fix:小组件- PUSH

server/app/api/limits.py

@@ -47,6 +47,7 @@ class FixedWindowRateLimiter:
 
 
 _reco_rate_limiter = FixedWindowRateLimiter(limit=10, window_seconds=60)
+_push_rate_limiter = FixedWindowRateLimiter(limit=30, window_seconds=60)
 
 
 async def rate_limit_reco_by_ip(request: Request) -> None:
@@ -60,3 +61,19 @@ async def rate_limit_reco_by_ip(request: Request) -> None:
 
     _reco_rate_limiter.allow(key=ip, now_ts=time.time())
 
+
+async def rate_limit_push_by_ip(request: Request) -> None:
+    """
+    推送相关接口限流：按 IP，1 分钟 30 次。
+
+    说明：
+    - register/preferences 等接口可能在客户端反复重试
+    - 本期先用内存固定窗口限流做基础保护
+    """
+
+    ip = "unknown"
+    if request.client and request.client.host:
+        ip = str(request.client.host)
+
+    _push_rate_limiter.allow(key=ip, now_ts=time.time())
+