IP-Based Rate Limiting

public/js/modals.js

@@ -322,6 +322,32 @@ export function openLimitModal() {
   });
 }
 
+export function openGuestRateLimitModal() {
+  openModal(`
+    <div class="modal-header">
+      <span class="modal-title">Unusual request activity detected</span>
+      <button class="modal-close" onclick="import('/js/modals.js').then(m=>m.closeModal())">×</button>
+    </div>
+    <div class="modal-body" style="padding-top:18px;">
+      <div class="limit-modal-inner">
+        <div class="limit-title">Please sign in to continue</div>
+        <div class="limit-desc" style="margin-top:10px;line-height:1.5;">
+          An unusual amount of signed out requests has come from your device. Please sign in, or if this is an error, contact <a href="mailto:incognito.email.mode@gmail.com" style="color:inherit;text-decoration:underline;">incognito.email.mode@gmail.com</a>.
+        </div>
+        <div style="display:flex;gap:10px;justify-content:center;flex-wrap:wrap;margin-top:20px;">
+          <button class="btn-primary" id="guest-rate-limit-signin">Sign In</button>
+          <button class="btn-ghost" id="guest-rate-limit-close">Close</button>
+        </div>
+      </div>
+    </div>
+  `, {
+    onOpen(b) {
+      b.querySelector('#guest-rate-limit-signin').addEventListener('click', () => { closeModal(); openAuthModal('signin'); });
+      b.querySelector('#guest-rate-limit-close').addEventListener('click', () => { closeModal(); });
+    }
+  });
+}
+
 // ── Device session detail modal ───────────────────────────────────────────
 
 export function openDeviceSessionModal(session, isCurrentSession) {
@@ -391,5 +417,6 @@ export function openPasteEditor(content, onSave) {
   });
 }
 
-// Auto-handle limit event
+// Auto-handle limit events
 on('chat:limitReached', () => openLimitModal());
+on('guest:rateLimit', () => openGuestRateLimitModal());

server/wsHandler.js

@@ -25,7 +25,10 @@ export async function handleWsMessage(ws, msg, wsClients) {
 
   if (!client.userId && msg.type !== 'ping' && msg.type !== 'turnstile:verify') {
     const allowed = await consumeGuestRequest(client.ip || 'unknown');
-    if (!allowed) return safeSend(ws, { type: 'error', message: 'Guest request limit exceeded' });
+    if (!allowed) return safeSend(ws, {
+      type: 'guest:rateLimit',
+      message: 'Guest request limit exceeded',
+    });
   }
 
   const h = handlers[msg.type];