Scaffolds the add-rate-limiting convoy. fix-auth-bypass Brief 4
shipped lib/rate-limit.js with a single 5/15min auth-only limiter
wired into login + register; this convoy extends the surface to
search, upload, and (pending Decision 1) import routes.
Parent's pre-architect audit surfaced a critical secondary
finding beyond "missing rate limit": pages/api/cards/import-*.js
(3 files) have ZERO auth checks. They are publicly callable,
hit external APIs (Scryfall / Pokémon / Lorcana) with no caller
throttling, and perform unbounded DB writes. Rate-limit alone
won't close P0 #6 cleanly.
Architect Decision 1 routes the scope choice:
Option A — in-scope: add auth gates + rate limit to import
routes in this convoy. ~30 LOC across 3 files. Parent
recommends — precedent from drop-public-setup Brief 2 (mid-
convoy CJS/ESM expansion).
Option B — spin out: stay narrow on the 4 listed routes; queue
gate-import-routes follow-up. Mark P0 #6 RESOLVED-with-caveat.
Option C — rate-limit-only on imports: worst option (leaves
abusive anonymous endpoint live).
Six decisions queued (scope expansion, named-limiter shape,
per-class limits, identifier extraction, 429 response shape,
test coverage). No operator action required — Upstash env vars
already auto-provisioned by Brief 4.
If Option A wins, this convoy closes the last open P0 ship-
blocker (8/8 RESOLVED) and the launch checklist becomes empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
