[laffer1]

Writers were getting 429s from /api/mood, /api/location and /api/security. The entry form loads all three every time it opens. They shared the per-address pages bucket with every page view and API call: 50 per 10 seconds and 300 per 10 minutes.

Change

• pages no longer covers /api/mood, /api/location and /api/security, including /{id}.
• New bucket: a lookups filter gives those three their own per-address bucket, 120 a minute and 1200 an hour. They are small read-only lists, so they stay limited, only more loosely.
• pages and attachments are unchanged otherwise.

Testing

• RateLimitConfigTests runs the real filter against Redis. Two new tests:
  • after the page burst is used up, the lookups still answer 200;
  • the lookups have their own burst of 120, and using it up doesn't touch the page bucket.
• All 7 rate limit tests pass locally against Redis.

Not changed

The general pages limit is still 300 per 10 minutes per address, and /fonts and /xsl count against it. If 429s move to other endpoints, that limit is the next thing to raise.

🤖 Generated with Claude Code

Summary by Sourcery

Separate lookup endpoints from the general page rate limit to prevent entry-form requests from triggering page throttling.

New Features:

• Give mood, location, and security lookup endpoints a dedicated per-address rate limit of 120 requests per minute and 1,200 per hour.

Bug Fixes:

• Prevent lookup requests from being throttled by the general page-view rate limit.

Tests:

• Add Redis-backed rate-limit coverage verifying lookup and page buckets are independent and that lookup endpoints enforce their dedicated burst limit.

[sourcery-ai]

Sorry @laffer1, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 hours and 55 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR updates Bucket4j URL matching so mood, location, and security lookup APIs bypass the shared pages bucket and use a dedicated per-address bucket with 120-per-minute and 1,200-per-hour limits. Redis-backed tests validate that the buckets are isolated, lookup traffic remains available after page throttling, and the existing page limit is unaffected.

File-Level Changes

Change	Details	Files
Separates lookup API traffic from the general page rate-limit bucket and assigns it a dedicated, more permissive per-address limit.	Excludes the mood, location, and security endpoints, including ID subpaths, from the pages filter. Adds a lookups filter with 120 requests per minute and 1,200 per hour using the remote address as the cache key. Leaves the existing pages and attachments behavior unchanged.	src/main/resources/application.yml
Adds Redis-backed integration coverage for rate-limit bucket isolation and lookup capacity.	Verifies lookups remain available after the page burst is exhausted. Verifies the lookup burst rejects excess requests without consuming the pages bucket. Extends test helpers and the test controller to exercise lookup routes and subpaths.	src/test/java/com/justjournal/config/RateLimitConfigTests.java

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[laffer1]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 02414a2...c56693c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Nov 2, 2026 9:16p.m.	Review ↗
Java		Nov 2, 2026 9:16p.m.	Review ↗
Shell		Nov 2, 2026 9:16p.m.	Review ↗
JavaScript		Nov 2, 2026 9:16p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.