From 6fa8a1f30ad5b75f686c7ff589c6d4d20ce4dd1e Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Wed, 17 Aug 2022 17:08:23 +0200
Subject: [PATCH] downstream: add hard limit on Web Push subscriptions

Each subscription comes with the cost of a HTTP request when
broadcasting a message.
---
 downstream.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/downstream.go b/downstream.go
index d4b879e..a5b7e71 100644
--- a/downstream.go
+++ b/downstream.go
@@ -3336,6 +3336,13 @@ func (dc *downstreamConn) handleMessageRegistered(ctx context.Context, msg *irc.
 				}}
 			}
 
+			if len(subs) > 25 {
+				return ircError{&irc.Message{
+					Command: "FAIL",
+					Params:  []string{"WEBPUSH", "INTERNAL_ERROR", subcommand, "Too many subscriptions"},
+				}}
+			}
+
 			oldSub := findWebPushSubscription(subs, endpoint)
 			if oldSub != nil {
 				// Update the old subscription instead of creating a new one