[abhinav-phi]

Fixes #750

CheckReactionRateLimit / CheckQuestionRateLimit read the Redis counter, and RecordReaction / RecordQuestion incremented it in a separate call. Two connections sharing one spectator hash could both read a count below the limit and then both record, so the limit could be exceeded.

The check and the record are now one Lua script: INCR, set PEXPIRE on the first increment, and return the new count. AllowReaction / AllowQuestion call it and report whether the action is within the limit. The callers in websocket/debate_spectator.go use the single call.

Tests, with miniredis as a test only dependency:

• 50 concurrent AllowReaction calls allow exactly MaxReactions.
• A question is refused inside the window and allowed after it expires.

go test ./internal/debate/ ./services/ ./utils/
ok  arguehub/internal/debate
ok  arguehub/services
ok  arguehub/utils

Summary by CodeRabbit

• Bug Fixes
  • Question and reaction limits are now applied consistently, including when multiple requests arrive at the same time.
  • Question limits become available again after the configured time window.
  • Requests that exceed a limit, or cannot be checked, are not broadcast.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8d0abff4-ea3f-4147-a706-776732f0167a

Commits

Reviewing files that changed from the base of the PR and between 95b24b5 and a789612.

Files ignored due to path filters: 1

• backend/go.sum is excluded by !**/*.sum

Files selected for processing: 4

• backend/go.mod
• backend/internal/debate/rate_limiter.go
• backend/internal/debate/rate_limiter_test.go
• backend/websocket/debate_spectator.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

Question and reaction rate limits now use a single atomic Redis operation to increment and check counts. The WebSocket handlers use these combined operations, and tests cover concurrent reaction attempts and question-window expiry.

Changes: Spectator rate limits

Layer / File(s)	Summary
Atomic limiter operation and validation backend/internal/debate/rate_limiter.go, backend/internal/debate/rate_limiter_test.go, backend/go.mod	The limiter adds atomic increment-and-expire handling and injectable Redis client support. Tests cover concurrent reaction attempts and question-window expiry. The module adds miniredis and gopher-lua dependencies.
WebSocket question and reaction calls backend/websocket/debate_spectator.go	Question and reaction handlers use the combined limiter operations and return when an operation errors or denies the request.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: rixitgithub

Merge Risk: Minimal · up to a7896

No actionable merge-blocking risk is identified; the change is mergeable after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: making spectator rate-limit enforcement atomic.
Linked Issues check		Issue #750 requires atomic enforcement for question and reaction limits across connections that share a spectator hash. rate_limiter.go now uses one Redis Lua operation for each action. The operatio…
Out of Scope Changes check		The changes remain within Issue #750. The Redis client constructor supports isolated rate-limiter tests. The miniredis and gopher-lua dependencies support those tests. The caller updates, Lua oper…

Full details: Linked Issues check

Explanation

Issue #750 requires atomic enforcement for question and reaction limits across connections that share a spectator hash. rate_limiter.go now uses one Redis Lua operation for each action. The operation increments the counter, sets expiry on the first increment, and returns the new count. debate_spectator.go uses AllowQuestion and AllowReaction without a separate record call. The concurrency test confirms that exactly the configured reaction limit succeeds. The expiry test confirms question-window reset behavior.

Full details: Out of Scope Changes check

Explanation

The changes remain within Issue #750. The Redis client constructor supports isolated rate-limiter tests. The miniredis and gopher-lua dependencies support those tests. The caller updates, Lua operation, and automated tests directly support atomic spectator rate limiting. No unrelated change is shown.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 3 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitcordapp]

Link your account with Gitcord

Thanks for opening this PR, @abhinav-phi!

To receive Discord notifications and contributor tracking for this organization:

1. Join Discord: https://discord.gg/hjUhu33uAn
2. In Discord, run /link abhinav-phi
3. Paste the verification code into your GitHub bio (or a public gist)
4. Click Verify in Discord (or run /verify-link abhinav-phi)

Once linked, Gitcord can notify you about reviews, merges, and more.

— Posted by Gitcord