[Bug]: Confusion alert API endpoint has no rate limiting

[Shreya-nipunge]

Bug Description

The confusion alert endpoint (src/app/api/confusion/route.ts) allows authenticated students to submit confusion alerts without any rate limiting or deduplication.

Repeated requests can create many duplicate confusion alerts, causing inaccurate teacher dashboard data and unnecessary database load.

Steps to Reproduce

1. Join a classroom as a student.
2. Send repeated POST requests to /api/confusion with a valid classroom ID and topic.
3. Submit many requests within a short period (for example, 100 requests in 1 second).
4. Open the teacher dashboard.
5. Observe duplicate confusion alerts being displayed.
6. Check the confusionAlerts table and observe multiple duplicate records.

Expected Behavior

The endpoint should limit repeated confusion alerts from the same user and classroom.

For example:

• Allow one alert per user/classroom within a short time window.
• Deduplicate repeated alerts with the same topic.

Actual Behavior

The endpoint accepts unlimited confusion alert submissions, allowing duplicate records and inaccurate dashboard counts.

Screenshots

N/A

Environment

• OS: Any
• Browser: Any modern browser
• Node.js version: Any supported version
• Screen size: Desktop/Mobile

Console Errors

No console errors.

Additional Context

Adding rate limiting and deduplication would improve dashboard accuracy and reduce unnecessary database writes.

[Shreya-nipunge]

Hi @knoxiboy ,

I would like to work on this issue under GSSoC 2026.

Could you please assign this issue to me?

Thank you!

[github-actions]

Hello @Shreya-nipunge! 👋 Thanks for your interest in working on this issue.

We have automatically notified the maintainers for you. They will review your request and officially assign the issue to you shortly if it's available.

Note: Please do not start working or raise a pull request until you are officially assigned!

[github-actions]

✅ Hi @Shreya-nipunge, you have been assigned to this issue! You have 7 days to work on this issue and create a PR. Happy coding! 🚀

[Shreya-nipunge]

Hi @knoxiboy,

I investigated this issue before implementing a fix.

I found that src/app/api/confusion/route.ts has only exposed GET and PATCH handlers since it was introduced (I also checked the git history). There has never been a POST handler for student submissions.

Confusion alerts are actually created by the ConfusionSpikeDetector Inngest function, which already performs cooldown-based deduplication before inserting alerts.

Because of this, I couldn't reproduce the issue as described ("students sending repeated POST requests to /api/confusion"), since no such endpoint currently exists.

I did notice that the existing GET and PATCH endpoints are not rate-limited, which could be a useful hardening improvement, but that doesn't appear to address the reported bug.

Could you please confirm whether:

• this issue refers to an older implementation,
• another endpoint, or
• if you'd prefer this issue to be updated to reflect the current codebase?

Thanks!