fix(rate-limiter): show correct rate limit points in debug output

commit: 5be4effdfa9f1a1480736a3d0e2e77dd61f53041
author: bnema · 9mo ago · 2026-01-18 16:38 UTC
parent: fb2f48e
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +17 -6

M src/lib/api/rate-limiter.ts +17 -6


@@ -71,6 +71,18 @@ function getEndpointType(pathname: string, isPublic: boolean): keyof typeof RATE
71	71		return 'protected';
72	72		}
73	73
	74	+	function getRateLimitPoints(
	75	+	endpointType: keyof typeof RATE_LIMITS,
	76	+	isAuthenticated: boolean
	77	+	): number {
	78	+	if (endpointType === 'sse') {
	79	+	return isAuthenticated
	80	+	? RATE_LIMITS.sse.authenticated.points
	81	+	: RATE_LIMITS.sse.unauthenticated.points;
	82	+	}
	83	+	return RATE_LIMITS[endpointType].points;
	84	+	}
	85	+
74	86		function isRateLimited(
75	87		ip: string,
76	88		endpointType: keyof typeof RATE_LIMITS,

@@ -176,9 +188,7 @@ export async function handleRateLimit(event: RequestEvent): Promise<Response \| n
176	188		hasUser: Boolean(event.locals.user),
177	189		hasSession: Boolean(event.locals.session),
178	190		endpointType,
179		-	rateLimitPoints: isAuthenticated
180		-	? RATE_LIMITS.sse.authenticated.points
181		-	: RATE_LIMITS.sse.unauthenticated.points
	191	+	rateLimitPoints: getRateLimitPoints(endpointType, isAuthenticated)
182	192		};
183	193		}
184	194

@@ -193,9 +203,10 @@ export async function handleRateLimit(event: RequestEvent): Promise<Response \| n
193	203		headers['X-Debug-Has-User'] = Boolean(event.locals.user).toString();
194	204		headers['X-Debug-Has-Session'] = Boolean(event.locals.session).toString();
195	205		headers['X-Debug-Endpoint-Type'] = endpointType;
196		-	headers['X-Debug-Rate-Limit-Points'] = isAuthenticated
197		-	? RATE_LIMITS.sse.authenticated.points.toString()
198		-	: RATE_LIMITS.sse.unauthenticated.points.toString();
	206	+	headers['X-Debug-Rate-Limit-Points'] = getRateLimitPoints(
	207	+	endpointType,
	208	+	isAuthenticated
	209	+	).toString();
199	210		}
200	211
201	212		return new Response(JSON.stringify(responseBody), {

 	return 'protected';
 }
+function getRateLimitPoints(
+	endpointType: keyof typeof RATE_LIMITS,
+	isAuthenticated: boolean
+): number {
+	if (endpointType === 'sse') {
+		return isAuthenticated
+			? RATE_LIMITS.sse.authenticated.points
+			: RATE_LIMITS.sse.unauthenticated.points;
+	}
+	return RATE_LIMITS[endpointType].points;
+}
 function isRateLimited(
 	ip: string,
 	endpointType: keyof typeof RATE_LIMITS,
 				hasUser: Boolean(event.locals.user),
 				hasSession: Boolean(event.locals.session),
 				endpointType,
-				rateLimitPoints: isAuthenticated
+				rateLimitPoints: getRateLimitPoints(endpointType, isAuthenticated)
-					? RATE_LIMITS.sse.authenticated.points
-					: RATE_LIMITS.sse.unauthenticated.points
 			};
 		}
 			headers['X-Debug-Has-User'] = Boolean(event.locals.user).toString();
 			headers['X-Debug-Has-Session'] = Boolean(event.locals.session).toString();
 			headers['X-Debug-Endpoint-Type'] = endpointType;
-			headers['X-Debug-Rate-Limit-Points'] = isAuthenticated
+			headers['X-Debug-Rate-Limit-Points'] = getRateLimitPoints(
-				? RATE_LIMITS.sse.authenticated.points.toString()
+				endpointType,
-				: RATE_LIMITS.sse.unauthenticated.points.toString();
+				isAuthenticated
+			).toString();
 		}
 		return new Response(JSON.stringify(responseBody), {