diff --git a/docs/code-bridge/responses/MSG-2026-04-13-releases-rate-limit.md b/docs/code-bridge/responses/MSG-2026-04-13-releases-rate-limit.md new file mode 100644 index 0000000..6f28768 --- /dev/null +++ b/docs/code-bridge/responses/MSG-2026-04-13-releases-rate-limit.md @@ -0,0 +1,48 @@ +# MSG-2026-04-13-releases-rate-limit + +**From:** Chronicler #85 +**Date:** 2026-04-13 +**Priority:** HIGH — Identify Version button does nothing on desktop +**Status:** OPEN + +## Problem + +Clicking "Identify Version" button fires a GET to: +`/api/client/extensions/modpackchecker/servers/{uuid}/releases` + +Returns **429 Too Many Requests** — rate limiter is set to 2 attempts per 60 +seconds per server. During testing/debugging this gets hit immediately. + +## Current Rate Limit (too aggressive) +```php +$limitKey = 'modpack_releases_' . $server->uuid; +if (RateLimiter::tooManyAttempts($limitKey, 2)) { // ← only 2 attempts + $seconds = RateLimiter::availableIn($limitKey); + return response()->json(['error' => "Too many requests. Wait {$seconds}s."], 429); +} +RateLimiter::hit($limitKey, 60); // ← 60 second window +``` + +## Fix + +Bump to 10 attempts per 60 seconds — this is a calibration UI action, +not an API endpoint that needs aggressive throttling: + +```php +if (RateLimiter::tooManyAttempts($limitKey, 10)) { +``` + +Also — the widget's `openCalibrate()` catch block silently swallows the 429. +The user sees nothing happen. Should show an error message when rate limited: + +```tsx +} catch (e: any) { + if (e?.response?.status === 429) { + setError('Too many requests — please wait a moment and try again.'); + } + setReleases([]); +} +``` + +--- +*— Chronicler #85*