feat(media): rate-limit upload endpoint to 10 req/min/IP

routes/api.php

@@ -13,7 +13,7 @@
 use Illuminate\Support\Facades\Route;
 
 Route::post('/uploads/{token}', [UploadController::class, 'store'])
-    ->middleware('signed')
+    ->middleware(['signed', 'throttle:10,1'])
     ->where('token', '[0-9a-f-]{36}')
     ->name('api.uploads.store');
 

tests/Feature/Api/UploadControllerTest.php

@@ -121,3 +121,19 @@ function signedUploadUrl(Workspace $ws, string $token, ?int $expiresInMinutes =
     $response->assertStatus(422);
     expect(Media::where('upload_token', $token)->exists())->toBeFalse();
 });
+
+test('rate limits floods from the same IP', function () {
+    for ($i = 0; $i < 10; $i++) {
+        $this->postJson(
+            signedUploadUrl($this->workspace, (string) Str::uuid()),
+            ['media' => UploadedFile::fake()->image("f{$i}.png", 16, 16)],
+        );
+    }
+
+    $response = $this->postJson(
+        signedUploadUrl($this->workspace, (string) Str::uuid()),
+        ['media' => UploadedFile::fake()->image('over.png', 16, 16)],
+    );
+
+    $response->assertStatus(429);
+});