add rate limits to all public endpoints

packages/backend/src/server/api/endpoints/pages/delete.ts

@@ -10,6 +10,7 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { RoleService } from '@/core/RoleService.js';
 import { ApiError } from '../../error.js';
+import ms from 'ms';
 
 export const meta = {
 	tags: ['pages'],
@@ -31,6 +32,12 @@ export const meta = {
 			id: '8b741b3e-2c22-44b3-a15f-29949aa1601e',
 		},
 	},
+
+	// 300 calls per hour (match update)
+	limit: {
+		duration: ms('1hour'),
+		max: 300,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/pages/featured.ts

@@ -23,6 +23,12 @@ export const meta = {
 			ref: 'Page',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/pages/like.ts

@@ -38,6 +38,12 @@ export const meta = {
 			id: 'd4c1edbe-7da2-4eae-8714-1acfd2d63941',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/pages/show.ts

@@ -30,6 +30,12 @@ export const meta = {
 			id: '222120c0-3ead-4528-811b-b96f233388d7',
 		},
 	},
+
+	// 5 calls per second
+	limit: {
+		duration: 1000,
+		max: 5,
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/pages/unlike.ts

@@ -31,6 +31,12 @@ export const meta = {
 			id: 'f5e586b0-ce93-4050-b0e3-7f31af5259ee',
 		},
 	},
+
+	// 2 calls per second
+	limit: {
+		duration: 1000,
+		max: 2,
+	},
 } as const;
 
 export const paramDef = {