Incident Dossier

Rate-limit bucket shared across users

Support tickets report that whenever one customer exceeds the per-user limit, *every* other customer hitting the same route also sees 429s. The dashboard claims per-user limits are enforced but the gateway appears to throttle by route only.

Initial failing signalsecond user is blocked by first user's trafficExpected behavior: A quiet user is allowed despite another user's traffic. · actual behavior: The quiet user's request is denied by another user's traffic.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Find how the limiter builds the bucket key on each request.
Notice the key shape and what identity information it carries.
Make sure each user has their own bucket while routes still stay distinct.

Focus Mode

Start

src/gateway.js

Likely area

src/gateway.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicReliability

DifficultyMedium

Est. time13 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace