From 4909a9f9d23ad969a03676d87087c1edad632a5d Mon Sep 17 00:00:00 2001
From: bndw <ben@bdw.to>
Date: Sun, 15 Feb 2026 17:10:49 -0800
Subject: fix: track rate limit hits in metrics

- Added RecordRateLimitHit to MetricsRecorder interface
- Call RecordRateLimitHit when EVENT or REQ is rate limited
- Allows dashboard to show accurate rate limiting statistics
- Previously rate limits were applied but not tracked
---
 internal/handler/websocket/handler.go      | 7 +++++++
 internal/handler/websocket/handler_test.go | 1 +
 2 files changed, 8 insertions(+)

(limited to 'internal')

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index c1b23b8..51288bc 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -34,6 +34,7 @@ type MetricsRecorder interface {
 	SetActiveSubscriptions(count int)
 	RecordRequest(method, status string, duration float64)
 	RecordAuthAttempt(success bool)
+	RecordRateLimitHit(authenticated bool)
 	RecordBlockedEvent(kind int32)
 }
 
@@ -274,6 +275,9 @@ func (h *Handler) handleEvent(ctx context.Context, conn *websocket.Conn, raw []j
 		}
 		if !h.limiter.Allow(identifier, "EVENT") {
 			status = "rate_limited"
+			if h.metrics != nil {
+				h.metrics.RecordRateLimitHit(state.authenticatedPubkey != "")
+			}
 			h.sendOK(ctx, conn, event.ID, false, "rate-limited: slow down")
 			return nil
 		}
@@ -386,6 +390,9 @@ func (h *Handler) handleReq(ctx context.Context, conn *websocket.Conn, raw []jso
 		}
 		if !h.limiter.Allow(identifier, "REQ") {
 			status = "rate_limited"
+			if h.metrics != nil {
+				h.metrics.RecordRateLimitHit(state.authenticatedPubkey != "")
+			}
 			return fmt.Errorf("rate limit exceeded")
 		}
 	}
diff --git a/internal/handler/websocket/handler_test.go b/internal/handler/websocket/handler_test.go
index 604a190..2ef72fd 100644
--- a/internal/handler/websocket/handler_test.go
+++ b/internal/handler/websocket/handler_test.go
@@ -98,6 +98,7 @@ func (m *mockMetrics) RecordRequest(method, status string, duration float64) {
 	m.requests[key]++
 }
 func (m *mockMetrics) RecordAuthAttempt(success bool) {}
+func (m *mockMetrics) RecordRateLimitHit(authenticated bool) {}
 func (m *mockMetrics) RecordBlockedEvent(kind int32) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-- 
cgit v1.2.3