Ask: Rate-limit failed Basic-auth attempts per source IP in the middleware so an exposed instance cannot be brute-forced indefinitely.
Expected files: src/middleware.ts, src/lib/rate-limit.ts
Problem: In DISPATCH_AUTH_MODE=basic, src/middleware.ts validates credentials with no attempt counting — unlimited guesses per IP, no lockout, no backoff. safeEqual prevents timing attacks but not brute force. Mutating API routes are rate-limited, but the auth gate itself is not, and the chart documents a Gateway HTTPRoute example, meaning the UI can be internet-exposed.
Evidence:
src/middleware.ts: the isBasicAuthorized path has no counter, lockout, or backoff; only safeEqual comparisonsrc/lib/rate-limit.ts: in-memory fixed-window limiter exists but is not used by the middleware pathcharts/dispatch/values.yaml: documents optional Gateway API HTTPRoute exposing the app
Acceptance:
- N consecutive failed Basic-auth attempts from the same source IP are rejected (429 or backoff) for the window; a successful auth resets the counter
- Existing basic-mode UI flows and route tests still pass
- Document the per-instance limitation if the limiter stays in-memory
Ask: Rate-limit failed Basic-auth attempts per source IP in the middleware so an exposed instance cannot be brute-forced indefinitely.
Expected files: src/middleware.ts, src/lib/rate-limit.ts
Problem: In
DISPATCH_AUTH_MODE=basic,src/middleware.tsvalidates credentials with no attempt counting — unlimited guesses per IP, no lockout, no backoff.safeEqualprevents timing attacks but not brute force. Mutating API routes are rate-limited, but the auth gate itself is not, and the chart documents a Gateway HTTPRoute example, meaning the UI can be internet-exposed.Evidence:
src/middleware.ts: theisBasicAuthorizedpath has no counter, lockout, or backoff; onlysafeEqualcomparisonsrc/lib/rate-limit.ts: in-memory fixed-window limiter exists but is not used by the middleware pathcharts/dispatch/values.yaml: documents optional Gateway API HTTPRoute exposing the appAcceptance: