From 671db5a01ea4131b8d38e0912d2ed5e12fb39170 Mon Sep 17 00:00:00 2001 From: Trezy Date: Mon, 11 May 2026 15:44:25 -0500 Subject: [PATCH] fix: require client key for rate limiting on all XRPC routes Signed-off-by: Trezy --- src/xrpc/mod.rs | 28 ++-------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/src/xrpc/mod.rs b/src/xrpc/mod.rs index ddf24b9..0cdbeb9 100644 --- a/src/xrpc/mod.rs +++ b/src/xrpc/mod.rs @@ -260,19 +260,7 @@ pub async fn xrpc_get( let mut params = parse_query_params(&raw_query); let claims = xrpc_claims.identity; - // Space credential Bearer requests bypass the client-key requirement; - // rate-limit by the credential's sub DID instead. - let rate_key = if claims.is_none() { - if let Some(ref token) = xrpc_claims.space_credential { - crate::spaces::credential::peek_credential_sub(token).ok_or_else(|| { - AppError::Auth("invalid space credential: unable to extract sub".into()) - })? - } else { - resolve_client_key(&state, None, &parts, ¶ms)? - } - } else { - resolve_client_key(&state, claims.as_ref(), &parts, ¶ms)? - }; + let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, ¶ms)?; let lexicon = state.lexicons.get(&method).await; @@ -364,19 +352,7 @@ pub async fn xrpc_post( // Space credential Bearer requests bypass the client-key requirement; // rate-limit by the credential's sub DID instead. - let rate_key = if claims.is_none() { - if let Some(ref token) = xrpc_claims.space_credential { - crate::spaces::credential::peek_credential_sub(token).ok_or_else(|| { - AppError::Auth("invalid space credential: unable to extract sub".into()) - })? - } else { - return Err(AppError::Auth( - "XRPC procedures require DPoP authentication".into(), - )); - } - } else { - resolve_client_key(&state, claims.as_ref(), &parts, ¶ms)? - }; + let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, ¶ms)?; let lexicon = state.lexicons.get(&method).await; -- 2.51.2