Charge the server actions the same budget the tools pay (#11)

Rate limiting only ever wrapped MCP tool calls. Every one of those tools has a
browser twin that calls the same service function and paid nothing, so the form
was the cheap way in: thirty POSTs to `draftSiteAction` is thirty page fetches,
thirty LLM calls and thirty VerifiedDR lookups against a monthly quota, where
`submit_site` stops at twenty an hour. `markLinkPlacedAction` is worse in kind
than in cost, since it crawls a URL the caller chose and an uncapped surface
that fetches on demand is a request proxy with our user agent on it.

The five actions now spend the budget of the tool they twin, under that tool's
name and keyed on `member:<id>`, which is the key `callerKey` already builds for
a signed-in caller. One allowance per member across both interfaces rather than
one each. A submit costs two either way: the tool path passes through `guard`
twice, once to draft and once to confirm.

`lib/mcp/limits.ts` moves to `lib/limits.ts`, since it now serves both
interfaces and the ESLint layering rule is about what MCP code may import, not
about who may import it. No budget changed.

Author: nyyhao

CLAUDE.md

@@ -15,7 +15,8 @@ next-app/src/
                   endpoint, api/cron/* are the two scheduled jobs.
   lib/services/   The data-access seam. Everything goes through here.
   lib/db/         Drizzle schema and the per-request connection handle.
-  lib/mcp/        Tool registration and rate-limit budgets. No logic of its own.
+  lib/mcp/        Tool registration. No logic of its own.
+  lib/limits.ts   Per-tool budgets, spent by the tools and the server actions alike.
   lib/exchange.ts Pure domain rules, and enum values derived from the pgEnums.
   components/web/ All shared components, flat, kebab-case, named exports.
   emails/         React Email templates.

next-app/src/app/api/mcp/route.ts

@@ -7,7 +7,7 @@ import {
 import { createMcpHandler, getMcpAuthContext } from "agents/mcp/server";
 
 import { bearerFromHeader, resolveMemberFromBearer } from "@/lib/auth/api-key";
-import { callerKey } from "@/lib/mcp/limits";
+import { callerKey } from "@/lib/limits";
 import { type ToolContext, registerTools } from "@/lib/mcp/tools";
 
 /**

next-app/src/app/app/actions.ts

@@ -1,5 +1,6 @@
 "use server";
 
+import { RateLimited, enforceToolLimit, memberCaller, rateLimitedMessage } from "@/lib/limits";
 import { type LinkBrief, LinkError, type PlacementReport, getLinkBrief, markLinkPlaced } from "@/lib/services/links";
 import { MatchError, respondToMatch } from "@/lib/services/matches";
 import { getSessionMember } from "@/lib/session";
@@ -12,6 +13,12 @@ import { getSessionMember } from "@/lib/session";
  * call the same service functions the tools call, so the two interfaces cannot
  * drift: `respond_to_match` and this file both end up in `respondToMatch`.
  *
+ * Each one spends the budget of the tool it twins, under that tool's name, so a
+ * member has one allowance rather than one per interface. `mark_link_placed` is
+ * the one that matters: it crawls a URL the caller chose, and an uncapped
+ * surface that fetches on demand is a request proxy with our name on the
+ * outbound packets.
+ *
  * Conventions, matching `submit/actions.ts` and `app/key/actions.ts`: file-level
  * "use server", a discriminated union with an "idle" arm, the member fetched
  * first and a `signed_out` arm rather than a redirect, errors RETURNED not
@@ -40,9 +47,12 @@ export async function respondToMatchAction(_previous: RespondState, formData: Fo
     if (!matchId) return { status: "error", matchId, message: "No match was submitted." };
 
     try {
+        await enforceToolLimit("respond_to_match", memberCaller(member.id));
+
         const view = await respondToMatch({ member, matchId, accept, reason: reason || undefined });
         return { status: "done", matchId, accepted: accept, revealed: view.revealed };
     } catch (err) {
+        if (err instanceof RateLimited) return { status: "error", matchId, message: rateLimitedMessage(err) };
         if (err instanceof MatchError) return { status: "error", matchId, message: err.message };
         console.error("dashboard: respondToMatch failed", err);
         return { status: "error", matchId, message: "Could not record that. The error was logged." };
@@ -80,9 +90,12 @@ export async function getLinkBriefAction(_previous: BriefState, formData: FormDa
     if (!matchId) return { status: "error", matchId, message: "No match was submitted." };
 
     try {
+        await enforceToolLimit("get_link_brief", memberCaller(member.id));
+
         const brief = await getLinkBrief({ member, matchId, format });
         return { status: "done", matchId, brief };
     } catch (err) {
+        if (err instanceof RateLimited) return { status: "error", matchId, message: rateLimitedMessage(err) };
         if (err instanceof LinkError) return { status: "error", matchId, message: err.message };
         console.error("dashboard: getLinkBrief failed", err);
         return { status: "error", matchId, message: "Could not build that brief. The error was logged." };
@@ -126,6 +139,8 @@ export async function markLinkPlacedAction(_previous: PlaceState, formData: Form
     }
 
     try {
+        await enforceToolLimit("mark_link_placed", memberCaller(member.id));
+
         const report = await markLinkPlaced({
             member,
             matchId,
@@ -134,6 +149,7 @@ export async function markLinkPlacedAction(_previous: PlaceState, formData: Form
         });
         return { status: "done", matchId, report };
     } catch (err) {
+        if (err instanceof RateLimited) return { status: "error", matchId, message: rateLimitedMessage(err) };
         if (err instanceof LinkError) return { status: "error", matchId, message: err.message };
         console.error("dashboard: markLinkPlaced failed", err);
         return { status: "error", matchId, message: "Could not check that page. The error was logged." };

next-app/src/app/submit/actions.ts

@@ -3,6 +3,7 @@
 import { signDraft, verifyDraft } from "@/app/submit/draft-signature";
 import type { Category } from "@/lib/categories";
 import { AnalyzeError } from "@/lib/contracts";
+import { RateLimited, enforceToolLimit, memberCaller, rateLimitedMessage } from "@/lib/limits";
 import { SiteError, commitSite, draftSite } from "@/lib/services/sites";
 import { getSessionMember } from "@/lib/session";
 
@@ -74,6 +75,11 @@ export async function draftSiteAction(_previous: DraftState, formData: FormData)
     if (!member) return { status: "signed_out", url };
 
     try {
+        // Same bucket the `submit_site` tool spends, because this costs the same
+        // money: a page fetch, an LLM call, and one of a monthly quota of
+        // VerifiedDR lookups. Charged before the work, not after.
+        await enforceToolLimit("submit_site", memberCaller(member.id));
+
         const draft = await draftSite(url);
 
         if (draft.alreadyListed) {
@@ -104,6 +110,7 @@ export async function draftSiteAction(_previous: DraftState, formData: FormData)
 
 /** Mirrors `explain()` in `src/lib/mcp/tools.ts`, word for word where it applies. */
 function explainAnalyzeFailure(err: unknown): string {
+    if (err instanceof RateLimited) return rateLimitedMessage(err);
     if (err instanceof AnalyzeError) {
         const hint =
             err.code === "too_thin"
@@ -213,6 +220,11 @@ export async function commitSiteAction(_previous: CommitState, formData: FormDat
     const placementOffered = String(formData.get("placementOffered") ?? "");
 
     try {
+        // Both halves of a submit are charged, exactly as they are on the tool
+        // path, where the draft call and the confirm call each pass through
+        // `guard`. One submitted listing costs two either way.
+        await enforceToolLimit("submit_site", memberCaller(member.id));
+
         const site = await commitSite({
             member,
             url: draft.url,
@@ -230,6 +242,9 @@ export async function commitSiteAction(_previous: CommitState, formData: FormDat
             outcome: PENDING_REVIEW_OUTCOME,
         };
     } catch (err) {
+        if (err instanceof RateLimited) {
+            return { status: "error", message: rateLimitedMessage(err), field: null };
+        }
         if (err instanceof SiteError) {
             const field =
                 err.code === "invalid_category" || err.code === "unmatchable_category"

next-app/src/lib/db/schema.ts

@@ -336,7 +336,7 @@ export const rateLimits = pgTable(
          * Seconds, not milliseconds, because this is `int4`: epoch ms is about
          * 831 times larger than int4 can hold and would overflow on every
          * write. Lossless for any window of a second or more, which every
-         * budget in `lib/mcp/limits.ts` is. Widen to `bigint` before adding a
+         * budget in `lib/limits.ts` is. Widen to `bigint` before adding a
          * sub-second window.
          */
         windowStart: integer("window_start").notNull(),

next-app/src/lib/mcp/limits.ts next-app/src/lib/limits.tsnext-app/src/lib/mcp/limits.ts renamed to next-app/src/lib/limits.ts

@@ -1,7 +1,16 @@
 import { enforceRateLimit } from "@/lib/rate-limit";
 
 /**
- * @file Rate limiting for the MCP surface.
+ * @file Rate limiting for both interfaces.
+ *
+ * It used to live in `lib/mcp/` and cap the tool surface only, which quietly
+ * made the browser the cheap way in: a server action is a POST endpoint that
+ * anyone signed in can call in a loop, and `draftSiteAction` spends a page
+ * fetch, an LLM call and a VerifiedDR lookup per call exactly as `submit_site`
+ * does. One capped path and one uncapped path to the same service function is
+ * not a budget. The budgets are keyed by the TOOL NAME on purpose, so a member
+ * shares one bucket across both interfaces rather than getting a second
+ * allowance by switching surface.
  *
  * The read tools (`search_partners`, `get_categories`, `get_rules`) answer with
  * no credentials at all. That is deliberate, it is what makes `claude mcp add`
@@ -65,7 +74,7 @@ export class RateLimited extends Error {
  * generously enough that ordinary use never notices them.
  */
 export function callerKey(memberId: string | null, headers: Headers): string {
-    if (memberId) return `member:${memberId}`;
+    if (memberId) return memberCaller(memberId);
     // CF-Connecting-IP is set by Cloudflare's edge on every request it proxies
     // and any inbound copy is overwritten, so it cannot be spoofed by the
     // caller. x-forwarded-for is the fallback for anything not behind the edge
@@ -77,6 +86,31 @@ export function callerKey(memberId: string | null, headers: Headers): string {
     return `ip:${edge || forwarded || headers.get("x-real-ip") || "unknown"}`;
 }
 
+/**
+ * The bucket a signed-in member shares between the two interfaces.
+ *
+ * The browser knows who the caller is before it does anything, so it never
+ * needs the IP fallback in {@link callerKey}. Same string either way, which is
+ * the point: twenty submits from the tool and twenty from the form are forty
+ * submits, not two allowances of twenty.
+ */
+export function memberCaller(memberId: string): string {
+    return `member:${memberId}`;
+}
+
+/**
+ * What a browser surface tells someone who ran out of budget.
+ *
+ * Kept beside the budgets rather than written out at each call site, so the
+ * five server actions cannot end up saying five different things about the same
+ * refusal. The tool surface has its own wording in `explain()`, which is
+ * addressed to a model and tells it to stop looping.
+ */
+export function rateLimitedMessage(err: RateLimited): string {
+    const minutes = Math.max(1, Math.ceil(err.retryAfterSeconds / 60));
+    return `You are doing that faster than the exchange allows. Wait about ${minutes} minute(s) and try again.`;
+}
+
 /**
  * Enforces the budget for one tool call.
  *

next-app/src/lib/mcp/tools.ts

@@ -5,7 +5,7 @@ import { CATEGORIES } from "@/lib/categories";
 import { AnalyzeError } from "@/lib/contracts";
 import type { ExchangeMember } from "@/lib/db/schema";
 import { PLACEMENT_OFFERS } from "@/lib/exchange";
-import { RateLimited, enforceToolLimit } from "@/lib/mcp/limits";
+import { RateLimited, enforceToolLimit } from "@/lib/limits";
 import { getCategoryDepths, getRules } from "@/lib/services/catalog";
 import { LinkError, checkLinks, getLinkBrief, getStanding, markLinkPlaced } from "@/lib/services/links";
 import { MatchError, listMatches, respondToMatch, searchPartners } from "@/lib/services/matches";