Lukas 7308ff88d6 fix(rate-limit): stop double-counting requests in middleware ...

Multiple RateLimitMiddleware instances were each calling
check_allowed() on every request, halving the effective global
limit (200 req/min became ~100). Added path_prefixes and skip_paths
so each instance only checks the paths it owns.

- Auth middleware scoped to /api/v1/auth/login and /api/v1/setup
- History middleware scoped to /api/v1/history
- Global middleware skips auth and history paths
- Updated tests to match single-count behavior

2026-05-15 23:04:02 +02:00

6.9 KiB

Raw Blame History

View Raw