Many resource handlers are missing the RATE_LIMITED flag as per the spec.

[jevolk]

Resolving this issue involves going through the handlers in the modules/ tree alongside the matrix client and server specification to flag methods required to be rate-limited. Currently some are, but many are not.

Example of a method with the flag:

resource::method
method
{
    resource, "GET", handler,
    {
        method.REQUIRES_AUTH |
        method.RATE_LIMITED
    }
};

[kamathmanu]

Hello! I'm interested in contributing to the project and was looking for nice issues that would let me get into the codebase. This issue was opened quite a while ago, is this issue still something that I can work on?

[jevolk]

This issue is still unfinished and would certainly appreciate your contribution! The logic for the actual rate-limiting itself is not in place so after adding these flags there won't be a testable difference; nevertheless adding the logic without the flags either would be equally useless. So one has to go first :) Feel free to inquire further here or in #test:zemos.net

Thank you!

[danilsatchkov]

I am also looking to contribute. Couple of questions.

1. When I tried to use the Synapse server in python, I noticed that it generates an incredible amount of what seems to be useless data. Typically, the table event_json and some others. How is the disk space use with construct?
2. Do you think it is possible to scale Construct to handle thousands of users? Devs on synapse claim that they have a configuration that can handle 50k users (very hard to believe). But regardless. Is there a plan to make construct more scalable and how feasible would that be?

Would love to help out!

[yangm97]

@danilsatchkov

1. Construct has been very space efficient for me (single user, joined most of the big rooms at the matrix.org directory, one year and going, ~30GB). Construct has an embedded rocksdb database which allowed some very deep schema optimizations for the matrix workload.
2. Are those trusted users? Because, as far as I know, currently the biggest concern with multi-user construct deployments lies within the security boundaries from local users.

[danilsatchkov]

@danilsatchkov

1. Construct has been very space efficient for me (single user, joined most of the big rooms at the matrix.org directory, one year and going, ~30GB). Construct has an embedded rocksdb database which allowed some very deep schema optimizations for the matrix workload.
2. Are those trusted users? Because, as far as I know, currently the biggest concern with multi-user construct deployments lies within the security boundaries from local users.

For #2, do you know if that is different from something like Synapse? Meaning does Synapse have the same issues with security?