---
kind: task
slug: rate-limit-workspace-create-and-archive
title: Extend rate-limits to workspace create + archive/restore
plan_slug: multitenant-saas-hardening
epic_slug: tenant-lifecycle
status: draft
priority: P3
tenant_id: global
owner: unassigned
cursor_todo_id: null
updated_at: "2026-06-02"
---

# Task summary

The parent task (`Task-rate-limit-and-abuse-guardrails`) shipped rate-limits on Credentials sign-in and invite-create. Two more endpoints from the original spec are still wide open:

- **`workspaces.create`** — a malicious or buggy script could create thousands of workspaces under one user. Suggested limit: 5 / `actor_user_id` / hour.
- **`workspaces.archive` / `workspaces.restore`** — flipping state in a loop is cheap. Suggested limit: 20 / `(workspace_id, actor_user_id)` / hour.

Use the same `rateLimit()` primitive at `apps/web/server/lib/rate-limit.ts`.

## Subtasks

- [ ] Add the limiter call to `workspaces.create` (top of mutation, after `protectedProcedure`'s auth check).
- [ ] Add the limiter call to `workspaces.archive` and `workspaces.restore`.
- [ ] Verify by smoke-test: 6 rapid workspace creates → 5 succeed, 6th returns `TOO_MANY_REQUESTS`.

## Acceptance criteria

- [ ] Workspace-create trip fires at attempt 6 within an hour.
- [ ] Archive/restore trip fires at attempt 21 within an hour for the same `(workspace_id, actor_user_id)` pair.

## Links

- Parent: `./Task-rate-limit-and-abuse-guardrails.md`
- Epic: `./Epic-tenant-lifecycle.md`