8338d0af1e
fix: remaining bugs.md findings — Repo calls, process dict, CSS, rate limits, Oban, debug route
...
- Extract Repo calls from LiveViews into Agents.get_agent_token_for_org/2
and Accounts.verify_new_totp_device/2 context functions
- Remove Process dictionary usage for cookie consent; use explicit assigns
- Reject url() references in status page custom CSS changeset
- Add per-organization rate limit check alongside per-IP
- Document Oban flush as emergency-only with audit logging
- Gate /admin/headers behind dev_routes (debug endpoint)
2026-05-11 19:34:18 -05:00
e822bc9986
chore: rate_limit rewrite + on-call redesign plan + handoff_notifications_mode
2026-04-28 12:17:29 -05:00
532d88ffb9
perf: disable Req retry for faster error tests
...
- Add retry: false to VISP Client HTTP requests
- Add retry: false to ReleaseChecker GitHub API requests
- Remove unused Plug.Conn import from RemoteIpLogger
- Remove unused default parameter from req_get/2
Results:
- VISP sync test: 7007ms → 113ms (62x faster)
- ReleaseChecker test: 7004ms → 17ms (402x faster)
- UserResetPasswordLive test: 1495ms → 284ms (5x faster)
Req's default retry behavior (1s, 2s, 4s exponential backoff) was
causing 7-second delays for HTTP 500/503 error responses in tests.
For these clients, immediate failure is preferred over retries.
2026-03-10 16:19:31 -05:00
8f52d87854
feat: add rate limiting to admin endpoints (100 req/min)
...
- Add :admin type to RateLimit plug with 100 requests per minute per IP
- Apply rate limiting to all /admin routes (LiveView and controller actions)
- Protects superuser endpoints from abuse and brute force attempts
- Aligns with existing auth (10 req/min) and API (1000 req/min) limits
2026-03-05 14:11:19 -06:00
d431931cfe
update hammer
2026-02-08 10:08:31 -06:00
02833d0b44
Add rate limiting to auth and API endpoints using Hammer
2026-02-01 14:59:54 -06:00
