fix(api): debounce miner dashboard refresh jobs

src/api/routes.ts

@@ -1,4 +1,4 @@
 import { Hono, type Context } from "hono";
 import { z } from "zod";
 import { analyzePRQueue, type AuthorRole, type ChecksStatus } from "../queue-intelligence";
 import { completeGitHubWebOAuth, createSessionFromGitHubToken, pollGitHubDeviceFlow, startGitHubDeviceFlow, startGitHubWebOAuth } from "../auth/github-oauth";
@@ -142,6 +142,7 @@
   CONTRIBUTOR_DECISION_PACK_SIGNAL,
   loadContributorDecisionPackForServing,
   repoDecisionFromPack,
+  tryEnqueueDecisionPackRebuild,
 } from "../services/decision-pack";
 import {
   buildMinerDashboardNextActions,
@@ -1108,8 +1109,8 @@
     if (!login) return c.json({ error: "login_required" }, 400);
     const unauthorized = await requireContributorAccess(c, login);
     if (unauthorized) return unauthorized;
-    const message: JobMessage = { type: "build-contributor-decision-packs", requestedBy: "api", login };
-    await c.env.JOBS.send(message);
+    const queued = await tryEnqueueDecisionPackRebuild(c.env, login);
+    if (!queued) return c.json({ error: "refresh_enqueue_failed", login }, 503);
     return c.json({ status: "queued", login }, 202);
   });
 

src/auth/rate-limit.ts

@@ -1,4 +1,4 @@
 import type { Context } from "hono";
 import { DurableObject } from "cloudflare:workers";
 import { recordAuditEvent } from "../db/repositories";
 import { authenticateInternalToken, authenticatePrivateToken, extractBearerToken, hashToken } from "./security";
@@ -103,6 +103,7 @@
     path.includes("/v1/agent/") ||
     path.includes("/scoring/preview") ||
     path.includes("/decision-pack") ||
+    path.includes("/miner-dashboard/refresh") ||
     path.includes("/open-pr-monitor") ||
     // Maintainer BYOK config: POST /ai-key runs PBKDF2 (100k iters) + an encrypted D1 upsert per request.
     /\/ai-(?:key|review)$/.test(path) ||

src/services/decision-pack.ts

@@ -1,4 +1,4 @@
 import { loadRepoFocusManifests } from "../signals/focus-manifest-loader";
 import type { FocusManifest, FocusManifestIssueDiscoveryPolicy, FocusManifestLinkedIssuePolicy, FocusManifestSource } from "../signals/focus-manifest";
 import { isFocusManifestPublicSafe } from "../signals/focus-manifest";
 import {
@@ -353,7 +353,7 @@
   };
 }
 
-async function tryEnqueueDecisionPackRebuild(env: Env, login: string): Promise<boolean> {
+export async function tryEnqueueDecisionPackRebuild(env: Env, login: string): Promise<boolean> {
   const pending = pendingDecisionPackRebuilds.get(login);
   if (pending) return pending;
   const sinceIso = new Date(Date.now() - DECISION_PACK_REBUILD_DEBOUNCE_MS).toISOString();

test/integration/api.test.ts

@@ -1,4 +1,4 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { createSessionForGitHubUser, hashToken } from "../../src/auth/security";
 import {
   upsertBounty,
@@ -2075,6 +2075,14 @@
     const refreshQueued = await app.request("/v1/app/miner-dashboard/refresh?login=oktofeesh1", { method: "POST", headers: apiHeaders(env) }, env);
     expect(refreshQueued.status).toBe(202);
     await expect(refreshQueued.json()).resolves.toMatchObject({ status: "queued", login: "oktofeesh1" });
+    const refreshDuplicate = await app.request("/v1/app/miner-dashboard/refresh?login=oktofeesh1", { method: "POST", headers: apiHeaders(env) }, env);
+    expect(refreshDuplicate.status).toBe(202);
+    const queuedRefreshRows = (
+      (await env.DB.prepare("SELECT COUNT(*) AS count FROM audit_events WHERE event_type='decision_pack.rebuild_enqueued' AND actor='oktofeesh1'").all()) as {
+        results: Array<{ count: number }>;
+      }
+    ).results;
+    expect(queuedRefreshRows[0]?.count).toBe(1);
     // No ?login → the login resolves from the session actor (covers the session-actor fallback).
     const refreshSelf = await app.request("/v1/app/miner-dashboard/refresh", { method: "POST", headers: { cookie: `gittensory_session=${otherToken}` } }, env);
     expect(refreshSelf.status).toBe(202);

test/unit/auth.test.ts

@@ -1,4 +1,4 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { completeGitHubWebOAuth, createSessionFromGitHubToken, pollGitHubDeviceFlow, startGitHubDeviceFlow, startGitHubWebOAuth } from "../../src/auth/github-oauth";
 import { enforceRateLimit, RateLimiter, routeClassForPath } from "../../src/auth/rate-limit";
 import { authenticatePrivateToken, buildBrowserSessionCookie, createSessionForGitHubUser, extractCookieValue, isAuthorizedGitHubSessionLogin, revokeSession, timingSafeEqual } from "../../src/auth/security";
@@ -85,6 +85,7 @@
     expect(routeClassForPath("/v1/scoring/preview")).toBe("expensive");
     expect(routeClassForPath("/v1/upstream/status")).toBe("expensive");
     expect(routeClassForPath("/v1/contributors/jsonbored/decision-pack")).toBe("expensive");
+    expect(routeClassForPath("/v1/app/miner-dashboard/refresh")).toBe("expensive");
     expect(routeClassForPath("/v1/contributors/jsonbored/open-pr-monitor")).toBe("expensive");
     expect(routeClassForPath("/v1/installations/999/repair/refresh")).toBe("expensive");
     expect(routeClassForPath("/v1/internal/jobs/generate-signal-snapshots")).toBe("expensive");