fix(a/M11): route the limiter's IP fallback through ipKeyGenerator
The custom keyGenerator returned req.ip directly, which express-rate-limit rejects as ERR_ERL_KEY_GEN_IPV6 - confirmed firing in the route suite, not theoretical. A raw IPv6 address gives every host in a /64 its own bucket, and a single client can hold trillions of those, so the fallback limit was bypassable. Kept the fallback rather than deleting it (it is unreachable today - requireAuth is mounted ahead of the limiter and 401s first - but "unreachable" is a property of the current mount order, not a guarantee), and recorded that reachability argument in the comment. Keys are now namespaced user:/ip: so a user id can never collide with an address literal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| Repository | Sloth-ninja/JessicaOSS |
|---|---|
| Author | sloth-ninja <ezanahaddis@gmail.com> |
| Authored | |
| Parents | d17de50e |
| Stats | 1 file changed , +15 , -3 |
| Part of | Practice Management: Clio-backed Matters and workspace links |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-2bfa0b57.md
from inside the repo you want the change in.