fix(api): debounce miner dashboard refresh jobs

[JSONbored]

Motivation

• The miner dashboard refresh endpoint previously enqueued heavy build-contributor-decision-packs jobs unconditionally, which can be abused by authenticated sessions to flood the queue and degrade availability.
• The endpoint bypassed the existing debounce/audit guard used elsewhere, so duplicate refresh requests could trigger repeated expensive rebuilds for the same login.
• The refresh path was not classified as an expensive route for rate limiting, so it received the normal (higher) request budget.

Description

• Reused the existing debounce/audit helper by exporting and calling tryEnqueueDecisionPackRebuild(env, login) from the /v1/app/miner-dashboard/refresh handler instead of calling c.env.JOBS.send directly, and return a 503 when enqueueing fails.
• Marked the /v1/app/miner-dashboard/refresh path as an expensive route in routeClassForPath so it is subject to stricter rate limits.
• Added regression test coverage in the integration test to assert duplicate refresh requests only record a single decision_pack.rebuild_enqueued audit event and updated the unit test to expect the refresh route classification.

Testing

• Ran npx vitest run test/unit/auth.test.ts test/integration/api.test.ts --reporter=verbose and observed the updated tests passed.
• Ran npm run typecheck (tsc --noEmit) and the typecheck completed successfully.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#867 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 5 changed file(s) — two independent AI reviewers.

Changed files: src/api/routes.ts, src/auth/rate-limit.ts, src/services/decision-pack.ts, test/integration/api.test.ts, test/unit/auth.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR introduces a debounced enqueue for miner dashboard refresh jobs, updates rate‑limit classification, exports the enqueue helper, and adds tests to verify deduplication and rate‑limit behavior. The changes are small, well‑scoped, and appear correct.

Suggestions

• Add a unit test for the failure path where tryEnqueueDecisionPackRebuild returns false (e.g., job queue unavailable).
• Document the exported tryEnqueueDecisionPackRebuild in the service module’s JSDoc for clarity.
• Consider sanitizing the login field in the 503 error response to avoid leaking user identifiers unnecessarily.

Worth double-checking

• If the pendingDecisionPackRebuilds map is not shared across worker instances, duplicate enqueues could still occur under load.
• Ensure the function always returns a boolean; returning a Promise object directly could cause unexpected truthy values.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR introduces debouncing for miner dashboard refresh jobs to prevent duplicate enqueues. The changes are focused and include necessary updates to the API route, rate limiting, decision pack service, and tests. The overall quality is good.

Suggestions

• Consider adding a comment in src/api/routes.ts explaining the purpose of the tryEnqueueDecisionPackRebuild function call to improve code readability.
• Ensure that the DECISION_PACK_REBUILD_DEBOUNCE_MS constant is well-documented, explaining its purpose and default value.

Worth double-checking

• Verify that the debouncing logic correctly handles edge cases, such as rapid successive requests from the same user.
• Ensure that the rate limiting for the /miner-dashboard/refresh endpoint is appropriately configured to prevent abuse.
• Check that the new test cases in test/integration/api.test.ts cover all possible scenarios, including error handling.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 96.70%. Comparing base (5d9d73a) to head (38f87d7).

Files with missing lines	Patch %	Lines
src/api/routes.ts	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #867      +/-   ##
==========================================
- Coverage   96.71%   96.70%   -0.01%     
==========================================
  Files         108      108              
  Lines       14641    14641              
  Branches     5298     5299       +1     
==========================================
- Hits        14160    14159       -1     
  Misses        102      102              
- Partials      379      380       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.