claimLimiter: widen to 100/hr in non-prod so back-to-back e2e suites don't 429

0cf8dae19c37073d6cb98f5d20b39fc46ab2e22e · 2026-05-18 16:09:41 -0700 · SteveStudio2

Shared by claim/notify/COI-request/paper-comments routes. The 5/hr cap
exhausted across suites, 429ing every POST after the first 5 — same class
of bug the loginLimiter commit fixed. Prod stays at 5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 0cf8dae19c37073d6cb98f5d20b39fc46ab2e22e
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 16:09:41 2026 -0700

    claimLimiter: widen to 100/hr in non-prod so back-to-back e2e suites don't 429
    
    Shared by claim/notify/COI-request/paper-comments routes. The 5/hr cap
    exhausted across suites, 429ing every POST after the first 5 — same class
    of bug the loginLimiter commit fixed. Prod stays at 5.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 6477800..31e8c93 100644
--- a/server.js
+++ b/server.js
@@ -165,8 +165,12 @@ const loginLimiter = rateLimit({
   standardHeaders: true, legacyHeaders: false,
   message: { error: 'too_many_requests' }
 });
+// Shared by claim / notify / COI-request / paper-comments. Like loginLimiter,
+// the non-prod max is widened so back-to-back e2e suites (which fire many
+// POSTs from one IP) don't trip it mid-run. Gated on NODE_ENV — prod stays 5.
 const claimLimiter = rateLimit({
-  windowMs: 60 * 60 * 1000, max: 5,
+  windowMs: 60 * 60 * 1000,
+  max: process.env.NODE_ENV === 'production' ? 5 : 100,
   standardHeaders: true, legacyHeaders: false,
   message: { error: 'too_many_requests' }
 });

← d8b8e58 snapshot: 2 file(s) changed, +1 new, ~1 modified · back to NationalPaperHangers · tests/app.js: mount csrfMiddleware to mirror server.js 4d68e2a →