📌 Description
middleware/rateLimiter.ts returns 429 RATE_LIMITED when a client exceeds the per-IP window, but per the current README it doesn't mention a Retry-After header — clients have to guess when to retry instead of being told the remaining window.
🧩 Requirements and context
- Compute seconds remaining in the current window and set
Retry-After on every 429 response, for both the general limiter and the stricter quote limiter.
- Value should be accurate to within one second of the actual window reset.
- No change to the
429 body shape.
🛠️ Suggested execution
- Update
rateLimiter() in middleware/rateLimiter.ts to compute and set the header from the bucket's window state.
- Add tests in
middleware/rateLimiter.test.ts asserting the header is present and numerically sane on a 429.
- Mention the header in the README's rate-limiting section.
✅ Acceptance criteria
🔒 Security notes
No new attack surface; slightly improves client-side backoff behavior which indirectly reduces load spikes.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
middleware/rateLimiter.tsreturns429 RATE_LIMITEDwhen a client exceeds the per-IP window, but per the current README it doesn't mention aRetry-Afterheader — clients have to guess when to retry instead of being told the remaining window.🧩 Requirements and context
Retry-Afteron every429response, for both the general limiter and the stricter quote limiter.429body shape.🛠️ Suggested execution
rateLimiter()inmiddleware/rateLimiter.tsto compute and set the header from the bucket's window state.middleware/rateLimiter.test.tsasserting the header is present and numerically sane on a429.✅ Acceptance criteria
429response includes aRetry-Afterheader.🔒 Security notes
No new attack surface; slightly improves client-side backoff behavior which indirectly reduces load spikes.
📋 Guidelines