jcoffey-dev ed93fefb9b Give each session a budget on the data path ...

Only sign-in and the account endpoints were rate limited. JMAP, blob
downloads and the image and calendar proxies had no budget at all, and the
proxy is one Node process that saturates a core at roughly 2,000 operations a
second -- measured at 110% CPU under 150 concurrent users. One signed-in
account looping requests could slow every other user on the instance.

Each session now gets API_RATE_LIMIT requests a minute on those routes, 1,200
by default: twenty a second sustained, well above what a busy tab does and an
order of magnitude below where one tab starts to hurt the rest. Over budget
returns 429 with Retry-After. Sign-in keeps its own, separate limiter.

Checked in situ: one session driven flat out was cut off after exactly 1,200
requests, and with API_RATE_LIMIT=0 throughput at 50 users is unchanged.

2026-09-06 00:42:49 -07:00

..

src

Give each session a budget on the data path

2026-09-06 00:42:49 -07:00

package.json

Let the message list be sorted by something other than the date

2026-09-01 23:51:56 -07:00

tsconfig.json

ihasmail 2.0: rebuild as Stalwart-first JMAP webmail

2026-08-23 01:07:13 -07:00