From 9f33177eab84abc3497dee92ca94be468d59e8d4 Mon Sep 17 00:00:00 2001
From: Hampus <hampus@fluxer.app>
Date: Wed, 2 Sep 2026 17:24:58 +0200
Subject: [PATCH] fix(gateway): rate limit resume like identify (#2353)

---
 .../src/gateway/gateway_handler_dispatch.erl   | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/fluxer_gateway/src/gateway/gateway_handler_dispatch.erl b/fluxer_gateway/src/gateway/gateway_handler_dispatch.erl
index b12e41b87..aa277218e 100644
--- a/fluxer_gateway/src/gateway/gateway_handler_dispatch.erl
+++ b/fluxer_gateway/src/gateway/gateway_handler_dispatch.erl
@@ -41,8 +41,12 @@ handle_opcode(identify, _, State) ->
     gateway_handler_encode:close_with_reason(
         already_authenticated, <<"Already authenticated">>, State
     );
-handle_opcode(resume, #{<<"d">> := Data}, State) ->
-    gateway_handler_identify:handle_resume(Data, State);
+handle_opcode(resume, #{<<"d">> := Data}, #{session_pid := undefined} = State) ->
+    handle_rate_limited_resume(Data, State);
+handle_opcode(resume, _, State) ->
+    gateway_handler_encode:close_with_reason(
+        already_authenticated, <<"Already authenticated">>, State
+    );
 handle_opcode(Op, #{<<"d">> := Data}, State) ->
     handle_authenticated_opcode(Op, Data, State);
 handle_opcode(_, _, State) ->
@@ -84,6 +88,16 @@ handle_authenticated_opcode(
 handle_authenticated_opcode(_, _, State) ->
     gateway_handler_encode:close_with_reason(unknown_opcode, <<"Unknown opcode">>, State).
 
+-spec handle_rate_limited_resume(map(), state()) -> ws_result().
+handle_rate_limited_resume(Data, State) ->
+    case session_abuse_protection:check_identify_rate(peer_ip(State)) of
+        {error, identify_rate_limited} ->
+            logger:debug("Holding gateway resume: reason=rate_limited"),
+            {ok, State};
+        ok ->
+            gateway_handler_identify:handle_resume(Data, State)
+    end.
+
 -spec handle_dispatch(
     atom() | binary(), map() | null | {pre_encoded, binary()}, integer(), state()
 ) -> ws_result().