feat: incremental crawl mode with seed-completion gate (0.33.0)

Daemon now auto-detects mode per source: Backfill until the first
full walk records `seed_completed:<source>` in `crawler_state`, then
Incremental (newest-first, stops after N consecutive Unchanged
upserts). `CRAWLER_MODE` overrides to a fixed mode; CLI rejects
`auto` since it has no pre-run DB state.

`Source::discover` returns a lazy `DiscoverWalk` so Incremental can
break out mid-walk without prefetching pages. The drop pass and seed
marker are now gated on a true full walk — fixes a latent soft-drop
of the index tail under partial sweeps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -29,13 +29,6 @@ COOKIE_DOMAIN=
 # get reaped lazily.
 SESSION_TTL_DAYS=30
 
-# ----- Auth brute-force rate limits -----
-# Token-bucket budget shared across /auth/login, /auth/register, and
-# /auth/me/password. Set per_sec=0 to disable (e.g. behind a
-# rate-limiting reverse proxy that already enforces a budget).
-AUTH_RATE_PER_SEC=5
-AUTH_RATE_BURST=10
-
 # ----- CORS -----
 # Comma-separated origins allowed to call the API with credentials.
 # Default is empty: same-origin only. Set when frontend and backend live

.gitea/README.md

@@ -1,71 +0,0 @@
-# Gitea Actions
-
-The [`deploy`](workflows/deploy.yml) workflow runs on every push to `main`
-(and via manual `workflow_dispatch`). It tests, builds, pushes the images
-to a private registry, and rolls the stack over by SSH on the target host.
-
-## Required secrets
-
-Set under *Repo Settings → Actions → Secrets*:
-
-| Name                 | Example                  | Purpose                                                          |
-| -------------------- | ------------------------ | ---------------------------------------------------------------- |
-| `REGISTRY_URL`       | `registry.example.com`   | Registry host. No scheme, no trailing slash.                     |
-| `REGISTRY_USERNAME`  | `mangalord-ci`           | `docker login` user.                                             |
-| `REGISTRY_PASSWORD`  | `<token>`                | `docker login` token/password.                                   |
-| `SSH_HOST`           | `mangalord.example.com`  | Deploy target hostname/IP.                                       |
-| `SSH_USER`           | `deploy`                 | SSH user on the target (must be in the `docker` group).          |
-| `SSH_PRIVATE_KEY`    | `-----BEGIN OPENSSH...`  | Private key authorised in the target user's `authorized_keys`.   |
-| `SSH_PORT`           | `22`                     | Optional. Defaults to `22` if unset.                             |
-
-## Required variables
-
-Set under *Repo Settings → Actions → Variables* (not secrets — they appear
-in logs):
-
-| Name          | Example                  | Purpose                                                                |
-| ------------- | ------------------------ | ---------------------------------------------------------------------- |
-| `DEPLOY_PATH` | `/srv/mangalord`         | Directory on target holding `docker-compose.yml`, `.env`, and the prod overlay. |
-
-## One-time host setup
-
-The workflow assumes the deploy target already has:
-
-1. Docker + Docker Compose v2 installed and the `SSH_USER` in the `docker` group.
-2. `$DEPLOY_PATH/docker-compose.yml` (copy of the repo's [docker-compose.yml](../docker-compose.yml)).
-3. `$DEPLOY_PATH/docker-compose.prod.yml` (copy of the repo's [docker-compose.prod.yml](../docker-compose.prod.yml)).
-4. `$DEPLOY_PATH/.env` populated from [.env.example](../.env.example) with production values (real `POSTGRES_PASSWORD`, `COOKIE_SECURE=true`, etc.).
-
-Bootstrap once:
-
-```bash
-ssh deploy@mangalord.example.com
-sudo mkdir -p /srv/mangalord && sudo chown deploy:deploy /srv/mangalord
-cd /srv/mangalord
-# place docker-compose.yml, docker-compose.prod.yml, and .env here
-```
-
-The first workflow run will pull the images, bring the stack up, and run
-the embedded migrations on startup.
-
-## Image tags
-
-Every push produces three tags per image:
-
-- `mangalord-{backend,frontend}:latest`
-- `mangalord-{backend,frontend}:<git-sha>` — used by the deploy job; lets
-  you pin a deploy to a specific commit
-- `mangalord-{backend,frontend}:<version>` — the version from
-  [backend/Cargo.toml](../backend/Cargo.toml) (verified in lockstep with
-  [frontend/package.json](../frontend/package.json))
-
-## Rollback
-
-SSH to the target, set `IMAGE_TAG` to a previous commit SHA, and re-up:
-
-```bash
-cd /srv/mangalord
-export REGISTRY_URL=registry.example.com
-export IMAGE_TAG=<previous-sha>
-docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
-```

.gitea/workflows/deploy.yml

@@ -1,144 +0,0 @@
-name: deploy
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  test-backend:
-    runs-on: ubuntu-latest
-    container:
-      image: rust:1-slim
-    services:
-      postgres:
-        image: postgres:16-alpine
-        env:
-          POSTGRES_USER: mangalord
-          POSTGRES_PASSWORD: mangalord
-          POSTGRES_DB: mangalord
-        options: >-
-          --health-cmd "pg_isready -U mangalord"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-    env:
-      DATABASE_URL: postgres://mangalord:mangalord@postgres:5432/mangalord
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install build deps
-        run: |
-          apt-get update
-          apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates
-      - name: Cache cargo registry and target
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            backend/target
-          key: cargo-${{ runner.os }}-${{ hashFiles('backend/Cargo.lock') }}
-          restore-keys: |
-            cargo-${{ runner.os }}-
-      - name: cargo test
-        working-directory: backend
-        run: cargo test --locked
-
-  test-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-      - name: npm ci
-        working-directory: frontend
-        run: npm ci
-      - name: vitest
-        working-directory: frontend
-        run: npm test
-
-  build-and-push:
-    runs-on: ubuntu-latest
-    needs: [test-backend, test-frontend]
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
-      version: ${{ steps.meta.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Resolve image tags
-        id: meta
-        run: |
-          version="$(grep -m1 '^version' backend/Cargo.toml | cut -d'"' -f2)"
-          frontend_version="$(grep -m1 '"version"' frontend/package.json | cut -d'"' -f4)"
-          if [ "$version" != "$frontend_version" ]; then
-            echo "Version mismatch: backend=$version frontend=$frontend_version" >&2
-            exit 1
-          fi
-          echo "image_tag=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: docker login
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.REGISTRY_URL }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build & push backend
-        uses: docker/build-push-action@v5
-        with:
-          context: ./backend
-          push: true
-          tags: |
-            ${{ secrets.REGISTRY_URL }}/mangalord-backend:latest
-            ${{ secrets.REGISTRY_URL }}/mangalord-backend:${{ steps.meta.outputs.image_tag }}
-            ${{ secrets.REGISTRY_URL }}/mangalord-backend:${{ steps.meta.outputs.version }}
-          cache-from: type=gha,scope=backend
-          cache-to: type=gha,mode=max,scope=backend
-
-      - name: Build & push frontend
-        uses: docker/build-push-action@v5
-        with:
-          context: ./frontend
-          push: true
-          tags: |
-            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:latest
-            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:${{ steps.meta.outputs.image_tag }}
-            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:${{ steps.meta.outputs.version }}
-          cache-from: type=gha,scope=frontend
-          cache-to: type=gha,mode=max,scope=frontend
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build-and-push
-    steps:
-      - name: SSH deploy
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          port: ${{ secrets.SSH_PORT || 22 }}
-          envs: REGISTRY_URL,REGISTRY_USERNAME,REGISTRY_PASSWORD,IMAGE_TAG,DEPLOY_PATH
-          script_stop: true
-          script: |
-            set -euo pipefail
-            cd "$DEPLOY_PATH"
-            echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" -u "$REGISTRY_USERNAME" --password-stdin
-            export REGISTRY_URL IMAGE_TAG
-            docker compose -f docker-compose.yml -f docker-compose.prod.yml pull
-            docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
-            docker image prune -f
-            docker logout "$REGISTRY_URL"
-        env:
-          REGISTRY_URL: ${{ secrets.REGISTRY_URL }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-          IMAGE_TAG: ${{ needs.build-and-push.outputs.image_tag }}
-          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}

backend/Cargo.lock

@@ -1470,7 +1470,7 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
 
 [[package]]
 name = "mangalord"
-version = "0.35.0"
+version = "0.33.0"
 dependencies = [
  "anyhow",
  "argon2",

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mangalord"
-version = "0.35.0"
+version = "0.33.0"
 edition = "2021"
 default-run = "mangalord"
 

backend/src/api/auth.rs

@@ -80,7 +80,6 @@ async fn register(
     jar: CookieJar,
     Json(input): Json<Credentials>,
 ) -> AppResult<impl IntoResponse> {
-    check_auth_rate_limit(&state, "register")?;
     let username = input.username.trim();
     validate_username(username)?;
     validate_password(&input.password)?;
@@ -96,7 +95,6 @@ async fn login(
     jar: CookieJar,
     Json(input): Json<Credentials>,
 ) -> AppResult<impl IntoResponse> {
-    check_auth_rate_limit(&state, "login")?;
     let username = input.username.trim();
     if username.is_empty() || input.password.is_empty() {
         return Err(AppError::InvalidInput(
@@ -151,7 +149,6 @@ async fn change_password(
     jar: CookieJar,
     Json(input): Json<ChangePassword>,
 ) -> AppResult<impl IntoResponse> {
-    check_auth_rate_limit(&state, "change_password")?;
     if !verify_password(&input.current_password, &user.password_hash) {
         return Err(AppError::Unauthenticated);
     }
@@ -296,33 +293,6 @@ fn build_expired_cookie(cfg: &AuthConfig) -> Cookie<'static> {
     builder.build()
 }
 
-/// Consume one token from the shared auth rate limiter. Called at the
-/// start of `register`, `login`, and `change_password` so credential
-/// stuffing / spraying / username-probe loops are throttled by the
-/// configured budget (default 5/sec with a 10-request burst).
-///
-/// All three endpoints share one bucket — they all expose the same
-/// argon2-verify-or-create work and the same enumeration channels, so
-/// any one of them in a tight loop should trip the limit. `endpoint`
-/// is included in the rate-limit-hit log line so operators can tell
-/// which endpoint is being probed.
-fn check_auth_rate_limit(state: &AppState, endpoint: &'static str) -> AppResult<()> {
-    use crate::auth::rate_limit::AcquireResult;
-    match state.auth_limiter.try_acquire() {
-        AcquireResult::Allowed => Ok(()),
-        AcquireResult::Denied { retry_after_secs } => {
-            tracing::warn!(
-                endpoint,
-                retry_after_secs,
-                "auth rate limit hit; returning 429"
-            );
-            Err(AppError::TooManyRequests {
-                retry_after_secs: Some(retry_after_secs),
-            })
-        }
-    }
-}
-
 fn validate_username(u: &str) -> AppResult<()> {
     if u.is_empty() {
         return Err(AppError::InvalidInput("username is required".into()));

backend/src/app.rs

@@ -12,7 +12,6 @@ use tokio_util::sync::CancellationToken;
 use tower_http::cors::{AllowOrigin, CorsLayer};
 use tower_http::trace::TraceLayer;
 
-use crate::auth::rate_limit::AuthRateLimiter;
 use crate::config::{AuthConfig, Config, CrawlerConfig, CrawlerModePref, UploadConfig};
 use crate::crawler::browser_manager::{self, BrowserManager};
 use crate::crawler::content::{self, SyncOutcome};
@@ -31,10 +30,6 @@ pub struct AppState {
     pub storage: Arc<dyn Storage>,
     pub auth: AuthConfig,
     pub upload: UploadConfig,
-    /// Shared rate limiter guarding the `/auth/*` mutation endpoints.
-    /// One instance per AppState so tests stay isolated across the
-    /// same process.
-    pub auth_limiter: Arc<AuthRateLimiter>,
 }
 
 /// Bundle returned by [`build`]. The router is what `axum::serve` consumes;
@@ -69,13 +64,11 @@ pub async fn build(config: Config) -> anyhow::Result<AppHandle> {
         None
     };
 
-    let auth_limiter = Arc::new(AuthRateLimiter::new(config.auth.rate_limit));
     let state = AppState {
         db,
         storage,
         auth: config.auth.clone(),
         upload: config.upload.clone(),
-        auth_limiter,
     };
     let router = router(state).layer(cors_layer(&config.cors_allowed_origins));
     Ok(AppHandle { router, daemon })

backend/src/auth/mod.rs

@@ -7,5 +7,4 @@
 
 pub mod extractor;
 pub mod password;
-pub mod rate_limit;
 pub mod token;

backend/src/auth/rate_limit.rs

@@ -1,179 +0,0 @@
-//! Per-process token-bucket rate limiter for the auth endpoints.
-//!
-//! Protects `/auth/login`, `/auth/register`, and `/auth/me/password`
-//! from credential stuffing / password spraying / username probing.
-//!
-//! The current deploy puts SvelteKit's hooks.server.ts proxy in front
-//! of axum without forwarding the original client IP (no
-//! `X-Forwarded-For`), so per-IP buckets would all collapse to the
-//! proxy container's address. Until the proxy learns to forward the
-//! peer address, a single global bucket gives equivalent protection
-//! against mass-attack patterns and trades a small DoS surface
-//! (legitimate users sharing the limit) for simplicity.
-//!
-//! Each `AppState` carries its own [`AuthRateLimiter`] instance, so
-//! tests run in isolated buckets and won't bleed across `#[sqlx::test]`
-//! cases that share a process.
-
-use std::sync::Mutex;
-use std::time::Instant;
-
-/// Tunable limits. `per_sec == 0` disables the limiter — used by the
-/// test harness and by anyone who wants to opt out via env config.
-#[derive(Clone, Copy, Debug)]
-pub struct RateLimitConfig {
-    pub per_sec: u32,
-    pub burst: u32,
-}
-
-impl Default for RateLimitConfig {
-    /// Disabled by default. The production `AuthConfig::from_env`
-    /// overrides to a real limit; the test harness keeps the default
-    /// so existing tests don't flake against shared buckets.
-    fn default() -> Self {
-        Self {
-            per_sec: 0,
-            burst: 0,
-        }
-    }
-}
-
-/// Production defaults: 5 requests/sec sustained, 10-request burst.
-/// Tight enough to make brute force impractical, loose enough that a
-/// real user mistyping their password three times in a row doesn't
-/// hit it.
-pub const PRODUCTION_PER_SEC: u32 = 5;
-pub const PRODUCTION_BURST: u32 = 10;
-
-struct Bucket {
-    tokens: f64,
-    last_refill: Instant,
-}
-
-/// Outcome of [`AuthRateLimiter::try_acquire`]. When `Denied`, the
-/// caller can use `retry_after_secs` for a `Retry-After: N` header
-/// (RFC 6585 §4) so well-behaved clients back off correctly rather
-/// than retrying in a tight loop.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum AcquireResult {
-    Allowed,
-    Denied { retry_after_secs: u64 },
-}
-
-/// Single-bucket token-bucket limiter. `try_acquire` is cheap (one
-/// mutex acquire, no allocations) so the auth path doesn't pay a real
-/// cost for the check.
-pub struct AuthRateLimiter {
-    cfg: RateLimitConfig,
-    bucket: Mutex<Bucket>,
-}
-
-impl AuthRateLimiter {
-    pub fn new(cfg: RateLimitConfig) -> Self {
-        Self {
-            cfg,
-            bucket: Mutex::new(Bucket {
-                tokens: cfg.burst as f64,
-                last_refill: Instant::now(),
-            }),
-        }
-    }
-
-    /// Consume one token if available. Returns `Denied` with a
-    /// rounded-up seconds-until-refill so the caller can emit a
-    /// `Retry-After` header.
-    pub fn try_acquire(&self) -> AcquireResult {
-        if self.cfg.per_sec == 0 {
-            return AcquireResult::Allowed;
-        }
-        let now = Instant::now();
-        let mut bucket = self.bucket.lock().expect("rate limiter mutex poisoned");
-        let elapsed = now.duration_since(bucket.last_refill).as_secs_f64();
-        bucket.tokens =
-            (bucket.tokens + elapsed * f64::from(self.cfg.per_sec)).min(f64::from(self.cfg.burst));
-        bucket.last_refill = now;
-        if bucket.tokens >= 1.0 {
-            bucket.tokens -= 1.0;
-            AcquireResult::Allowed
-        } else {
-            // ceil((1 - tokens) / per_sec), minimum 1 — a `Retry-After: 0`
-            // would tell clients to retry immediately, which is what we're
-            // actively trying to discourage.
-            let deficit = 1.0 - bucket.tokens;
-            let wait_secs = (deficit / f64::from(self.cfg.per_sec)).ceil() as u64;
-            AcquireResult::Denied {
-                retry_after_secs: wait_secs.max(1),
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn disabled_limiter_always_allows() {
-        let rl = AuthRateLimiter::new(RateLimitConfig {
-            per_sec: 0,
-            burst: 0,
-        });
-        for _ in 0..1000 {
-            assert_eq!(rl.try_acquire(), AcquireResult::Allowed);
-        }
-    }
-
-    #[test]
-    fn burst_lets_through_initial_window_then_blocks() {
-        // 0 refill, burst 3 → first three pass, fourth blocks.
-        let rl = AuthRateLimiter::new(RateLimitConfig {
-            per_sec: 1,
-            burst: 3,
-        });
-        assert_eq!(rl.try_acquire(), AcquireResult::Allowed);
-        assert_eq!(rl.try_acquire(), AcquireResult::Allowed);
-        assert_eq!(rl.try_acquire(), AcquireResult::Allowed);
-        match rl.try_acquire() {
-            AcquireResult::Denied { retry_after_secs } => {
-                // Bucket is at ~0 tokens, refill rate 1/sec → ~1s wait.
-                assert!(
-                    retry_after_secs >= 1,
-                    "retry_after must be at least 1s, got {retry_after_secs}"
-                );
-            }
-            AcquireResult::Allowed => panic!("fourth request must be denied"),
-        }
-    }
-
-    #[test]
-    fn tokens_refill_over_time() {
-        // 10/sec → after ~120ms we should have at least one token back.
-        let rl = AuthRateLimiter::new(RateLimitConfig {
-            per_sec: 10,
-            burst: 1,
-        });
-        assert_eq!(rl.try_acquire(), AcquireResult::Allowed);
-        assert!(matches!(rl.try_acquire(), AcquireResult::Denied { .. }));
-        std::thread::sleep(std::time::Duration::from_millis(150));
-        assert_eq!(
-            rl.try_acquire(),
-            AcquireResult::Allowed,
-            "token should have refilled"
-        );
-    }
-
-    #[test]
-    fn retry_after_scales_inversely_with_refill_rate() {
-        // 1/sec → wait ~1s after burst exhausted.
-        // 10/sec → wait <1s, but we clamp to a minimum of 1s.
-        let slow = AuthRateLimiter::new(RateLimitConfig {
-            per_sec: 1,
-            burst: 1,
-        });
-        slow.try_acquire();
-        match slow.try_acquire() {
-            AcquireResult::Denied { retry_after_secs } => assert_eq!(retry_after_secs, 1),
-            _ => panic!("expected Denied"),
-        }
-    }
-}

backend/src/config.rs

@@ -21,7 +21,6 @@ pub struct AuthConfig {
     pub cookie_secure: bool,
     pub cookie_domain: Option<String>,
     pub session_ttl_days: i64,
-    pub rate_limit: crate::auth::rate_limit::RateLimitConfig,
 }
 
 impl Default for AuthConfig {
@@ -30,11 +29,6 @@ impl Default for AuthConfig {
             cookie_secure: true,
             cookie_domain: None,
             session_ttl_days: 30,
-            // Disabled by default so the test harness inherits a
-            // non-throttling limiter. Production `from_env` overrides
-            // to the [`PRODUCTION_PER_SEC`]/[`PRODUCTION_BURST`]
-            // defaults.
-            rate_limit: crate::auth::rate_limit::RateLimitConfig::default(),
         }
     }
 }
@@ -141,16 +135,6 @@ impl Config {
                     .ok()
                     .filter(|s| !s.is_empty()),
                 session_ttl_days: env_i64("SESSION_TTL_DAYS", 30),
-                rate_limit: crate::auth::rate_limit::RateLimitConfig {
-                    per_sec: env_u64(
-                        "AUTH_RATE_PER_SEC",
-                        crate::auth::rate_limit::PRODUCTION_PER_SEC.into(),
-                    ) as u32,
-                    burst: env_u64(
-                        "AUTH_RATE_BURST",
-                        crate::auth::rate_limit::PRODUCTION_BURST.into(),
-                    ) as u32,
-                },
             },
             upload: UploadConfig {
                 max_request_bytes: env_usize("MAX_REQUEST_BYTES", 200 * 1024 * 1024),

backend/src/error.rs

@@ -21,11 +21,6 @@ pub enum AppError {
     PayloadTooLarge(String),
     #[error("unsupported media type: {0}")]
     UnsupportedMediaType(String),
-    /// 429 with an optional `Retry-After` header value (in seconds).
-    #[error("too many requests")]
-    TooManyRequests {
-        retry_after_secs: Option<u64>,
-    },
     /// Semantic per-field validation failure. `details` is rendered into the
     /// envelope so the client can highlight the bad field(s).
     #[error("validation failed")]
@@ -56,7 +51,6 @@ impl AppError {
             AppError::Conflict(_) => "conflict",
             AppError::PayloadTooLarge(_) => "payload_too_large",
             AppError::UnsupportedMediaType(_) => "unsupported_media_type",
-            AppError::TooManyRequests { .. } => "too_many_requests",
             AppError::ValidationFailed { .. } => "validation_failed",
             AppError::Database(sqlx::Error::RowNotFound) => "not_found",
             AppError::Database(_) => "internal_error",
@@ -85,31 +79,6 @@ impl IntoResponse for AppError {
             AppError::UnsupportedMediaType(msg) => {
                 (StatusCode::UNSUPPORTED_MEDIA_TYPE, msg.clone(), None)
             }
-            AppError::TooManyRequests { retry_after_secs } => {
-                // Emit `Retry-After: N` (RFC 6585 §4) so a well-behaved
-                // client can back off correctly. Done by building the
-                // response by hand below — the `(status, headers,
-                // body)` tuple shape doesn't fit the standard
-                // `(status, body)` IntoResponse path for the other
-                // variants.
-                let body = json!({
-                    "error": {
-                        "code": code,
-                        "message": "too many requests; slow down",
-                    }
-                });
-                let mut resp = (StatusCode::TOO_MANY_REQUESTS, Json(body)).into_response();
-                if let Some(secs) = retry_after_secs {
-                    // `HeaderValue: From<u64>` skips both the
-                    // intermediate `String` allocation and the
-                    // fallible-by-shape `from_str` path.
-                    resp.headers_mut().insert(
-                        axum::http::header::RETRY_AFTER,
-                        axum::http::HeaderValue::from(*secs),
-                    );
-                }
-                return resp;
-            }
             AppError::ValidationFailed { message, details } => (
                 StatusCode::UNPROCESSABLE_ENTITY,
                 message.clone(),

backend/tests/api_auth.rs

@@ -567,81 +567,6 @@ async fn user_a_cannot_delete_user_b_token(pool: PgPool) {
     assert_eq!(resp.status(), StatusCode::NO_CONTENT);
 }
 
-/// Brute-force / spray protection: at default production limits, a
-/// tight loop of /auth/login attempts should burst through the bucket
-/// and then 429 every subsequent request until the bucket refills.
-#[sqlx::test(migrations = "./migrations")]
-async fn login_rate_limited_under_burst_pressure(pool: PgPool) {
-    let h = common::harness_with_auth_rate_limit(pool, 1, 3);
-
-    // Register a victim so the wrong-password branch is real work.
-    let _ = h
-        .app
-        .clone()
-        .oneshot(common::post_json("/api/v1/auth/register", creds("victim")))
-        .await
-        .unwrap();
-
-    // Register consumed one token from the burst-3 bucket. Fire 30
-    // wrong-password logins back-to-back; with per_sec=1 the refill
-    // is too slow to keep up and at least one must come back 429.
-    let mut saw_429 = false;
-    for _ in 0..30 {
-        let resp = h
-            .app
-            .clone()
-            .oneshot(common::post_json(
-                "/api/v1/auth/login",
-                json!({ "username": "victim", "password": "wrong" }),
-            ))
-            .await
-            .unwrap();
-        if resp.status() == StatusCode::TOO_MANY_REQUESTS {
-            // RFC 6585 §4: 429 SHOULD include a Retry-After header. The
-            // value is in seconds; with per_sec=1 the bucket needs ~1s
-            // to refill, so the header should be 1 or 2.
-            let retry_after = resp
-                .headers()
-                .get(axum::http::header::RETRY_AFTER)
-                .and_then(|v| v.to_str().ok())
-                .and_then(|s| s.parse::<u32>().ok())
-                .expect("Retry-After header present and numeric");
-            assert!(
-                retry_after >= 1,
-                "Retry-After must be at least 1s, got {retry_after}"
-            );
-            let body = common::body_json(resp).await;
-            assert_eq!(body["error"]["code"], "too_many_requests");
-            saw_429 = true;
-            break;
-        }
-    }
-    assert!(
-        saw_429,
-        "expected at least one 429 within 30 rapid login attempts"
-    );
-}
-
-/// Default (test-harness) limits are disabled, so existing tests that
-/// fire multiple auth requests don't start failing.
-#[sqlx::test(migrations = "./migrations")]
-async fn default_test_harness_does_not_rate_limit(pool: PgPool) {
-    let h = common::harness(pool);
-    for i in 0..50 {
-        let resp = h
-            .app
-            .clone()
-            .oneshot(common::post_json(
-                "/api/v1/auth/login",
-                json!({ "username": format!("nobody-{i}"), "password": "x" }),
-            ))
-            .await
-            .unwrap();
-        // None of these should be 429 — only 401.
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED, "iter {i}");
-    }
-}
-
 #[sqlx::test(migrations = "./migrations")]
 async fn delete_unknown_token_is_404(pool: PgPool) {
     let h = common::harness(pool);

backend/tests/common/mod.rs

@@ -15,7 +15,6 @@ use tempfile::TempDir;
 use tower::ServiceExt;
 
 use mangalord::app::{router, AppState};
-use mangalord::auth::rate_limit::AuthRateLimiter;
 use mangalord::config::{AuthConfig, UploadConfig};
 use mangalord::storage::{LocalStorage, Storage, StorageError, StreamingFile};
 
@@ -50,51 +49,20 @@ fn harness_inner(
     storage: Arc<dyn Storage>,
     storage_dir: TempDir,
 ) -> Harness {
-    harness_with_auth_config(pool, storage, storage_dir, AuthConfig {
-        cookie_secure: false,
-        ..AuthConfig::default()
-    })
-}
-
-fn harness_with_auth_config(
-    pool: PgPool,
-    storage: Arc<dyn Storage>,
-    storage_dir: TempDir,
-    auth: AuthConfig,
-) -> Harness {
-    let auth_limiter = Arc::new(AuthRateLimiter::new(auth.rate_limit));
     let state = AppState {
         db: pool,
         storage,
-        auth,
+        auth: AuthConfig { cookie_secure: false, ..AuthConfig::default() },
         upload: UploadConfig {
             // Keep file caps small in tests so the size-cap path is cheap to
             // exercise without producing tens of MBs of bytes.
             max_request_bytes: 4 * 1024 * 1024,
             max_file_bytes: 256 * 1024,
         },
-        auth_limiter,
     };
     Harness { app: router(state), _storage_dir: storage_dir }
 }
 
-/// Like [`harness`] but configures a tight auth rate limit. Used by
-/// the brute-force-rate-limiting test.
-pub fn harness_with_auth_rate_limit(
-    pool: PgPool,
-    per_sec: u32,
-    burst: u32,
-) -> Harness {
-    let storage_dir = tempfile::tempdir().expect("tempdir");
-    let storage = Arc::new(LocalStorage::new(storage_dir.path()));
-    let auth = AuthConfig {
-        cookie_secure: false,
-        rate_limit: mangalord::auth::rate_limit::RateLimitConfig { per_sec, burst },
-        ..AuthConfig::default()
-    };
-    harness_with_auth_config(pool, storage, storage_dir, auth)
-}
-
 /// Wraps a real `Storage` and fails on the N-th `put` call so tests can
 /// assert that handlers roll their DB writes back when storage errors
 /// mid-upload. Reads and other operations delegate to `inner`.

docker-compose.prod.yml

@@ -1,22 +0,0 @@
-# Production overlay: layer on top of docker-compose.yml on the deploy
-# host so the backend and frontend run from pre-built registry images
-# instead of building locally.
-#
-#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
-#
-# REGISTRY_URL and IMAGE_TAG are injected by .gitea/workflows/deploy.yml
-# at deploy time. IMAGE_TAG defaults to `latest` so a manual
-# `docker compose ... up -d` on the host still works.
-
-services:
-  backend:
-    build: !reset null
-    image: ${REGISTRY_URL}/mangalord-backend:${IMAGE_TAG:-latest}
-    pull_policy: always
-    restart: unless-stopped
-
-  frontend:
-    build: !reset null
-    image: ${REGISTRY_URL}/mangalord-frontend:${IMAGE_TAG:-latest}
-    pull_policy: always
-    restart: unless-stopped

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mangalord-frontend",
-  "version": "0.35.0",
+  "version": "0.33.0",
   "private": true,
   "type": "module",
   "scripts": {