@@ -123,14 +123,20 @@ public function submit(array $review = [], string $subjectType = '', string $sub
123123 * OpenRegister's enforcement of the predicate. So an arbitrary
124124 * `subjectId` can only ever select from already-approved reviews.
125125 * @spec openspec/specs/catalog-ratings/spec.md#requirement-module-and-dienst-detail-pages-must-display-an-aggregate-rating-computed-only-from-approved-reviews
126+ *
127+ * Rate limit: a read of already-published aggregate review scores — no
128+ * credential, and the data is public by design, so a volume ceiling only.
129+ * Much looser than IntakeController's 5/3600: that one accepts a SUBMISSION,
130+ * this one answers a page render, and a catalogue page listing many subjects
131+ * will legitimately call it repeatedly.
132+ *
133+ * (This note lived between the attributes and the signature, where PHPCS
134+ * reads any comment as the function's doc comment and requires docblock
135+ * syntax. It belongs up here regardless — nothing should sit between an
136+ * attribute list and the thing it annotates.)
126137 */
127138 #[PublicPage]
128139 #[NoCSRFRequired]
129- // A read of already-published aggregate review scores — no credential, and
130- // the data is public by design, so a volume ceiling only. Much looser than
131- // IntakeController's 5/3600: that one accepts a SUBMISSION, this one
132- // answers a page render, and a catalogue page listing many subjects will
133- // legitimately call it repeatedly.
134140 #[AnonRateLimit(limit: 120 , period: 60 )]
135141 public function aggregate (string $ subjectType = '' , string $ subjectId = '' ): JSONResponse {
136142 $ result = $ this ->aggregate ->getAggregate (subjectType: $ subjectType , subjectId: $ subjectId );
0 commit comments