stop republishing primal events

1 files changed, 14 insertions, 1 deletions

diff --git a/lib/nwc.ts b/lib/nwc.ts
index facf9dc8..646ed4b0 100644
--- a/lib/nwc.ts
+++ b/lib/nwc.ts
@@ -42,6 +42,11 @@ const nwcEventMaxAgeSeconds = 5 * 60;
 const handledKey = "handled:nwc";
 const handledMaxSize = 200000;
 
+// Per-pubkey rate limiting for NWC requests
+const nwcRateLimit = 5; // max requests per minute per pubkey
+const nwcRateWindow = 60 * 1000; // 1 minute in ms
+const nwcRequestTimes: Map<string, number[]> = new Map();
+
 export default () => {
   let r: any;
 
@@ -50,7 +55,7 @@ export default () => {
 
     r.on("open", async (_) => {
       l("nwc connected to strfry");
-      r.subscribe("nwc", { kinds: [23194], "#p": [serverPubkey, serverPubkey2] });
+      r.subscribe("nwc", { kinds: [23194], "#p": [serverPubkey, serverPubkey2], since: Math.floor(Date.now() / 1000) - nwcEventMaxAgeSeconds });
       const info = await finalizeEvent(
         {
           created_at: Math.floor(Date.now() / 1000),
@@ -94,6 +99,14 @@ export default () => {
       if (ev.created_at && now - ev.created_at > nwcEventMaxAgeSeconds) return;
       if (await db.zScore(handledKey, ev.id)) return;
 
+      // Per-pubkey rate limiting
+      const times = nwcRequestTimes.get(ev.pubkey) || [];
+      const cutoff = Date.now() - nwcRateWindow;
+      const recent = times.filter((t) => t > cutoff);
+      if (recent.length >= nwcRateLimit) return;
+      recent.push(Date.now());
+      nwcRequestTimes.set(ev.pubkey, recent);
+
       db.zAdd(handledKey, { score: now, value: ev.id });
       db.zRemRangeByScore(handledKey, 0, now - nwcEventMaxAgeSeconds);
       const size = await db.zCard(handledKey);