GitHub/outline
1
0
Fork 0
mirror of https://github.com/outline/outline.git synced 2026-08-03 13:27:25 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore: Tighten rate limits on document mutations (#13142)

Browse Source
This commit is contained in:
Tom Moor
2026-07-26 08:18:01 -04:00
committed by GitHub
parent 9d066c2a92
commit 22cb3f1baf
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routes/api/documents/documents.ts
+10
View File
@@ -982,6 +982,7 @@ router.post(
router.post(
"documents.restore",
auth({ role: UserRole.Member }),
rateLimiter(RateLimiterStrategy.OneHundredPerMinute),
validate(T.DocumentsRestoreSchema),
transaction(),
async (ctx: APIContext<T.DocumentsRestoreReq>) => {
@@ -1326,6 +1327,7 @@ router.post(
router.post(
"documents.duplicate",
auth(),
rateLimiter(RateLimiterStrategy.TwentyFivePerMinute),
validate(T.DocumentsDuplicateSchema),
transaction(),
async (ctx: APIContext<T.DocumentsDuplicateReq>) => {
@@ -1384,6 +1386,7 @@ router.post(
router.post(
"documents.move",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerMinute),
validate(T.DocumentsMoveSchema),
transaction(),
async (ctx: APIContext<T.DocumentsMoveReq>) => {
@@ -1439,6 +1442,7 @@ router.post(
router.post(
"documents.archive",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerMinute),
validate(T.DocumentsArchiveSchema),
transaction(),
async (ctx: APIContext<T.DocumentsArchiveReq>) => {
@@ -1465,6 +1469,7 @@ router.post(
router.post(
"documents.delete",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerMinute),
validate(T.DocumentsDeleteSchema),
transaction(),
async (ctx: APIContext<T.DocumentsDeleteReq>) => {
@@ -1509,6 +1514,7 @@ router.post(
router.post(
"documents.unpublish",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerMinute),
validate(T.DocumentsUnpublishSchema),
transaction(),
async (ctx: APIContext<T.DocumentsUnpublishReq>) => {
@@ -1793,6 +1799,7 @@ router.post(
router.post(
"documents.remove_user",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerHour),
validate(T.DocumentsRemoveUserSchema),
transaction(),
async (ctx: APIContext<T.DocumentsRemoveUserReq>) => {
@@ -1838,6 +1845,7 @@ router.post(
router.post(
"documents.add_group",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerHour),
validate(T.DocumentsAddGroupSchema),
transaction(),
async (ctx: APIContext<T.DocumentsAddGroupsReq>) => {
@@ -1898,6 +1906,7 @@ router.post(
router.post(
"documents.remove_group",
auth(),
rateLimiter(RateLimiterStrategy.OneHundredPerHour),
validate(T.DocumentsRemoveGroupSchema),
transaction(),
async (ctx: APIContext<T.DocumentsRemoveGroupReq>) => {
@@ -2064,6 +2073,7 @@ router.post(
router.post(
"documents.empty_trash",
auth({ role: UserRole.Admin }),
rateLimiter(RateLimiterStrategy.TenPerHour),
async (ctx: APIContext) => {
const { user } = ctx.state.auth;