test: Bereinigung des Markdowns festhalten, Ratenbegrenzung nachziehen

Elf Tests halten fest, was nicht durchkommen darf: script-Elemente,
Ereignis-Attribute aus rohem HTML, javascript: als Link und als Bildquelle,
data:text/html. Dazu die Aufloesung relativer Verweise und der Fall
"Bild im Link", der kein a im a erzeugen darf.

Gerendert wird serverseitig - fuer die Frage nach dem erzeugten HTML
braucht es kein DOM. Damit .tsx ueberhaupt laeuft, muss Vitest das JSX
selbst uebersetzen; die tsconfig setzt jsx auf "preserve", weil sonst Next
zustaendig ist. Vite nimmt inzwischen oxc statt esbuild, die esbuild-Option
wuerde stillschweigend ignoriert.

Umsortieren im Brett und das Anlegen von Vorlagen hatten als einzige
schreibende Endpunkte keine Ratenbegrenzung.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/app/api/projects/reorder/route.ts

@@ -3,7 +3,8 @@ import type { Prisma, ProjectStatus } from "@prisma/client";
 import { describeStatus, recordActivities } from "@/lib/activity";
 import { requireUserApi } from "@/lib/auth/guard";
 import { prisma } from "@/lib/db";
-import { readJsonBody } from "@/lib/security/request";
+import { LIMITS, rateLimit } from "@/lib/security/rateLimit";
+import { clientIp, readJsonBody, tooManyRequests } from "@/lib/security/request";
 import { formatZodError, projectReorderSchema } from "@/lib/validation";
 
 export const dynamic = "force-dynamic";
@@ -20,6 +21,13 @@ export async function PATCH(request: Request) {
   const auth = await requireUserApi();
   if (!auth.ok) return auth.response;
 
+  const limited = rateLimit(
+    `mutate:${clientIp(request)}`,
+    LIMITS.mutation.limit,
+    LIMITS.mutation.windowMs,
+  );
+  if (!limited.ok) return tooManyRequests(limited.retryAfter);
+
   const body = await readJsonBody(request);
   if (!body.ok) return body.response;
 

src/app/api/templates/from-project/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { requireUserApi } from "@/lib/auth/guard";
 import { prisma } from "@/lib/db";
-import { jsonError, readJsonBody } from "@/lib/security/request";
+import { LIMITS, rateLimit } from "@/lib/security/rateLimit";
+import { clientIp, jsonError, readJsonBody, tooManyRequests } from "@/lib/security/request";
 import { formatZodError, templateFromProjectSchema } from "@/lib/validation";
 
 export const dynamic = "force-dynamic";
@@ -21,6 +22,13 @@ export async function POST(request: Request) {
   const auth = await requireUserApi();
   if (!auth.ok) return auth.response;
 
+  const limited = rateLimit(
+    `mutate:${clientIp(request)}`,
+    LIMITS.mutation.limit,
+    LIMITS.mutation.windowMs,
+  );
+  if (!limited.ok) return tooManyRequests(limited.retryAfter);
+
   const body = await readJsonBody(request);
   if (!body.ok) return body.response;
 

src/app/api/templates/route.ts

@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { requireUserApi } from "@/lib/auth/guard";
 import { prisma } from "@/lib/db";
-import { jsonError, readJsonBody } from "@/lib/security/request";
+import { LIMITS, rateLimit } from "@/lib/security/rateLimit";
+import { clientIp, jsonError, readJsonBody, tooManyRequests } from "@/lib/security/request";
 import { formatZodError, templateCreateSchema } from "@/lib/validation";
 
 export const dynamic = "force-dynamic";
@@ -25,6 +26,13 @@ export async function POST(request: Request) {
   const auth = await requireUserApi();
   if (!auth.ok) return auth.response;
 
+  const limited = rateLimit(
+    `mutate:${clientIp(request)}`,
+    LIMITS.mutation.limit,
+    LIMITS.mutation.windowMs,
+  );
+  if (!limited.ok) return tooManyRequests(limited.retryAfter);
+
   const body = await readJsonBody(request);
   if (!body.ok) return body.response;