Merge branch 'develop' into feature/2024.10

packages/backend/src/core/NoteCreateService.ts

@@ -637,6 +637,7 @@ export class NoteCreateService implements OnApplicationShutdown {
 			this.queueService.endedPollNotificationQueue.add(note.id, {
 				noteId: note.id,
 			}, {
+				jobId: `pollEnd:${note.id}`,
 				delay,
 				removeOnComplete: true,
 			});

packages/backend/src/core/NoteEditService.ts

@@ -471,8 +471,9 @@ export class NoteEditService implements OnApplicationShutdown {
 		const poll = await this.pollsRepository.findOneBy({ noteId: oldnote.id });
 
 		const oldPoll = poll ? { choices: poll.choices, multiple: poll.multiple, expiresAt: poll.expiresAt } : null;
+		const pollChanged = data.poll != null && JSON.stringify(data.poll) !== JSON.stringify(oldPoll);
 
-		if (Object.keys(update).length > 0 || filesChanged) {
+		if (Object.keys(update).length > 0 || filesChanged || pollChanged) {
 			const exists = await this.noteEditRepository.findOneBy({ noteId: oldnote.id });
 
 			await this.noteEditRepository.insert({
@@ -544,7 +545,7 @@ export class NoteEditService implements OnApplicationShutdown {
 				}));
 			}
 
-			if (data.poll != null && JSON.stringify(data.poll) !== JSON.stringify(oldPoll)) {
+			if (pollChanged) {
 				// Start transaction
 				await this.db.transaction(async transactionalEntityManager => {
 					await transactionalEntityManager.update(MiNote, oldnote.id, note);
@@ -609,10 +610,11 @@ export class NoteEditService implements OnApplicationShutdown {
 
 		if (data.poll && data.poll.expiresAt) {
 			const delay = data.poll.expiresAt.getTime() - Date.now();
-			this.queueService.endedPollNotificationQueue.remove(note.id);
+			this.queueService.endedPollNotificationQueue.remove(`pollEnd:${note.id}`);
 			this.queueService.endedPollNotificationQueue.add(note.id, {
 				noteId: note.id,
 			}, {
+				jobId: `pollEnd:${note.id}`,
 				delay,
 				removeOnComplete: true,
 			});

packages/backend/src/core/activitypub/ApRendererService.ts

@@ -469,6 +469,7 @@ export class ApRendererService {
 		};
 	}
 
+	// if you change this, also change `server/api/endpoints/i/update.ts`
 	@bindThis
 	public async renderPerson(user: MiLocalUser) {
 		const id = this.userEntityService.genLocalUserUri(user.id);

packages/backend/src/core/activitypub/misc/check-against-url.ts

@@ -2,26 +2,29 @@
  * SPDX-FileCopyrightText: dakkar and sharkey-project
  * SPDX-License-Identifier: AGPL-3.0-only
  */
+
 import type { IObject } from '../type.js';
 
-function getHrefFrom(one: IObject|string): string | undefined {
-	if (typeof(one) === 'string') return one;
-	return one.href;
+function getHrefsFrom(one: IObject | string | undefined | (IObject | string | undefined)[]): (string | undefined)[] {
+	if (Array.isArray(one)) {
+		return one.flatMap(h => getHrefsFrom(h));
+	}
+	return [
+		typeof(one) === 'object' ? one.href : one,
+	];
 }
 
 export function assertActivityMatchesUrls(activity: IObject, urls: string[]) {
-	const idOk = activity.id !== undefined && urls.includes(activity.id);
-	if (idOk) return;
+	const expectedUrls = new Set(urls
+		.filter(u => URL.canParse(u))
+		.map(u => new URL(u).href),
+	);
 
-	const url = activity.url;
-	if (url) {
-		// `activity.url` can be an `ApObject = IObject | string | (IObject
-		// | string)[]`, we have to look inside it
-		const activityUrls = Array.isArray(url) ? url.map(getHrefFrom) : [getHrefFrom(url)];
-		const goodUrl = activityUrls.find(u => u && urls.includes(u));
+	const actualUrls = [activity.id, ...getHrefsFrom(activity.url)]
+		.filter(u => u && URL.canParse(u))
+		.map(u => new URL(u as string).href);
 
-		if (goodUrl) return;
+	if (!actualUrls.some(u => expectedUrls.has(u))) {
+		throw new Error(`bad Activity: neither id(${activity.id}) nor url(${JSON.stringify(activity.url)}) match location(${urls})`);
 	}
-
-	throw new Error(`bad Activity: neither id(${activity?.id}) nor url(${JSON.stringify(activity?.url)}) match location(${urls})`);
 }

packages/backend/src/core/entities/NoteEntityService.ts

@@ -218,8 +218,8 @@ export class NoteEntityService implements OnModuleInit {
 			packedNote.reactionAcceptance = null;
 			packedNote.reactionAndUserPairCache = undefined;
 			packedNote.reactionCount = 0;
-			packedNote.reactionEmojis = undefined;
-			packedNote.reactions = undefined;
+			packedNote.reactionEmojis = {};
+			packedNote.reactions = {};
 			packedNote.isHidden = true;
 			// TODO: hiddenReason みたいなのを提供しても良さそう
 		}

packages/backend/src/misc/secure-rndstr.ts

@@ -14,10 +14,7 @@ export function secureRndstr(length = 32, { chars = LU_CHARS } = {}): string {
 	let str = '';
 
 	for (let i = 0; i < length; i++) {
-		let rand = Math.floor((crypto.randomBytes(1).readUInt8(0) / 0xFF) * chars_len);
-		if (rand === chars_len) {
-			rand = chars_len - 1;
-		}
+		const rand = crypto.randomInt(0, chars_len);
 		str += chars.charAt(rand);
 	}
 

packages/backend/src/queue/processors/InboxProcessorService.ts

@@ -194,7 +194,8 @@ export class InboxProcessorService implements OnApplicationShutdown {
 				throw new Bull.UnrecoverableError(`skip: signerHost(${signerHost}) !== activity.id host(${activityIdHost}`);
 			}
 		} else {
-			throw new Bull.UnrecoverableError('skip: activity id is not a string');
+			// Activity ID should only be string or undefined.
+			delete activity.id;
 		}
 
 		this.apRequestChart.inbox();

packages/backend/src/server/FileServerService.ts

@@ -31,6 +31,7 @@ import { handleRequestRedirectToOmitSearch } from '@/misc/fastify-hook-handlers.
 import { RateLimiterService } from '@/server/api/RateLimiterService.js';
 import { getIpHash } from '@/misc/get-ip-hash.js';
 import { AuthenticateService } from '@/server/api/AuthenticateService.js';
+import type { IEndpointMeta } from '@/server/api/endpoints.js';
 import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyPluginOptions } from 'fastify';
 import type Limiter from 'ratelimiter';
 
@@ -82,7 +83,7 @@ export class FileServerService {
 			});
 
 			fastify.get<{ Params: { key: string; } }>('/files/:key', async (request, reply) => {
-				if (!await this.checkRateLimit(request, reply, `/files/${request.params.key}`)) return;
+				if (!await this.checkRateLimit(request, reply, '/files/', request.params.key)) return;
 
 				return await this.sendDriveFile(request, reply)
 					.catch(err => this.errorHandler(request, reply, err));
@@ -109,7 +110,7 @@ export class FileServerService {
 			keyUrl.username = '';
 			keyUrl.password = '';
 
-			if (!await this.checkRateLimit(request, reply, `/proxy/${keyUrl}`)) return;
+			if (!await this.checkRateLimit(request, reply, '/proxy/', keyUrl.href)) return;
 
 			return await this.proxyHandler(request, reply)
 				.catch(err => this.errorHandler(request, reply, err));
@@ -603,7 +604,8 @@ export class FileServerService {
 			Params?: Record<string, unknown> | unknown,
 		}>,
 		reply: FastifyReply,
-		rateLimitKey: string,
+		group: string,
+		resource: string,
 	): Promise<boolean> {
 		const body = request.method === 'GET'
 			? request.query
@@ -622,32 +624,48 @@ export class FileServerService {
 		const [user] = await this.authenticateService.authenticate(token);
 		const actor = user?.id ?? getIpHash(request.ip);
 
+		// Call both limits: the per-resource limit and the shared cross-resource limit
+		return await this.checkResourceLimit(reply, actor, group, resource) && await this.checkSharedLimit(reply, actor, group);
+	}
+
+	private async checkResourceLimit(reply: FastifyReply, actor: string, group: string, resource: string): Promise<boolean> {
 		const limit = {
 			// Group by resource
-			key: rateLimitKey,
+			key: `${group}${resource}`,
 
 			// Maximum of 10 requests / 10 minutes
 			max: 10,
 			duration: 1000 * 60 * 10,
-
-			// Minimum of 250 ms between each request
-			minInterval: 250,
 		};
 
-		// Rate limit proxy requests
+		return await this.checkLimit(reply, actor, limit);
+	}
+
+	private async checkSharedLimit(reply: FastifyReply, actor: string, group: string): Promise<boolean> {
+		const limit = {
+			key: group,
+
+			// Maximum of 3600 requests per hour, which is an average of 1 per second.
+			max: 3600,
+			duration: 1000 * 60 * 60,
+		};
+
+		return await this.checkLimit(reply, actor, limit);
+	}
+
+	private async checkLimit(reply: FastifyReply, actor: string, limit: IEndpointMeta['limit'] & { key: NonNullable<string> }): Promise<boolean> {
 		try {
 			await this.rateLimiterService.limit(limit, actor);
 			return true;
 		} catch (err) {
 			// errはLimiter.LimiterInfoであることが期待される
-			reply.code(429);
-
 			if (hasRateLimitInfo(err)) {
 				const cooldownInSeconds = Math.ceil((err.info.resetMs - Date.now()) / 1000);
 				// もしかするとマイナスになる可能性がなくはないのでマイナスだったら0にしておく
 				reply.header('Retry-After', Math.max(cooldownInSeconds, 0).toString(10));
 			}
 
+			reply.code(429);
 			reply.send({
 				message: 'Rate limit exceeded. Please try again later.',
 				code: 'RATE_LIMIT_EXCEEDED',

packages/backend/src/server/WellKnownServerService.ts

@@ -140,6 +140,7 @@ fastify.get('/.well-known/change-password', async (request, reply) => {
 			}
 
 			const subject = `acct:${user.username}@${this.config.host}`;
+			const profileLink = `${this.config.url}/@${user.username}`;
 			const self = {
 				rel: 'self',
 				type: 'application/activity+json',
@@ -148,7 +149,7 @@ fastify.get('/.well-known/change-password', async (request, reply) => {
 			const profilePage = {
 				rel: 'http://webfinger.net/rel/profile-page',
 				type: 'text/html',
-				href: `${this.config.url}/@${user.username}`,
+				href: profileLink,
 			};
 			const subscribe = {
 				rel: 'http://ostatus.org/schema/1.0/subscribe',
@@ -164,12 +165,14 @@ fastify.get('/.well-known/change-password', async (request, reply) => {
 					{ element: 'Subject', value: subject },
 					{ element: 'Link', attributes: self },
 					{ element: 'Link', attributes: profilePage },
-					{ element: 'Link', attributes: subscribe });
+					{ element: 'Link', attributes: subscribe },
+					{ element: 'Alias', value: profileLink });
 			} else {
 				reply.type(jrd);
 				return {
 					subject,
 					links: [self, profilePage, subscribe],
+					aliases: [profileLink],
 				};
 			}
 		});

packages/backend/src/server/api/ApiCallService.ts

@@ -311,7 +311,15 @@ export class ApiCallService implements OnApplicationShutdown {
 			throw new ApiError(accessDenied);
 		}
 
-		if (ep.meta.limit) {
+		// For endpoints without a limit, the default is 10 calls per second
+		const endpointLimit: IEndpointMeta['limit'] = ep.meta.limit ?? {
+			duration: 1000,
+			max: 10,
+		};
+
+		// We don't need this check, but removing it would cause a big merge conflict.
+		// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+		if (endpointLimit) {
 			// koa will automatically load the `X-Forwarded-For` header if `proxy: true` is configured in the app.
 			let limitActor: string;
 			if (user) {
@@ -320,7 +328,7 @@ export class ApiCallService implements OnApplicationShutdown {
 				limitActor = getIpHash(request.ip);
 			}
 
-			const limit = Object.assign({}, ep.meta.limit);
+			const limit = Object.assign({}, endpointLimit);
 
 			if (limit.key == null) {
 				(limit as any).key = ep.name;

packages/backend/src/server/api/endpoints/announcements.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Announcement',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/announcements/show.ts

@@ -27,6 +27,12 @@ export const meta = {
 			id: 'b57b5e1d-4f49-404a-9edb-46b00268f121',
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/create.ts

@@ -47,6 +47,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/delete.ts

@@ -24,6 +24,12 @@ export const meta = {
 			id: 'b34dcf9d-348f-44bb-99d0-6c9314cfe2df',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/list.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Antenna',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/notes.ts

@@ -41,6 +41,12 @@ export const meta = {
 			ref: 'Note',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/antennas/update.ts

@@ -45,6 +45,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Antenna',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/app/create.ts

@@ -22,6 +22,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'App',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/app/show.ts

@@ -26,6 +26,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'App',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/accept.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '9c72d8de-391a-43c1-9d06-08d29efde8df',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/generate.ts

@@ -40,6 +40,12 @@ export const meta = {
 			id: '92f93e63-428e-4f2f-a5a4-39e1407fe998',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/show.ts

@@ -43,6 +43,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/auth/session/userkey.ts

@@ -51,6 +51,12 @@ export const meta = {
 			id: '8c8a4145-02cc-4cca-8e66-29ba60445a8e',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/blocking/list.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Blocking',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/bubble-game/ranking.ts

@@ -40,6 +40,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/favorite.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '4938f5f3-6167-4c04-9149-6607b7542861',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/featured.ts

@@ -23,6 +23,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/follow.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: 'c0031718-d573-4e85-928e-10039f1fbb68',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/followed.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/my-favorites.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/owned.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/search.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Channel',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/show.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: '6f6c314b-7486-4897-8966-c04a66a02923',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/timeline.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: '4d0eeeba-a02c-4c3c-9966-ef60d38d2e7f',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/unfavorite.ts

@@ -25,6 +25,12 @@ export const meta = {
 			id: '353c68dd-131a-476c-aa99-88a345e83668',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/unfollow.ts

@@ -26,6 +26,12 @@ export const meta = {
 			id: '19959ee9-0153-4c51-bbd9-a98c49dc59d6',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/channels/update.ts

@@ -10,6 +10,7 @@ import { ChannelEntityService } from '@/core/entities/ChannelEntityService.js';
 import { DI } from '@/di-symbols.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['channels'],
@@ -43,6 +44,11 @@ export const meta = {
 			id: 'e86c14a4-0da2-4032-8df3-e737a04c7f3b',
 		},
 	},
+
+	limit: {
+		duration: ms('1hour'),
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/active-users.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/ap-request.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/drive.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/federation.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/instance.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/notes.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/drive.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/following.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/notes.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/pv.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/user/reactions.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/charts/users.ts

@@ -16,6 +16,12 @@ export const meta = {
 
 	allowGet: true,
 	cacheSec: 60 * 60,
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/add-note.ts

@@ -18,9 +18,10 @@ export const meta = {
 
 	kind: 'write:account',
 
+	// 60 calls per hour
 	limit: {
 		duration: ms('1hour'),
-		max: 20,
+		max: 60,
 	},
 
 	errors: {

packages/backend/src/server/api/endpoints/clips/create.ts

@@ -32,6 +32,12 @@ export const meta = {
 			id: '920f7c2d-6208-4b76-8082-e632020f5883',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/delete.ts

@@ -22,6 +22,12 @@ export const meta = {
 			id: '70ca08ba-6865-4630-b6fb-8494759aa754',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/favorite.ts

@@ -32,6 +32,12 @@ export const meta = {
 			id: '92658936-c625-4273-8326-2d790129256e',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/list.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Clip',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/my-favorites.ts

@@ -25,6 +25,12 @@ export const meta = {
 			ref: 'Clip',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/notes.ts

@@ -35,6 +35,12 @@ export const meta = {
 			ref: 'Note',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/remove-note.ts

@@ -30,6 +30,12 @@ export const meta = {
 			id: 'aff017de-190e-434b-893e-33a9ff5049d8',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Clip',
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/unfavorite.ts

@@ -31,6 +31,12 @@ export const meta = {
 			id: '90c3a9e8-b321-4dae-bf57-2bf79bbcc187',
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/clips/update.ts

@@ -31,6 +31,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'Clip',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive.ts

@@ -29,6 +29,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 3 calls per second
+	limit: {
+		duration: 1000,
+		max: 3,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files.ts

@@ -28,6 +28,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/attached-notes.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: 'c118ece3-2e4b-4296-99d1-51756e32d232',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/check-existence.ts

@@ -21,6 +21,12 @@ export const meta = {
 		type: 'boolean',
 		optional: false, nullable: false,
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/delete.ts

@@ -11,6 +11,7 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -34,6 +35,12 @@ export const meta = {
 			id: '5eb8d909-2540-4970-90b8-dd6f86088121',
 		},
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/find-by-hash.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/find.ts

@@ -28,6 +28,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/show.ts

@@ -40,6 +40,12 @@ export const meta = {
 			id: '25b73c73-68b1-41d0-bad1-381cfdf6579f',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/files/update.ts

@@ -11,6 +11,7 @@ import { RoleService } from '@/core/RoleService.js';
 import { DriveService } from '@/core/DriveService.js';
 import type { Config } from '@/config.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -63,6 +64,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'DriveFile',
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'DriveFolder',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/delete.ts

@@ -9,6 +9,7 @@ import type { DriveFoldersRepository, DriveFilesRepository } from '@/models/_.js
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -30,6 +31,12 @@ export const meta = {
 			id: 'b0fc8a17-963c-405d-bfbc-859a487295e1',
 		},
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/find.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'DriveFolder',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 			id: 'd74ab9eb-bb09-4bba-bf24-fb58f761e1e9',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/folders/update.ts

@@ -10,6 +10,7 @@ import { DriveFolderEntityService } from '@/core/entities/DriveFolderEntityServi
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['drive'],
@@ -43,6 +44,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'DriveFolder',
 	},
+
+	// 100 calls per minute
+	limit: {
+		duration: 1000 * 60,
+		max: 100,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/drive/stream.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'DriveFile',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/email-address/available.ts

@@ -26,6 +26,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/emoji.ts

@@ -22,6 +22,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'EmojiDetailed',
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/emojis.ts

@@ -32,6 +32,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/endpoint.ts

@@ -28,6 +28,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/endpoints.ts

@@ -26,6 +26,12 @@ export const meta = {
 			'...',
 		],
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/followers.ts

@@ -22,6 +22,12 @@ export const meta = {
 			ref: 'Following',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/following.ts

@@ -22,6 +22,12 @@ export const meta = {
 			ref: 'Following',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/instances.ts

@@ -27,6 +27,12 @@ export const meta = {
 			ref: 'FederationInstance',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/show-instance.ts

@@ -20,6 +20,12 @@ export const meta = {
 		optional: false, nullable: true,
 		ref: 'FederationInstance',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/stats.ts

@@ -50,6 +50,12 @@ export const meta = {
 			otherFollowingCount: { type: 'number' },
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/update-remote-user.ts

@@ -12,6 +12,12 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/federation/users.ts

@@ -24,6 +24,12 @@ export const meta = {
 			ref: 'UserDetailedNotMe',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/fetch-rss.ts

@@ -203,6 +203,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 20 calls per 10 seconds
+	limit: {
+		duration: 1000 * 10,
+		max: 20,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/delete.ts

@@ -10,6 +10,7 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['flashs'],
@@ -31,6 +32,11 @@ export const meta = {
 			id: '1036ad7b-9f92-4fff-89c3-0e50dc941704',
 		},
 	},
+
+	limit: {
+		duration: ms('1hour'),
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/featured.ts

@@ -24,6 +24,12 @@ export const meta = {
 			ref: 'Flash',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/like.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: '010065cf-ad43-40df-8067-abff9f4686e3',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/my-likes.ts

@@ -36,6 +36,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/my.ts

@@ -26,6 +26,12 @@ export const meta = {
 			ref: 'Flash',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/show.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: 'f0d34a1a-d29a-401d-90ba-1982122b5630',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/flash/unlike.ts

@@ -31,6 +31,12 @@ export const meta = {
 			id: '755f25a7-9871-4f65-9f34-51eaad9ae0ac',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/accept.ts

@@ -28,6 +28,12 @@ export const meta = {
 			id: 'bcde4f8b-0913-4614-8881-614e522fb041',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/cancel.ts

@@ -37,6 +37,12 @@ export const meta = {
 		optional: false, nullable: false,
 		ref: 'UserLite',
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/list.ts

@@ -42,6 +42,12 @@ export const meta = {
 			},
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/following/requests/reject.ts

@@ -23,6 +23,12 @@ export const meta = {
 			id: 'abc2ffa6-25b2-4380-ba99-321ff3a94555',
 		},
 	},
+
+	// 10 calls per 5 seconds
+	limit: {
+		duration: 1000 * 5,
+		max: 10,
+	},
 } as const;
 
 export const paramDef = {