security: add rate limiting to admin action endpoints #20

Merged

Charon merged 1 commit from security/rate-limit-admin-actions into main

2026-02-20 12:10:48 +00:00

Clotho commented

2026-02-20 11:30:21 +00:00

Member

Summary

Add HasRateLimiting trait providing reusable per-user rate limiting for Livewire component methods
Apply rate limits to all sensitive mutation and export methods in PlatformUser, Settings, and WaitlistManager
Add comprehensive Pest tests for rate limit enforcement, per-user scoping, user feedback, and window reset

Rate Limits

Action	Limit	Components
Tier changes, verification	10/min per admin	PlatformUser
Entitlement provisioning/revocation	10/min per admin	PlatformUser
Profile updates	20/min per user	Settings
Password changes	5/min per user	Settings
Data exports (JSON, CSV)	5/min per admin	PlatformUser, WaitlistManager
Deletions/anonymisation	3/min per admin	PlatformUser, Settings
Waitlist mutations (invite, delete)	10/min per admin	WaitlistManager

Implementation

Uses Laravel's RateLimiter::attempt() at the Livewire component method level via a reusable trait. This approach:

Scopes limits per authenticated user ID
Provides user-friendly feedback (seconds until retry) via actionMessage/actionType or session()->flash()
Allows Settings to override with Flux::toast() for consistent UX
Keeps rate limit logic co-located with the protected actions

Test Plan

Rate limit enforcement (blocks after threshold)
Per-user scoping (users don't affect each other)
Separate limits per action type
User feedback with retry countdown
Session flash fallback for components without actionMessage
Rate limit reset after window expiry
PHP lint passes on all modified files

Closes #12

🤖 Generated with Claude Code

## Summary - Add `HasRateLimiting` trait providing reusable per-user rate limiting for Livewire component methods - Apply rate limits to all sensitive mutation and export methods in `PlatformUser`, `Settings`, and `WaitlistManager` - Add comprehensive Pest tests for rate limit enforcement, per-user scoping, user feedback, and window reset ## Rate Limits | Action | Limit | Components | |--------|-------|------------| | Tier changes, verification | 10/min per admin | PlatformUser | | Entitlement provisioning/revocation | 10/min per admin | PlatformUser | | Profile updates | 20/min per user | Settings | | Password changes | 5/min per user | Settings | | Data exports (JSON, CSV) | 5/min per admin | PlatformUser, WaitlistManager | | Deletions/anonymisation | 3/min per admin | PlatformUser, Settings | | Waitlist mutations (invite, delete) | 10/min per admin | WaitlistManager | ## Implementation Uses Laravel's `RateLimiter::attempt()` at the Livewire component method level via a reusable trait. This approach: - Scopes limits per authenticated user ID - Provides user-friendly feedback (seconds until retry) via `actionMessage`/`actionType` or `session()->flash()` - Allows `Settings` to override with `Flux::toast()` for consistent UX - Keeps rate limit logic co-located with the protected actions ## Test Plan - [x] Rate limit enforcement (blocks after threshold) - [x] Per-user scoping (users don't affect each other) - [x] Separate limits per action type - [x] User feedback with retry countdown - [x] Session flash fallback for components without actionMessage - [x] Rate limit reset after window expiry - [x] PHP lint passes on all modified files Closes #12 🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Clotho added 1 commit 2026-02-20 11:30:21 +00:00

security: add rate limiting to admin action endpoints (#12 )

CI / PHP 8.3 (pull_request) Failing after 27s

Details

CI / PHP 8.2 (pull_request) Failing after 30s

Details

CI / Assets (pull_request) Failing after 1s

Details

CI / PHP 8.4 (pull_request) Failing after 1s

Details

9ae0055f33

Add per-user rate limiting to sensitive Livewire component methods to
prevent abuse from compromised admin sessions. Introduces a reusable
HasRateLimiting trait and applies it to PlatformUser, Settings, and
WaitlistManager components.

Rate limits:
- Tier changes, verification, entitlements: 10/min per admin
- Profile updates, preferences: 20/min per user
- Password changes: 5/min per user
- Data exports: 5/min per admin
- Deletions/anonymisation: 3/min per admin

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>