BE-116: Tiered Rate Limiting Across Remaining Public Endpoints

[Cedarich]

Labels: Backend, Stellar Wave, rate-limiting, security, api
Complexity: Medium (150)

Description
Rate limiting was added for payment link endpoints, but discovery, username lookup, profile reads, marketplace queries, and export requests remain unlimited. These are the cheapest endpoints to abuse for enumeration. Extend the existing throttler into named tiers applied across the public surface.

Acceptance Criteria

• Named rate limit tiers exist (for example public-read, search, mutation, export) with configurable limits.
• Every public endpoint is assigned a tier, enforced by a test that fails on unassigned routes.
• Limits key on API key when present and fall back to client identity otherwise.
• Exceeded limits return a consistent error body with a retry hint.

[David237-hub]

@David237-hub has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I went through the issue requirements and identified the relevant functionality. I have a solid approach for resolving it and can take care of the implementation and validation

ℹ️ Repo Maintainers: To accept this application, review their application or assign @David237-hub to this issue.

[ryal-net01]

@ryal-net01 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I’d like to work on this. Please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ryal-net01 to this issue.

[sanctus-mvp]

@sanctus-mvp has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I'd love to work on this issue please. I deliver high impact solutions, ensuring seamless workflow and client satisfaction please.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sanctus-mvp to this issue.

[Windowlight]

@Windowlight has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’d like to work on this issue. I’ve reviewed the requirements and understand the work involved. I’ll implement the changes, test them properly, and submit a clean PR. I’m ready to begin.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Windowlight to this issue.

[drips-wave]

Congratulations, @sanctus-mvp! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @sanctus-mvp: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[doctorlight0]

@doctorlight0 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Please, Maintainer, I humbly beg you to assign this issue to me. I desperately need the opportunity, and I promise to work hard and complete it properly. Please consider my request.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @doctorlight0 to this issue.