Admin endpoint: ENV/file admin key, --reset-admin-key, settings API wired into ratelimit/max-bytes/default-expiry/burn-window (#40)

ratelimit.go

@@ -59,9 +59,20 @@ func clientIP(r *http.Request) string {
 
 var globalLimiter = newLimiter()
 
-// rateLimitCreate: 1 req/sec refill, burst 5, per IP.
+// globalSettingsFn is set at startup; tests can point it at fixed settings.
+var globalSettingsFn func() Settings
+
+func globalSettings() Settings {
+	if globalSettingsFn != nil {
+		return globalSettingsFn()
+	}
+	return defaultSettings(Config{})
+}
+
+// rateLimitCreate uses the admin-tunable burst and per-minute refill (#40).
 func rateLimitCreate(r *http.Request) bool {
-	return globalLimiter.allow("create:"+clientIP(r), 1, 5)
+	s := globalSettings()
+	return globalLimiter.allow("create:"+clientIP(r), s.RateLimitPerMinute/60.0, s.RateLimitBurst)
 }
 
 // rateLimitGuess: 1 req/sec refill, burst 5, per IP.