From abd9e3daf3ff8333ecdaa5ec6318fc61cd6ed67c Mon Sep 17 00:00:00 2001 From: Trezy Date: Mon, 11 May 2026 15:51:50 -0500 Subject: [PATCH] fix: rate-limit unauthenticated procedure requests before rejecting Signed-off-by: Trezy --- src/xrpc/mod.rs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/xrpc/mod.rs b/src/xrpc/mod.rs index 0cdbeb9..200a21c 100644 --- a/src/xrpc/mod.rs +++ b/src/xrpc/mod.rs @@ -350,10 +350,14 @@ pub async fn xrpc_post( let mut params = parse_query_params(&raw_query); let claims = xrpc_claims.identity; - // Space credential Bearer requests bypass the client-key requirement; - // rate-limit by the credential's sub DID instead. let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, ¶ms)?; + if claims.is_none() && xrpc_claims.space_credential.is_none() { + return Err(AppError::Auth( + "XRPC procedures require DPoP authentication".into(), + )); + } + let lexicon = state.lexicons.get(&method).await; // Determine token cost: per-NSID override → type default → 1 -- 2.51.2