336a5890a8
Soft-delete cascade was the missing half of archive: stamping workspaces.archived_at alone left objects visible to anyone with a direct id. The cascade runs in one transaction so the partial state isn't reachable, and restore inverts it for any archived row in the workspace — provenance-blind on purpose until we have a use case that needs to distinguish per-workspace from per-object archives. audit_log keeps the keyset index on (workspace_id, created_at) and the actor_user_id FK with onDelete set null. recordAudit() refuses to write a null actor without a metadata.system_actor label so the audit view always has something to render. workspaces and invites mutations call recordAudit on success; objects-router instrumentation and the markdown importer's system-actor flow are filed as P2 follow-ups because each needs a thoughtful "what's audit-worthy?" pass, not mechanical wiring. Settings → Audit log lives at /<slug>/settings/audit, owner-gated, keyset-paginated. ACTION_LABELS is small on purpose; new actions fall back to their raw key so missing a label degrades gracefully. Co-authored-by: Cursor <cursoragent@cursor.com>
1.5 KiB
1.5 KiB
| kind | slug | title | plan_slug | epic_slug | status | priority | tenant_id | owner | cursor_todo_id | updated_at |
|---|---|---|---|---|---|---|---|---|---|---|
| task | rate-limit-workspace-create-and-archive | Extend rate-limits to workspace create + archive/restore | multitenant-saas-hardening | tenant-lifecycle | draft | P3 | global | unassigned | null | 2026-06-02 |
Task summary
The parent task (Task-rate-limit-and-abuse-guardrails) shipped rate-limits on Credentials sign-in and invite-create. Two more endpoints from the original spec are still wide open:
workspaces.create— a malicious or buggy script could create thousands of workspaces under one user. Suggested limit: 5 /actor_user_id/ hour.workspaces.archive/workspaces.restore— flipping state in a loop is cheap. Suggested limit: 20 /(workspace_id, actor_user_id)/ hour.
Use the same rateLimit() primitive at apps/web/server/lib/rate-limit.ts.
Subtasks
- Add the limiter call to
workspaces.create(top of mutation, afterprotectedProcedure's auth check). - Add the limiter call to
workspaces.archiveandworkspaces.restore. - Verify by smoke-test: 6 rapid workspace creates → 5 succeed, 6th returns
TOO_MANY_REQUESTS.
Acceptance criteria
- Workspace-create trip fires at attempt 6 within an hour.
- Archive/restore trip fires at attempt 21 within an hour for the same
(workspace_id, actor_user_id)pair.
Links
- Parent:
./Task-rate-limit-and-abuse-guardrails.md - Epic:
./Epic-tenant-lifecycle.md