From c635ab5f5f20a7b3e89ec80f1397c066b5018a3b Mon Sep 17 00:00:00 2001 From: adonis Date: Tue, 25 Aug 2026 21:43:29 +0330 Subject: [PATCH] fix(api): raise admin rate limit and skip throttle on /admin/p Admin price polling was hitting the shared 60/min IP limit and returning 429 on restore-all. Co-authored-by: Cursor --- app/Providers/RouteServiceProvider.php | 16 +++++++++++++++- routes/admin.php | 3 ++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php index de6593e..0eaa4b0 100644 --- a/app/Providers/RouteServiceProvider.php +++ b/app/Providers/RouteServiceProvider.php @@ -74,7 +74,21 @@ class RouteServiceProvider extends ServiceProvider protected function configureRateLimiting() { RateLimiter::for('api', function (Request $request) { - return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip()); + // throttle قبل از auth اجرا می‌شود → اغلب فقط IP داریم. + // پنل ادمین با polling قیمت (/admin/p) + اکشن سریع به‌راحتی از ۶۰/دقیقه رد می‌شود → ۴۲۹. + if ($request->is('admin/*')) { + return Limit::perMinute(600)->by('admin:'.$request->ip()); + } + + $userId = optional($request->user())->id + ?? optional($request->user('customer'))->id + ?? optional($request->user('user'))->id; + + if ($userId) { + return Limit::perMinute(180)->by((string) $userId); + } + + return Limit::perMinute(60)->by($request->ip()); }); } } diff --git a/routes/admin.php b/routes/admin.php index bcb758a..57c1c2c 100644 --- a/routes/admin.php +++ b/routes/admin.php @@ -32,7 +32,8 @@ use App\Services\ConfigService; Route::middleware('auth:user')->group(function (){ Route::middleware('validation')->group(function (){ - Route::get('/p', [PriceController::class, 'methodPrices']); + Route::get('/p', [PriceController::class, 'methodPrices']) + ->withoutMiddleware(['throttle:api']); //upload file Route::post('/file',[FileController::class, 'store']);