Skip to content

fix: disable pod creation in single-user mode #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
melvincarvalho merged 2 commits into from
Apr 3, 2026
Merged

fix: disable pod creation in single-user mode #258

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ae1b194
fix: disable pod creation in single-user mode
melvincarvalho Apr 3, 2026
f6c5f71
fix: use consistent error format for 403 response
melvincarvalho Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions src/server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,15 +472,22 @@ export function createServer(options = {}) {

// Pod creation endpoint with rate limiting
// Limit: 1 pod per IP per day to prevent resource exhaustion and namespace squatting
fastify.post('/.pods', {
config: {
rateLimit: {
max: 1,
timeWindow: '1 day',
keyGenerator: (request) => request.ip
// Disabled in single-user mode
if (singleUser) {
fastify.post('/.pods', async (request, reply) => {

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In single-user mode this route no longer has the per-IP rate limit (1/day) that exists in the non-single-user branch. Even though it always returns 403, removing the limiter is a behavior regression that makes it easier to spam the endpoint (CPU/log noise). Consider keeping the same rateLimit config on the single-user handler as well.

Suggested change
fastify.post('/.pods', async (request, reply) => {
fastify.post('/.pods', {
config: {
rateLimit: {
max: 1,
timeWindow: '1 day',
keyGenerator: (request) => request.ip
}
}
}, async (request, reply) => {

Copilot uses AI. Check for mistakes.
return reply.code(403).send({ error: 'Forbidden', message: 'Pod creation disabled in single-user mode' });
});
} else {
Comment on lines +475 to +480

Copilot AI Apr 3, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change introduces new single-user-specific behavior (POST /.pods must return 403), but there doesn’t appear to be a corresponding automated test covering single-user mode in the existing pod lifecycle tests. Adding a test case would prevent regressions and ensure the behavior stays enforced.

Copilot uses AI. Check for mistakes.
fastify.post('/.pods', {
config: {
rateLimit: {
max: 1,
timeWindow: '1 day',
keyGenerator: (request) => request.ip
}
}
}
}, handleCreatePod);
}, handleCreatePod);
}

// Mashlib CDN mode: redirect chunk requests to CDN
if (mashlibEnabled && mashlibCdn) {
Expand Down