GraphQL PIN Checker

This GraphQL endpoint enforces a 5-attempt rate limit — but does it apply per query or per batch?

Single query example:

POST /graphql
Content-Type: application/json

{"query": "query($userId:String!,$pin:String!){checkPin(userId:$userId,pin:$pin){success flag error}}",
 "variables": {"userId": "me", "pin": "0000"}}

Batch example (try all 10000 PINs in one request):

[
  {"query": "...", "variables": {"userId": "me", "pin": "0000"}},
  {"query": "...", "variables": {"userId": "me", "pin": "0001"}},
  ...
]

Hint: The rate limiter only resets after a correct guess. Each operation in a batch is a separate "attempt" — but the counter only increments once per batch object resolved.