Hugh Brown 94988deef2 security: add rate limiting to agent auth and webhook ingest ...

Agent token auth performed O(n) PBKDF2 operations per request with no
rate limiting, enabling CPU exhaustion attacks. Webhook ingest had no
rate limits either. Add an in-memory token-bucket rate limiter:
- Agent auth: 20 requests/minute per IP
- Webhook ingest: 60 requests/minute per IP

Includes unit tests for the rate limiter.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-07 23:35:10 +05:30

..

core

test(core): add unit tests for version constants

2026-02-12 18:34:18 +00:00

__init__.py

refactor: update module docstrings for clarity and consistency

2026-02-09 15:49:50 +05:30

conftest.py

feat(config): make BASE_URL a required field and update related documentation

2026-03-05 01:36:07 +05:30

test_activity_api_rows.py

fix(ci): resolve backend check failures in dashboard metrics

2026-03-04 16:11:14 +05:30

test_agent_auth_token_lookup_regression.py

feat: update activity feed to include various event types and improve messaging

2026-02-12 15:21:46 +05:30

test_agent_create_limits.py

feat(boards): add max_agents field to board models and enforce limits

2026-02-14 19:43:16 +05:30

test_agent_delete_lead_agent.py

feat: add allow_insecure_tls parameter to agent configuration

2026-02-22 20:24:41 +05:30

test_agent_delete_main_agent.py

feat: add allow_insecure_tls parameter to agent configuration

2026-02-22 20:24:41 +05:30

test_agent_health_api.py

feat: add health check endpoint for agent authentication status

2026-02-16 00:42:15 +05:30

test_agent_provisioning_utils.py

fix(agent): refine agent update retry logic to handle creation race conditions #193

2026-03-03 03:19:11 +05:30

test_agent_tags_api.py

feat(tags): add tag management interfaces and update related schemas

2026-02-12 18:35:48 +05:30

test_agent_task_delete_api.py

feat(api): add delete task endpoint for board leads with authorization checks

2026-02-15 03:19:45 +05:30

test_agent_webhook_payload_read_api.py

fix(agent): address webhook payload read review feedback

2026-03-04 23:26:31 +05:30

test_api_openclaw_integration_boundary.py

refactor: streamline agent lifecycle management with new DB service helpers

2026-02-11 01:13:10 +05:30

test_approval_task_links.py

test: refactor async context management in approval and dependency tests

2026-02-12 14:14:33 +05:30

test_approvals_lead_notifications.py

feat: add approval-task links model and related functionality for task associations

2026-02-11 20:27:07 +05:30

test_approvals_pending_conflicts.py

feat(approvals): enhance approval model with task titles and confidence as float

2026-02-12 19:57:04 +05:30

test_approvals_schema.py

feat: add lead_reasoning field to ApprovalCreate and update validation logic

2026-02-13 21:34:08 +05:30

test_auth_bootstrap_api.py

test(backend): add negative auth/bootstrap cases

2026-02-12 09:08:55 +00:00

test_auth_claims.py

refactor: update Clerk authentication integration and improve organization handling

2026-02-09 23:55:52 +05:30

test_authenticate_request_flow.py

feat: update local authentication mode to require a non-placeholder token of at least 50 characters

2026-02-11 19:40:33 +05:30

test_board_group_assignment_notifications.py

feat(boards): implement lead notification on board updates with detailed change messages

2026-02-26 01:58:55 +05:30

test_board_groups_delete.py

refactor: replace DefaultLimitOffsetPage with LimitOffsetPage in multiple files and update timezone handling to use UTC

2026-02-09 20:40:17 +05:30

test_board_onboarding_autonomy_toggle.py

feat: add board rule toggles for approval and review requirements

2026-02-12 23:05:37 +05:30

test_board_onboarding_start_api.py

feat: implement user message redispatching in onboarding process

2026-02-12 14:02:24 +05:30

test_board_schema.py

feat(boards): add 'comment_required_for_review' rule and update related logic

2026-02-26 00:31:47 +05:30

test_board_webhooks_api.py

refactor: migrate webhook queue to RQ with updated configuration

2026-02-15 13:02:55 +05:30

test_boards_delete.py

redesigned dashboard page

2026-03-04 16:01:56 +05:30

test_boards_gateway_agent_validation.py

feat: add validation for gateway main agent requirement on board mutations

2026-02-16 01:25:44 +05:30

test_common_logging_policy.py

feat: enhance logging configuration and add request logging context

2026-02-11 16:49:43 +05:30

test_config_auth_mode.py

feat(config): make BASE_URL a required field and update related documentation

2026-03-05 01:36:07 +05:30

test_db_transaction_safety.py

refactor: replace DefaultLimitOffsetPage with LimitOffsetPage in multiple files and update timezone handling to use UTC

2026-02-09 20:40:17 +05:30

test_error_handling.py

refactor(skills): reorganize imports and improve code formatting

2026-02-14 12:46:47 +05:30

test_gateway_device_identity.py

feat: add disable_device_pairing option to gateway configuration

2026-02-22 19:19:26 +05:30

test_gateway_resolver.py

refactor(gateway): update gateway parameters to use None as default #169

2026-03-03 01:51:52 +05:30

test_gateway_rpc_connect_scopes.py

refactor(gateway): update gateway parameters to use None as default #169

2026-03-03 01:51:52 +05:30

test_gateway_ssl_context.py

test: Add tests for SSL context configuration

2026-02-22 05:29:32 +00:00

test_gateway_version_compat.py

feat: upgrade FastAPI to 0.130.0 and implement ORJSONResponse for performance

2026-02-22 22:13:52 +00:00

test_lead_policy.py

refactor: enhance docstrings for clarity and consistency across multiple files

2026-02-09 16:23:41 +05:30

test_lifecycle_reconcile_queue.py

feat: implement unified agent lifecycle orchestration and metadata tracking

2026-02-25 00:34:04 +05:30

test_lifecycle_reconcile_state.py

feat: implement unified agent lifecycle orchestration and metadata tracking

2026-02-25 00:34:04 +05:30

test_lifecycle_services.py

feat(board): introduce new board agent templates and restructure existing files

2026-02-15 00:45:28 +05:30

test_local_auth_integration.py

feat: update local authentication mode to require a non-placeholder token of at least 50 characters

2026-02-11 19:40:33 +05:30

test_mentions.py

refactor: remove main session key references and enhance agent-gateway associations

2026-02-10 02:58:58 +05:30

test_metrics_filters.py

feat: enhance task management with due date handling and mention support

2026-02-12 21:46:22 +05:30

test_metrics_kpis.py

fix(ci): resolve backend check failures in dashboard metrics

2026-03-04 16:11:14 +05:30

test_metrics_ranges.py

feat(metrics): extend time range options and update related metrics handling

2026-02-12 19:30:02 +05:30

test_openapi_agent_role_tags.py

feat: update agent heartbeat endpoint to require no request payload

2026-02-16 01:46:06 +05:30

test_openapi_agent_webhook_payload_endpoint.py

fix(agent): address webhook payload read review feedback

2026-03-04 23:26:31 +05:30

test_openapi_blocked_task_error_schema.py

test: harden blocked-task regression tests per review

2026-03-04 23:01:24 +05:30

test_openclaw_import_boundaries.py

refactor: update imports to use provisioning_db and gateway_rpc modules

2026-02-11 00:00:19 +05:30

test_organizations_delete_api.py

feat: add board webhook configuration and payload models

2026-02-13 00:31:36 +05:30

test_organizations_member_remove_api.py

refactor: replace DefaultLimitOffsetPage with LimitOffsetPage in multiple files and update timezone handling to use UTC

2026-02-09 20:40:17 +05:30

test_organizations_service.py

feat(skills): consolidate skill-related models and update imports

2026-02-14 19:31:32 +05:30

test_queue_worker_lifecycle_handler.py

feat: implement unified agent lifecycle orchestration and metadata tracking

2026-02-25 00:34:04 +05:30

test_queue.py

refactor: reorganize imports and improve code formatting for readability

2026-02-15 13:20:46 +05:30

test_rate_limit.py

security: add rate limiting to agent auth and webhook ingest

2026-03-07 23:35:10 +05:30

test_request_id_middleware.py

feat: enhance logging configuration and add request logging context

2026-02-11 16:49:43 +05:30

test_security_headers_middleware.py

refactor(tests): format code for better readability in test files

2026-02-25 03:41:03 +05:30

test_session_keys.py

refactor: clean up imports and improve session key assertion formatting

2026-02-11 10:47:32 +05:30

test_skills_marketplace_api.py

feat(skills): consolidate skill-related models and update imports

2026-02-14 19:31:32 +05:30

test_souls_directory.py

refactor: update module docstrings for clarity and consistency

2026-02-09 15:49:50 +05:30

test_tags_service.py

feat(tags): add tag management interfaces and update related schemas

2026-02-12 18:35:48 +05:30

test_task_agent_permissions.py

refactor(page): improve code formatting for better readability in event handlers

2026-02-26 00:36:33 +05:30

test_task_dependencies_integration.py

test: refactor async context management in approval and dependency tests

2026-02-12 14:14:33 +05:30

test_task_dependencies.py

refactor: enhance docstrings for clarity and consistency across multiple files

2026-02-09 16:23:41 +05:30

test_tasks_api_rows.py

chore: update generated files to orval v8.3.0 and adjust related interfaces

2026-02-12 18:04:35 +05:30

test_tasks_blocked_lead_dependency_only.py

test: assert blocked precondition in dependency-only update test

2026-03-04 23:09:56 +05:30

test_tasks_blocked_lead_transitions.py

refactor(skills): reorganize imports and improve code formatting

2026-02-14 12:46:47 +05:30

test_tasks_done_approval_gate.py

Harden non-lead task patch auth and add regression tests

2026-02-14 06:35:21 +00:00

test_template_size_budget.py

refactor(constants): initialize LEAD_TEMPLATE_MAP as an empty dictionary

2026-02-15 00:53:27 +05:30

test_users_delete_api.py

refactor: implement user deletion functionality and enhance settings management

2026-02-10 00:17:06 +05:30

test_webhook_dispatch.py

refactor: add agent_id to various interfaces and improve field organization

2026-02-15 13:36:57 +05:30