From cd31cc8e71ffc253e3f2c13d481f52637ef8f774 Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Tue, 13 Feb 2024 18:57:54 +0530
Subject: [PATCH] fix: throttle conversation search endpoint to prevent abuse

---
 config/initializers/rack_attack.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index 440fc43cb..81422458a 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -154,6 +154,12 @@ class Rack::Attack
     match_data[:account_id] if match_data.present?
   end
 
+  # Prevent abuse of conversation search api
+  throttle('/api/v1/accounts/:account_id/conversations/search', limit: 5, period: 1.minute) do |req|
+    match_data = %r{/api/v1/accounts/(?<account_id>\d+)/conversations/search}.match(req.path)
+    match_data[:account_id] if match_data.present?
+  end
+
   ## ----------------------------------------------- ##
 end