by unit tests and repo-wide type/test/build validation.