336a5890a8
Soft-delete cascade was the missing half of archive: stamping workspaces.archived_at alone left objects visible to anyone with a direct id. The cascade runs in one transaction so the partial state isn't reachable, and restore inverts it for any archived row in the workspace — provenance-blind on purpose until we have a use case that needs to distinguish per-workspace from per-object archives. audit_log keeps the keyset index on (workspace_id, created_at) and the actor_user_id FK with onDelete set null. recordAudit() refuses to write a null actor without a metadata.system_actor label so the audit view always has something to render. workspaces and invites mutations call recordAudit on success; objects-router instrumentation and the markdown importer's system-actor flow are filed as P2 follow-ups because each needs a thoughtful "what's audit-worthy?" pass, not mechanical wiring. Settings → Audit log lives at /<slug>/settings/audit, owner-gated, keyset-paginated. ACTION_LABELS is small on purpose; new actions fall back to their raw key so missing a label degrades gracefully. Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
---
|
|
kind: task
|
|
slug: rate-limit-workspace-create-and-archive
|
|
title: Extend rate-limits to workspace create + archive/restore
|
|
plan_slug: multitenant-saas-hardening
|
|
epic_slug: tenant-lifecycle
|
|
status: draft
|
|
priority: P3
|
|
tenant_id: global
|
|
owner: unassigned
|
|
cursor_todo_id: null
|
|
updated_at: "2026-06-02"
|
|
---
|
|
|
|
# Task summary
|
|
|
|
The parent task (`Task-rate-limit-and-abuse-guardrails`) shipped rate-limits on Credentials sign-in and invite-create. Two more endpoints from the original spec are still wide open:
|
|
|
|
- **`workspaces.create`** — a malicious or buggy script could create thousands of workspaces under one user. Suggested limit: 5 / `actor_user_id` / hour.
|
|
- **`workspaces.archive` / `workspaces.restore`** — flipping state in a loop is cheap. Suggested limit: 20 / `(workspace_id, actor_user_id)` / hour.
|
|
|
|
Use the same `rateLimit()` primitive at `apps/web/server/lib/rate-limit.ts`.
|
|
|
|
## Subtasks
|
|
|
|
- [ ] Add the limiter call to `workspaces.create` (top of mutation, after `protectedProcedure`'s auth check).
|
|
- [ ] Add the limiter call to `workspaces.archive` and `workspaces.restore`.
|
|
- [ ] Verify by smoke-test: 6 rapid workspace creates → 5 succeed, 6th returns `TOO_MANY_REQUESTS`.
|
|
|
|
## Acceptance criteria
|
|
|
|
- [ ] Workspace-create trip fires at attempt 6 within an hour.
|
|
- [ ] Archive/restore trip fires at attempt 21 within an hour for the same `(workspace_id, actor_user_id)` pair.
|
|
|
|
## Links
|
|
|
|
- Parent: `./Task-rate-limit-and-abuse-guardrails.md`
|
|
- Epic: `./Epic-tenant-lifecycle.md`
|