merge: Bump develop version (!789)

View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/789

packages/backend/src/core/entities/NoteEntityService.ts

@@ -160,8 +160,8 @@ export class NoteEntityService implements OnModuleInit {
 			packedNote.reactionAcceptance = null;
 			packedNote.reactionAndUserPairCache = undefined;
 			packedNote.reactionCount = 0;
-			packedNote.reactionEmojis = undefined;
-			packedNote.reactions = undefined;
+			packedNote.reactionEmojis = {};
+			packedNote.reactions = {};
 			packedNote.isHidden = true;
 		}
 	}

packages/backend/src/server/FileServerService.ts

@@ -31,6 +31,7 @@ import { handleRequestRedirectToOmitSearch } from '@/misc/fastify-hook-handlers.
 import { RateLimiterService } from '@/server/api/RateLimiterService.js';
 import { getIpHash } from '@/misc/get-ip-hash.js';
 import { AuthenticateService } from '@/server/api/AuthenticateService.js';
+import type { IEndpointMeta } from '@/server/api/endpoints.js';
 import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions } from 'fastify';
 import type Limiter from 'ratelimiter';
 
@@ -82,7 +83,7 @@ export class FileServerService {
 			});
 
 			fastify.get<{ Params: { key: string; } }>('/files/:key', async (request, reply) => {
-				if (!await this.checkRateLimit(request, reply, `/files/${request.params.key}`)) return;
+				if (!await this.checkRateLimit(request, reply, '/files/', request.params.key)) return;
 
 				return await this.sendDriveFile(request, reply)
 					.catch(err => this.errorHandler(request, reply, err));
@@ -109,7 +110,7 @@ export class FileServerService {
 			keyUrl.username = '';
 			keyUrl.password = '';
 
-			if (!await this.checkRateLimit(request, reply, `/proxy/${keyUrl}`)) return;
+			if (!await this.checkRateLimit(request, reply, '/proxy/', keyUrl.href)) return;
 
 			return await this.proxyHandler(request, reply)
 				.catch(err => this.errorHandler(request, reply, err));
@@ -603,7 +604,8 @@ export class FileServerService {
 			Params?: Record<string, unknown> | unknown,
 		}>,
 		reply: FastifyReply,
-		rateLimitKey: string,
+		group: string,
+		resource: string,
 	): Promise<boolean> {
 		const body = request.method === 'GET'
 			? request.query
@@ -622,32 +624,48 @@ export class FileServerService {
 		const [user] = await this.authenticateService.authenticate(token);
 		const actor = user?.id ?? getIpHash(request.ip);
 
+		// Call both limits: the per-resource limit and the shared cross-resource limit
+		return await this.checkResourceLimit(reply, actor, group, resource) && await this.checkSharedLimit(reply, actor, group);
+	}
+
+	private async checkResourceLimit(reply: FastifyReply, actor: string, group: string, resource: string): Promise<boolean> {
 		const limit = {
 			// Group by resource
-			key: rateLimitKey,
+			key: `${group}${resource}`,
 
 			// Maximum of 10 requests / 10 minutes
 			max: 10,
 			duration: 1000 * 60 * 10,
-
-			// Minimum of 250 ms between each request
-			minInterval: 250,
 		};
 
-		// Rate limit proxy requests
+		return await this.checkLimit(reply, actor, limit);
+	}
+
+	private async checkSharedLimit(reply: FastifyReply, actor: string, group: string): Promise<boolean> {
+		const limit = {
+			key: group,
+
+			// Maximum of 3600 requests per hour, which is an average of 1 per second.
+			max: 3600,
+			duration: 1000 * 60 * 60,
+		};
+
+		return await this.checkLimit(reply, actor, limit);
+	}
+
+	private async checkLimit(reply: FastifyReply, actor: string, limit: IEndpointMeta['limit'] & { key: NonNullable<string> }): Promise<boolean> {
 		try {
 			await this.rateLimiterService.limit(limit, actor);
 			return true;
 		} catch (err) {
 			// errはLimiter.LimiterInfoであることが期待される
-			reply.code(429);
-
 			if (hasRateLimitInfo(err)) {
 				const cooldownInSeconds = Math.ceil((err.info.resetMs - Date.now()) / 1000);
 				// もしかするとマイナスになる可能性がなくはないのでマイナスだったら0にしておく
 				reply.header('Retry-After', Math.max(cooldownInSeconds, 0).toString(10));
 			}
 
+			reply.code(429);
 			reply.send({
 				message: 'Rate limit exceeded. Please try again later.',
 				code: 'RATE_LIMIT_EXCEEDED',

packages/backend/src/server/api/ApiCallService.ts

@@ -311,7 +311,15 @@ export class ApiCallService implements OnApplicationShutdown {
 			throw new ApiError(accessDenied);
 		}
 
-		if (ep.meta.limit) {
+		// For endpoints without a limit, the default is 10 calls per second
+		const endpointLimit: IEndpointMeta['limit'] = ep.meta.limit ?? {
+			duration: 1000,
+			max: 10,
+		};
+
+		// We don't need this check, but removing it would cause a big merge conflict.
+		// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+		if (endpointLimit) {
 			// koa will automatically load the `X-Forwarded-For` header if `proxy: true` is configured in the app.
 			let limitActor: string;
 			if (user) {
@@ -320,7 +328,7 @@ export class ApiCallService implements OnApplicationShutdown {
 				limitActor = getIpHash(request.ip);
 			}
 
-			const limit = Object.assign({}, ep.meta.limit);
+			const limit = Object.assign({}, endpointLimit);
 
 			if (limit.key == null) {
 				(limit as any).key = ep.name;

packages/backend/src/server/api/endpoints/announcements.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Announcement',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/announcements/show.ts

@@ -27,6 +27,12 @@ export const meta = {
 			id: 'b57b5e1d-4f49-404a-9edb-46b00268f121',
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/create.ts

@@ -47,6 +47,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/delete.ts

@@ -24,6 +24,12 @@ export const meta = {
 			id: 'b34dcf9d-348f-44bb-99d0-6c9314cfe2df',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/list.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Antenna',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/notes.ts

@@ -41,6 +41,12 @@ export const meta = {
 			ref: 'Note',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/update.ts

@@ -45,6 +45,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/app/create.ts

@@ -22,6 +22,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'App',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/app/show.ts

@@ -26,6 +26,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'App',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/accept.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '9c72d8de-391a-43c1-9d06-08d29efde8df',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/generate.ts

@@ -40,6 +40,12 @@ export const meta = {
 			id: '92f93e63-428e-4f2f-a5a4-39e1407fe998',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/show.ts

@@ -43,6 +43,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/userkey.ts

@@ -51,6 +51,12 @@ export const meta = {
 			id: '8c8a4145-02cc-4cca-8e66-29ba60445a8e',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/blocking/list.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Blocking',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/bubble-game/ranking.ts

@@ -40,6 +40,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/favorite.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '4938f5f3-6167-4c04-9149-6607b7542861',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/featured.ts

@@ -23,6 +23,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/follow.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: 'c0031718-d573-4e85-928e-10039f1fbb68',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/followed.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/my-favorites.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/owned.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/search.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/show.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: '6f6c314b-7486-4897-8966-c04a66a02923',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/timeline.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: '4d0eeeba-a02c-4c3c-9966-ef60d38d2e7f',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/unfavorite.ts

@@ -25,6 +25,12 @@ export const meta = {
 			id: '353c68dd-131a-476c-aa99-88a345e83668',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/unfollow.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '19959ee9-0153-4c51-bbd9-a98c49dc59d6',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/update.ts

@@ -10,6 +10,7 @@ import { ChannelEntityService } from '@/core/entities/ChannelEntityService.js';
 import { DI } from '@/di-symbols.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['channels'],
@@ -43,6 +44,11 @@ export const meta = {
 			id: 'e86c14a4-0da2-4032-8df3-e737a04c7f3b',
 		},
 	},
+
+	limit: {
+		duration: ms('1hour'),
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/active-users.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/ap-request.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/drive.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/federation.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/instance.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/notes.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/drive.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/following.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/notes.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/pv.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/reactions.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/users.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/add-note.ts

@@ -18,9 +18,10 @@ export const meta = {
 
 	kind: 'write:account',
 
+	// 60 calls per hour
 	limit: {
 		duration: ms('1hour'),
-		max: 20,
+		max: 60,
 	},
 
 	errors: {

packages/backend/src/server/api/endpoints/clips/create.ts

@@ -32,6 +32,12 @@ export const meta = {
 			id: '920f7c2d-6208-4b76-8082-e632020f5883',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/delete.ts

@@ -22,6 +22,12 @@ export const meta = {
 			id: '70ca08ba-6865-4630-b6fb-8494759aa754',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/favorite.ts

@@ -32,6 +32,12 @@ export const meta = {
 			id: '92658936-c625-4273-8326-2d790129256e',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/list.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Clip',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/my-favorites.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Clip',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/notes.ts

@@ -35,6 +35,12 @@ export const meta = {
 			ref: 'Note',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/remove-note.ts

@@ -30,6 +30,12 @@ export const meta = {
 			id: 'aff017de-190e-434b-893e-33a9ff5049d8',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Clip',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/unfavorite.ts

@@ -31,6 +31,12 @@ export const meta = {
 			id: '90c3a9e8-b321-4dae-bf57-2bf79bbcc187',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/update.ts

@@ -31,6 +31,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Clip',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive.ts

@@ -29,6 +29,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files.ts

@@ -28,6 +28,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/attached-notes.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: 'c118ece3-2e4b-4296-99d1-51756e32d232',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/check-existence.ts

@@ -21,6 +21,12 @@ export const meta = {
 		type: 'boolean',
 		optional: false, nullable: false,
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/delete.ts

@@ -11,6 +11,7 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -34,6 +35,12 @@ export const meta = {
 			id: '5eb8d909-2540-4970-90b8-dd6f86088121',
 		},
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/find-by-hash.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/find.ts

@@ -28,6 +28,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/show.ts

@@ -40,6 +40,12 @@ export const meta = {
 			id: '25b73c73-68b1-41d0-bad1-381cfdf6579f',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/update.ts

@@ -11,6 +11,7 @@ import { RoleService } from '@/core/RoleService.js';
 import { DriveService } from '@/core/DriveService.js';
 import type { Config } from '@/config.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -63,6 +64,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'DriveFile',
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'DriveFolder',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/delete.ts

@@ -9,6 +9,7 @@ import type { DriveFoldersRepository, DriveFilesRepository } from '@/models/_.js
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -30,6 +31,12 @@ export const meta = {
 			id: 'b0fc8a17-963c-405d-bfbc-859a487295e1',
 		},
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/find.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'DriveFolder',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 			id: 'd74ab9eb-bb09-4bba-bf24-fb58f761e1e9',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/update.ts

@@ -10,6 +10,7 @@ import { DriveFolderEntityService } from '@/core/entities/DriveFolderEntityServi
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -43,6 +44,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'DriveFolder',
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/stream.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/email-address/available.ts

@@ -26,6 +26,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/emoji.ts

@@ -22,6 +22,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'EmojiDetailed',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/emojis.ts

@@ -32,6 +32,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/endpoint.ts

@@ -28,6 +28,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/endpoints.ts

@@ -26,6 +26,12 @@ export const meta = {
 			'...',
 		],
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/followers.ts

@@ -22,6 +22,12 @@ export const meta = {
 			ref: 'Following',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/following.ts

@@ -22,6 +22,12 @@ export const meta = {
 			ref: 'Following',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/instances.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'FederationInstance',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/show-instance.ts

@@ -20,6 +20,12 @@ export const meta = {
 		optional: false, nullable: true,
 		ref: 'FederationInstance',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/stats.ts

@@ -50,6 +50,12 @@ export const meta = {
 			otherFollowingCount: { type: 'number' },
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/update-remote-user.ts

@@ -12,6 +12,12 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/users.ts

@@ -24,6 +24,12 @@ export const meta = {
 			ref: 'UserDetailedNotMe',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/fetch-rss.ts

@@ -203,6 +203,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 20 calls per 10 seconds
+	limit: {
+		duration: 1000 * 10,
+		max: 20,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/delete.ts

@@ -10,6 +10,7 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['flashs'],
@@ -31,6 +32,11 @@ export const meta = {
 			id: '1036ad7b-9f92-4fff-89c3-0e50dc941704',
 		},
 	},
+
+	limit: {
+		duration: ms('1hour'),
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/featured.ts

@@ -23,6 +23,12 @@ export const meta = {
 			ref: 'Flash',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/like.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: '010065cf-ad43-40df-8067-abff9f4686e3',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/my-likes.ts

@@ -36,6 +36,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/my.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Flash',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/show.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: 'f0d34a1a-d29a-401d-90ba-1982122b5630',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/unlike.ts

@@ -31,6 +31,12 @@ export const meta = {
 			id: '755f25a7-9871-4f65-9f34-51eaad9ae0ac',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/accept.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: 'bcde4f8b-0913-4614-8881-614e522fb041',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/cancel.ts

@@ -37,6 +37,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'UserLite',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/list.ts

@@ -42,6 +42,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/reject.ts

@@ -23,6 +23,12 @@ export const meta = {
 			id: 'abc2ffa6-25b2-4380-ba99-321ff3a94555',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/sent.ts

@@ -42,6 +42,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/featured.ts

@@ -24,6 +24,12 @@ export const meta = {
 			ref: 'GalleryPost',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/popular.ts

@@ -23,6 +23,12 @@ export const meta = {
 			ref: 'GalleryPost',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/posts.ts

@@ -22,6 +22,12 @@ export const meta = {
 			ref: 'GalleryPost',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/posts/delete.ts

@@ -10,6 +10,7 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['gallery'],
@@ -31,6 +32,11 @@ export const meta = {
 			id: 'c86e09de-1c48-43ac-a435-1c7e42ed4496',
 		},
 	},
+
+	limit: {
+		duration: ms('1hour'),
+		max: 300,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/posts/like.ts

@@ -39,6 +39,12 @@ export const meta = {
 			id: '40e9ed56-a59c-473a-bf3f-f289c54fb5a7',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/gallery/posts/show.ts

@@ -28,6 +28,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'GalleryPost',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {