fix(reliability): restack limiter JSON protocol on protected main

[seonghobae]

Purpose

Restack only the still-valid rate-limiter JSON media-type/protocol hardening from #269 onto the current protected-main lineage without reusing predecessor CI/review/scanner authority.

Test-first construction

• protected main immediately before branch creation: 10f7874f309cb120bc57b8c0cb637d1292650fe0;
• predecessor fix(reliability): harden limiter JSON protocol #269 exact unchanged head: 591a8988894fdef3f98b98c1e1ae6e70c60137dc;
• current RED head: 9aedfb8c43d0c8854de086c50f62f6e0f06c0e97;
• current main src/rate-limit.ts blob is byte-identical to fix(reliability): harden limiter JSON protocol #269's merge-base blob e5b0708ec260a0d52706eae52adc274313bbc56a;
• this RED adds only test/rate-limit-media-type.test.ts, whose import of isJsonMediaType intentionally fails against unchanged protected source.

The predecessor's CodeRabbit finding was validated and resolved on #269, but its COMMENTED review and all predecessor checks remain historical only. This successor will preserve both focused regression files and the narrow production delta only after the RED is observed.

Intended GREEN

The final source must parse only the media-type token, accept exact application/json case-insensitively with ordinary parameters, reject misleading values such as text/plain; profile=application/json, accept limiter decisions only on exact HTTP 200 plus JSON media type, and keep existing decision-schema/fail-closed behavior. No rate-limit semantics or persistence contract changes.

Evidence boundary

Keep Draft through RED→GREEN. Before each write refetch current protected main, exact branch/ref/blob/review/writer state. After GREEN require fresh exact-head application ci, reviewer-ci, protected-base-eligible central Security Scan, 100% configured owned production statement/branch/function/line coverage, and zero valid unresolved findings. Pending/queued/skipped/absent/neutral/failed/cancelled/stale/predecessor/status-only/model-only/rate-limited evidence is non-passing.

No protection weakening, force push, self-approval, repair/self-modifying workflow, release/deployment claim, secret/reviewer invention, or outbound-license decision.

Summary by CodeRabbit

• 버그 수정

  • JSON 미디어 타입을 대소문자, 공백 및 charset을 고려해 정확히 검증합니다.
  • 잘못된 요청 콘텐츠 타입에는 415 오류와 일관된 JSON 오류 응답을 반환합니다.
  • 분산 rate limit 응답은 HTTP 200 및 유효한 JSON 콘텐츠 타입일 때만 처리합니다.
  • 부적절한 상태 코드나 콘텐츠 타입의 응답을 안전하게 거부합니다.

• 테스트

  • 다양한 JSON 콘텐츠 타입과 잘못된 미디어 타입에 대한 검증을 추가했습니다.
  • 분산 rate limit 응답 프로토콜 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 59602a3b-c6db-4b6f-b700-ffcda58a5824

📥 Commits

Reviewing files that changed from the base of the PR and between 1f4964f and f199fda.

📒 Files selected for processing (3)

• src/rate-limit.ts
• test/rate-limit-media-type.test.ts
• test/rate-limit-response-protocol.test.ts

---

📝 Walkthrough

Walkthrough

isJsonMediaType를 추가했습니다. 요청과 Durable Object 응답의 Content-Type 검증을 강화했습니다. Durable Object 응답은 정확한 HTTP 200과 JSON 미디어 타입을 사용해야 합니다. 관련 허용 및 거부 동작을 테스트했습니다.

Changes

JSON 미디어 타입 검증

Layer / File(s)	Summary
JSON 미디어 타입 계약 및 요청 검증 src/rate-limit.ts, test/rate-limit-media-type.test.ts	isJsonMediaType가 매개변수와 대소문자를 처리합니다. 요청은 유효한 JSON 미디어 타입만 허용합니다. 잘못된 타입에는 415와 content_type_required 오류를 반환합니다.
분산 응답 프로토콜 검증 src/rate-limit.ts, test/rate-limit-response-protocol.test.ts	Durable Object 응답은 정확한 HTTP 200과 JSON 미디어 타입을 사용해야 합니다. 조건을 충족하지 않으면 DistributedRateLimitUnavailable 오류를 발생시킵니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to f199f

This localized protocol-hardening change has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant NoemaRateLimiter
  participant DurableObject
  participant ResponseValidator
  NoemaRateLimiter->>DurableObject: 분산 rate-limit 요청
  DurableObject-->>ResponseValidator: HTTP 상태 코드와 Content-Type
  ResponseValidator->>ResponseValidator: HTTP 200 및 JSON 미디어 타입 확인
  ResponseValidator-->>NoemaRateLimiter: 결정 반환 또는 DistributedRateLimitUnavailable 오류

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보호된 main에 rate limiter JSON 프로토콜 강화를 재적용한다는 주요 변경을 명확하게 설명합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rate-limit-content-type-boundary-10f787

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}