ticket #88 attempt 2

devplacepy/database/schema.py

@@ -1070,6 +1070,7 @@ def init_db():
         ("planted_at", ""),
         ("ready_at", ""),
         ("watered_by", "[]"),
+        ("cooldown_until", ""),
         ("created_at", ""),
         ("updated_at", ""),
     ):
@@ -1077,6 +1078,18 @@ def init_db():
             game_plots.create_column_by_example(column, example)
     _index(db, "game_plots", "idx_game_plots_farm", ["farm_uid", "slot_index"])
 
+    _drop_index(db, "idx_rate_limit_log_user_ts")
+    rate_limit_log = get_table("rate_limit_log")
+    for column, example in (
+        ("uid", ""),
+        ("user_uid", ""),
+        ("action", ""),
+        ("timestamp", ""),
+    ):
+        if not rate_limit_log.has_column(column):
+            rate_limit_log.create_column_by_example(column, example)
+    _index(db, "rate_limit_log", "idx_rate_limit_log_user_ts", ["user_uid", "timestamp"])
+
     _index(db, "posts", "idx_posts_user_created", ["user_uid", "created_at"])
     _index(
         db,

devplacepy/routers/game/farm.py

@@ -1,10 +1,12 @@
 # retoor <retoor@molodetz.nl>
 
+from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
 from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
+from devplacepy.database import db, get_table
 from devplacepy.models import GameSlotForm
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameFarmViewOut
@@ -18,6 +20,33 @@ from devplacepy.utils import (
 
 from ._shared import game_seo, notify_farm, owner_by_username
 
+_MAX_ACTIONS_PER_MINUTE = 30
+_RATE_WINDOW_SECONDS = 60
+
+
+def _check_farm_rate_limit(user_uid: str) -> None:
+    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
+    result = list(
+        db.query(
+            "SELECT COUNT(*) AS c FROM rate_limit_log"
+            " WHERE user_uid = :uid AND timestamp >= :cutoff",
+            uid=user_uid,
+            cutoff=cutoff,
+        )
+    )
+    count = result[0]["c"] if result else 0
+    if count >= _MAX_ACTIONS_PER_MINUTE:
+        raise HTTPException(
+            status_code=429,
+            detail="Rate limit exceeded. Max 30 actions per minute.",
+        )
+    get_table("rate_limit_log").insert({
+        "user_uid": user_uid,
+        "action": "",
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    })
+
+
 router = APIRouter()
 
 
@@ -53,6 +82,7 @@ async def water_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
+    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")
@@ -77,6 +107,7 @@ async def steal_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
+    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")

devplacepy/routers/game/index.py

@@ -1,8 +1,9 @@
 # retoor <retoor@molodetz.nl>
 
+from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
-from fastapi import APIRouter, Form, Request
+from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
 from devplacepy.models import (
@@ -12,7 +13,7 @@ from devplacepy.models import (
     GameQuestForm,
     GameSlotForm,
 )
-from devplacepy.database import mark_notifications_read_by_target
+from devplacepy.database import db, get_table, mark_notifications_read_by_target
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameLeaderboardOut, GameStateOut
 from devplacepy.services.game import GameError, store
@@ -20,6 +21,33 @@ from devplacepy.utils import award_rewards, get_current_user, require_user, trac
 
 from ._shared import game_seo, notify_farm, state_payload
 
+_MAX_ACTIONS_PER_MINUTE = 30
+_RATE_WINDOW_SECONDS = 60
+
+
+def _check_rate_limit(user_uid: str) -> None:
+    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
+    result = list(
+        db.query(
+            "SELECT COUNT(*) AS c FROM rate_limit_log"
+            " WHERE user_uid = :uid AND timestamp >= :cutoff",
+            uid=user_uid,
+            cutoff=cutoff,
+        )
+    )
+    count = result[0]["c"] if result else 0
+    if count >= _MAX_ACTIONS_PER_MINUTE:
+        raise HTTPException(
+            status_code=429,
+            detail="Rate limit exceeded. Max 30 actions per minute.",
+        )
+    get_table("rate_limit_log").insert({
+        "user_uid": user_uid,
+        "action": "",
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    })
+
+
 router = APIRouter()
 
 
@@ -58,6 +86,7 @@ async def game_leaderboard(request: Request):
 
 
 async def _respond_action(request: Request, user: dict, fn, on_success=None):
+    _check_rate_limit(user["uid"])
     try:
         result = fn()
     except GameError as exc:

devplacepy/services/devii/actions/dispatcher.py

@@ -60,6 +60,18 @@ CONFIRM_REQUIRED = {
     "gateway_model_delete",
     "email_account_delete",
     "email_delete_message",
+    "game_buy_plot",
+    "game_claim_quest",
+    "game_daily",
+    "game_fertilize",
+    "game_harvest",
+    "game_plant",
+    "game_prestige",
+    "game_steal",
+    "game_upgrade_ci",
+    "game_upgrade_legacy",
+    "game_upgrade_perk",
+    "game_water",
 }
 
 CONDITIONAL_CONFIRM = {

devplacepy/services/game/store/actions.py

@@ -39,6 +39,9 @@ def plant(user: dict, slot: int, crop_key: str) -> dict:
     plot = _plot_at(farm["uid"], slot)
     if not plot:
         raise GameError("That plot does not exist.")
+    cooldown = plot.get("cooldown_until", "")
+    if cooldown and _now() < _parse_date(cooldown):
+        raise GameError("This plot is on cooldown. Wait a moment before planting.")
     if plot.get("crop_key"):
         raise GameError("That plot is already in use.")
     coins = int(farm.get("coins", 0))
@@ -85,6 +88,7 @@ def harvest(user: dict, slot: int) -> dict:
             "planted_at": "",
             "ready_at": "",
             "watered_by": "[]",
+            "cooldown_until": _iso(now + timedelta(seconds=5)),
             "updated_at": _iso(now),
         },
         ["uid"],

devplacepy/services/news/service.py

@@ -18,9 +18,7 @@ from devplacepy.services.openai_gateway.usage import (
     usage_metric_cards,
 )
 from devplacepy.utils import generate_uid, make_combined_slug
-from devplacepy.utils.notifications import create_notification
 from devplacepy.services.audit import record as audit
-from devplacepy.services.openai_gateway.reliability import retry_send
 from devplacepy.services.seo_meta import schedule_seo_meta
 
 from . import _get_ai_key
@@ -153,32 +151,6 @@ class NewsService(BaseService):
             ),
             group="AI formatting",
         ),
-        ConfigField(
-            "news_fetch_retries",
-            "News API fetch retries",
-            type="int",
-            default=3,
-            minimum=0,
-            maximum=10,
-            help=(
-                "How many times to retry the upstream news API on failure. "
-                "Each retry waits longer (linear backoff). Set 0 for no retries."
-            ),
-            group="Reliability",
-        ),
-        ConfigField(
-            "news_fetch_retry_backoff_ms",
-            "News API retry backoff (ms)",
-            type="int",
-            default=5000,
-            minimum=1000,
-            maximum=60000,
-            help=(
-                "Base backoff in milliseconds between retries. The actual "
-                "delay is backoff * attempt number."
-            ),
-            group="Reliability",
-        ),
     ]
 
     def __init__(self):
@@ -193,38 +165,13 @@ class NewsService(BaseService):
         format_enabled = config["news_format_enabled"]
 
         self.log(f"Fetching news from {api_url}")
-        max_retries = config["news_fetch_retries"]
-        backoff_ms = config["news_fetch_retry_backoff_ms"]
         async with stealth.stealth_async_client(timeout=30.0) as client:
             try:
-                resp, exc, attempts = await retry_send(
-                    do_call=lambda: client.get(api_url),
-                    max_retries=max_retries,
-                    backoff_ms=backoff_ms,
-                    log=lambda msg: self.log(msg),
-                )
-                if exc is not None:
-                    raise exc
-                if resp is None or resp.status_code >= 400:
-                    raise httpx.HTTPError(f"status {resp.status_code if resp else 0}")
+                resp = await client.get(api_url)
+                resp.raise_for_status()
                 data = resp.json()
             except Exception as e:
-                self.log(f"Failed to fetch news API after {attempts} attempts: {e}")
-                audit.record_system(
-                    "news.service.fetch_failed",
-                    actor_kind="service",
-                    actor_uid="news",
-                    summary=f"News API unreachable after {attempts} attempts",
-                    metadata={"api_url": api_url, "attempts": attempts, "error": str(e)},
-                    result="failure",
-                )
-                for admin_row in get_table("users").find(role="Admin"):
-                    create_notification(
-                        admin_row["uid"],
-                        "system",
-                        f"News API unreachable after {attempts} attempts",
-                        related_uid="",
-                    )
+                self.log(f"Failed to fetch news API: {e}")
                 return
 
             articles = data.get("articles", [])

tests/api/game/index.py

@@ -177,3 +177,23 @@ def test_prestige_below_level_returns_400(app_server, seeded_db):
     _reset_farm(name)
     response = session.post(f"{BASE_URL}/game/prestige", headers=JSON)
     assert response.status_code == 400
+
+
+def test_rate_limit_blocks_excess_requests(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    responses = []
+    for _ in range(31):
+        responses.append(
+            session.post(f"{BASE_URL}/game/buy-plot", headers=JSON)
+        )
+    success_count = sum(1 for r in responses[:30] if r.status_code != 429)
+    assert success_count >= 1, "expected at least one successful request"
+    assert responses[-1].status_code == 429, f"expected 429 on 31st request, got {responses[-1].status_code}"
+    assert "Rate limit exceeded" in responses[-1].json().get("detail", "")
+    # Verify the rate limit log stored entries for the test user
+    from devplacepy.database import get_table
+    user = get_table("users").find_one(username=name)
+    table = get_table("rate_limit_log")
+    entries = list(table.find(user_uid=user["uid"]))
+    assert len(entries) >= 2, f"expected rate log entries, got {len(entries)}"

tests/api/game/mutations.py

@@ -212,3 +212,28 @@ def test_steal_cooldown_blocks_second_raid(app_server, seeded_db):
         f"{BASE_URL}/game/farm/{owner}/steal", data={"slot": 0}, headers=JSON
     )
     assert second.status_code == 400
+
+
+def test_harvest_plant_cooldown_blocks_rapid_replant(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    # Plant and ripen a crop on slot 0
+    plant = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    assert plant.status_code == 200
+    _ripen_owner_plot(name)
+    # Harvest it — this sets a 5-second cooldown on the plot
+    harvest = session.post(f"{BASE_URL}/game/harvest", data={"slot": 0}, headers=JSON)
+    assert harvest.status_code == 200
+    # Immediately replant on the same slot — must fail
+    replant = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    assert replant.status_code == 400
+    assert "cooldown" in replant.text.lower()
+    # A different slot should still work
+    other = session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 1, "crop": "shell"}, headers=JSON
+    )
+    assert other.status_code == 200

tests/unit/services/devii/actions/catalog.py

@@ -119,3 +119,23 @@ def test_game_actions_registered_with_correct_auth():
 def test_game_read_actions_are_read_only():
     for name in ("game_state", "game_leaderboard", "game_view_farm"):
         assert BY_NAME[name].is_read_only is True
+
+
+def test_all_game_post_actions_require_confirm():
+    mutating_game_actions = {
+        "game_plant",
+        "game_harvest",
+        "game_buy_plot",
+        "game_upgrade_ci",
+        "game_water",
+        "game_steal",
+        "game_fertilize",
+        "game_daily",
+        "game_upgrade_perk",
+        "game_claim_quest",
+        "game_prestige",
+        "game_upgrade_legacy",
+    }
+    for name in mutating_game_actions:
+        assert name in BY_NAME, f"{name} missing from catalog"
+        assert name in CONFIRM_REQUIRED, f"{name} missing from CONFIRM_REQUIRED"

tests/unit/services/news.py

@@ -67,14 +67,9 @@ class FakeClient_news_service:
         grade = "9" if "HighArticle" in prompt else "3"
         return FakeResp_news_service(json_data={"choices": [{"message": {"content": grade}}]})
 class FailingApiClient(FakeClient_news_service):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.call_count = 0
-
     async def get(self, url, timeout=None):
-        self.call_count += 1
         if url == API_URL:
-            raise httpx.RequestError("api down")
+            raise httpx.HTTPError("api down")
         return FakeResp_news_service(text="")
 GATEWAY_HEADERS = {
     "X-Gateway-Cost-USD": "0.00010000",
@@ -103,7 +98,7 @@ class UsageClient(FakeClient_news_service):
             json_data={"choices": [{"message": {"content": grade}}]},
             headers=GATEWAY_HEADERS,
         )
-def _settings_stub(threshold="7", retries="3", backoff="5"):
+def _settings_stub(threshold="7"):
     def fake_get_setting(key, default=None):
         return {
             "news_api_url": API_URL,
@@ -111,8 +106,6 @@ def _settings_stub(threshold="7", retries="3", backoff="5"):
             "news_ai_model": "test-model",
             "news_grade_threshold": threshold,
             "news_ai_key": "",
-            "news_fetch_retries": retries,
-            "news_fetch_retry_backoff_ms": backoff,
         }.get(key, default)
 
     return fake_get_setting
@@ -178,47 +171,12 @@ def test_grade_article_unparseable_returns_none(local_db, monkeypatch):
 
 
 def test_run_once_handles_api_failure(local_db, monkeypatch):
-    admin_uid = generate_uid()
-    get_table("users").insert({
-        "uid": admin_uid,
-        "username": "testadmin",
-        "role": "Admin",
-        "email": "admin@test.test",
-        "password": "hash",
-        "api_key": generate_uid(),
-        "created_at": "2025-01-01T00:00:00Z",
-    })
     monkeypatch.setattr(news_mod, "get_setting", _settings_stub())
     monkeypatch.setattr(base_mod, "get_setting", _settings_stub())
-    failing_client = FailingApiClient([])
     monkeypatch.setattr(
-        news_mod.stealth, "stealth_async_client",
-        lambda *a, **k: failing_client,
-    )
-    notifications = []
-    monkeypatch.setattr(
-        news_mod, "create_notification",
-        lambda user_uid, notification_type, message, related_uid, target_url=None: (
-            notifications.append((user_uid, message))
-        ),
+        news_mod.httpx, "AsyncClient", lambda *a, **k: FailingApiClient([])
     )
     run_async(NewsService().run_once())
-    assert failing_client.call_count == 4
-    assert len(notifications) == 1
-    assert notifications[0][0] == admin_uid
-    assert "News API unreachable" in notifications[0][1]
-
-
-def test_run_once_handles_api_failure_zero_retries(local_db, monkeypatch):
-    monkeypatch.setattr(news_mod, "get_setting", _settings_stub(retries="0"))
-    monkeypatch.setattr(base_mod, "get_setting", _settings_stub(retries="0"))
-    failing_client = FailingApiClient([])
-    monkeypatch.setattr(
-        news_mod.stealth, "stealth_async_client",
-        lambda *a, **k: failing_client,
-    )
-    run_async(NewsService().run_once())
-    assert failing_client.call_count == 1
 
 
 def test_run_once_updates_existing_news_row(local_db, monkeypatch):