Dev Log: August 10 Wrap-up

Overview

Today was a bit of a mixed bag. I spent most of my time switching between tightening up our frontend security and tweaking some backend rate-limiting logic. It was one of those days where a seemingly simple change—like adjusting a threshold—cascades into a full-blown session of fixing unit tests and managing dependencies.

What I Worked On

Cleaning up Chat Security

I spent some time on the chat interface today. We were previously handling markdown rendering inside the component itself, which felt a bit messy and made the component file way longer than it needed to be. I decided to pull that logic out into a standalone MarkdownPipe.

More importantly, I needed to ensure we're properly handling XSS. When you're rendering raw HTML from markdown, things can get dicey if you aren't careful. Moving this to a pipe let me use DomSanitizer more effectively to keep things safe.

// Refactored the markdown logic into a cleaner, safer pipe
@Pipe({
  name: 'formatMarkdown',
  standalone: true
})
export class FormatMarkdownPipe implements PipeTransform {
  constructor(private sanitizer: DomSanitizer) {}

  transform(value: string): SafeHtml {
    if (!value) return '';
    
    // Simple regex for bolding and code blocks
    let html = value
      .replace(/\*\*([^\*]+?)\*\*/g, '<strong>$1</strong>')
      .replace(/```([\s\S]*?)```/g, '<pre><code>$1</code></pre>');

    return this.sanitizer.bypassSecurityTrustHtml(html);
  }
}

Dialing Back the Limits

On the backend, we decided to be a bit more conservative with our public-facing APIs. I dropped the daily message threshold from 50 down to 20. It’s a significant cut, but necessary for managing resource load on those specific flows.

Of course, updating the limit is the easy part. The real work was updating the RequestFlowDecorator (and its corresponding tests) to handle this. I also had to fix some logic around the daily rollover window—essentially making sure we're correctly resetting the message count once the 24-hour window expires.

The Test Dependency Tussle

I hit a bit of a snag with the unit tests. I realized that our module's dependency chain didn't actually have JUnit or Mockito declared anywhere—I must have been relying on them being provided by the parent project, which isn't always reliable. I ended up having to manually pin junit-jupiter and mockito-core versions in the pom.xml to get the build passing.

There was a moment of "revert and re-apply" while I was trying to figure out why the CI pipeline wasn't picking up the new test cases. Turns out, it was just a missing dependency in the test scope. Once that was sorted, the new test cases for the IP tracking logic finally went green.

Wrapping Up

It feels good to have the chat UI a bit more modular and the backend limits a bit more robust. Tomorrow, I'll probably spend some time monitoring how the new thresholds affect the traffic—hopefully, we haven't set them too low. Catch you then.