feat: limit message deletion to 100 per request and limit list to 100…

… also
affinidi · Oct 10, 2024 · 7980fe8 · 7980fe8
1 parent 0777430
commit 7980fe8
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/affinidi-messaging-mediator/src/database/list.rs b/affinidi-messaging-mediator/src/database/list.rs
@@ -43,6 +43,8 @@ impl DatabaseHandler {
                 .arg(&key)
                 .arg(start)
                 .arg(end)
+                .arg("COUNT")
+                .arg(100)
                 .query_async(&mut conn)
                 .await
                 .map_err(|err| {

diff --git a/affinidi-messaging-mediator/src/handlers/message_delete.rs b/affinidi-messaging-mediator/src/handlers/message_delete.rs
@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 use tracing::{debug, span, warn, Instrument, Level};
 
 use crate::{
-    common::errors::{AppError, Session, SuccessResponse},
+    common::errors::{AppError, MediatorError, Session, SuccessResponse},
     SharedData,
 };
 
@@ -34,6 +34,16 @@ pub async fn message_delete_handler(
     );
     async move {
         debug!("Deleting ({}) messages", body.message_ids.len());
+        if body.message_ids.len() > 100 {
+            return Err(MediatorError::RequestDataError(
+                session.session_id.clone(),
+                format!(
+                    "Operation exceeds the allowed limit. You may delete a maximum of 100 messages per request. Received {} ids.",
+                    body.message_ids.len()
+                ),
+            )
+            .into());
+        }
         let mut deleted: DeleteMessageResponse = DeleteMessageResponse::default();
 
         for message in &body.message_ids {