fix(errors): browsers get the 429 page, not raw JSON; 403 copy stops contradicting itself #5548
gluecron[bot]🤖 botAI Reviewcommented 6d ago
AI review unavailable
The platform's AI balance is exhausted, so AI generation is temporarily unavailable. Nothing was lost. You can queue this as a repair for the internal agent from the repository's Health page, or try again once the balance is restored. The PR is otherwise unchanged.
ccantynzAI Reviewcommented 6d ago
AI Triage
(no summary)
Priority: medium Risk area: mixed
Suggested labels: (no label suggestions) Suggested reviewers: (no reviewer suggestions)
Suggestions only — nothing has been applied. The PR author stays in control.
Cross-repo impact
See what breaks downstream if this PR merges.
⮌ Merged
This pull request was merged into main.
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts
Queue item #2 from the flow audit.
Rate limiting: the limiter guards browser surfaces (anonymous
/search/nlat 6/min, login, register) yet dumped{"error":"Rate limit exceeded"}into the viewport — while a polished RateLimitPage sat unused, its own docstring documenting the defect. The middleware now content-negotiates:Accept: text/htmlgets the standalone 429 page with the actual refill seconds and the signed-in-multiplier hint; API callers keep the JSON shape and all rate-limit headers. The 400 no-client-address case gets the same treatment.403: ForbiddenPage's body was unconditionally "You're signed in, but…" while its suggestion list correctly branched on
user— a signed-out visitor was told they were signed in and offered a Sign-in link in the same card. The body now branches like the suggestions always did.Typecheck clean; system-states + rate-limit suites 33 pass.