misc: finalized list of license rate limits

backend/src/ee/services/license/licence-fns.ts

@@ -43,13 +43,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   externalKms: false,
   rateLimits: {
     readLimit: 60,
-    publicEndpointLimit: 30,
     writeLimit: 200,
-    secretsLimit: 40,
+    secretsLimit: 40
-    authRateLimit: 60,
-    inviteUserRateLimit: 30,
-    mfaRateLimit: 20,
-    creationLimit: 30
   }
 });
 

backend/src/ee/services/license/license-types.ts

@@ -1,7 +1,5 @@
 import { TOrgPermission } from "@app/lib/types";
 
-import { RateLimitConfiguration } from "../rate-limit/rate-limit-types";
-
 export enum InstanceType {
   OnPrem = "self-hosted",
   EnterpriseOnPrem = "enterprise-self-hosted",
@@ -60,7 +58,11 @@ export type TFeatureSet = {
   caCrl: false;
   instanceUserManagement: false;
   externalKms: false;
-  rateLimits: RateLimitConfiguration;
+  rateLimits: {
+    readLimit: number;
+    writeLimit: number;
+    secretsLimit: number;
+  };
 };
 
 export type TOrgPlansTableDTO = {

backend/src/ee/services/rate-limit/rate-limit-service.ts

@@ -13,8 +13,7 @@ let rateLimitMaxConfiguration: RateLimitConfiguration = {
   secretsLimit: 60,
   authRateLimit: 60,
   inviteUserRateLimit: 30,
-  mfaRateLimit: 20,
+  mfaRateLimit: 20
-  creationLimit: 30
 };
 
 Object.freeze(rateLimitMaxConfiguration);
@@ -67,8 +66,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL
           secretsLimit: rateLimit.secretsRateLimit,
           authRateLimit: rateLimit.authRateLimit,
           inviteUserRateLimit: rateLimit.inviteUserRateLimit,
-          mfaRateLimit: rateLimit.mfaRateLimit,
+          mfaRateLimit: rateLimit.mfaRateLimit
-          creationLimit: rateLimit.creationLimit
         };
 
         logger.info(`syncRateLimitConfiguration: rate limit configuration: %o`, newRateLimitMaxConfiguration);

backend/src/ee/services/rate-limit/rate-limit-types.ts

@@ -23,5 +23,4 @@ export type RateLimitConfiguration = {
   authRateLimit: number;
   inviteUserRateLimit: number;
   mfaRateLimit: number;
-  creationLimit: number;
 };

backend/src/server/config/rateLimiter.ts

@@ -66,14 +66,6 @@ export const mfaRateLimit: RateLimitOptions = {
   }
 };
 
-export const creationLimit: RateLimitOptions = {
-  // identity, project, org
-  timeWindow: 60 * 1000,
-  hook: "preValidation",
-  max: (req) => req.rateLimits.creationLimit,
-  keyGenerator: (req) => req.realIp
-};
-
 // Public endpoints to avoid brute force attacks
 export const publicEndpointLimit: RateLimitOptions = {
   // Read Shared Secrets

backend/src/server/plugins/inject-rate-limits.ts

@@ -27,13 +27,12 @@ export const injectRateLimits = fp(async (server) => {
     // we're using the null coalescing operator in order to handle outdated licenses
     req.rateLimits = {
       readLimit: rateLimits?.readLimit ?? instanceRateLimiterConfig.readLimit,
-      publicEndpointLimit: rateLimits?.publicEndpointLimit ?? instanceRateLimiterConfig.publicEndpointLimit,
       writeLimit: rateLimits?.writeLimit ?? instanceRateLimiterConfig.writeLimit,
       secretsLimit: rateLimits?.secretsLimit ?? instanceRateLimiterConfig.secretsLimit,
-      authRateLimit: rateLimits?.authRateLimit ?? instanceRateLimiterConfig.authRateLimit,
+      publicEndpointLimit: instanceRateLimiterConfig.publicEndpointLimit,
-      inviteUserRateLimit: rateLimits?.inviteUserRateLimit ?? instanceRateLimiterConfig.inviteUserRateLimit,
+      authRateLimit: instanceRateLimiterConfig.authRateLimit,
-      mfaRateLimit: rateLimits?.mfaRateLimit ?? instanceRateLimiterConfig.mfaRateLimit,
+      inviteUserRateLimit: instanceRateLimiterConfig.inviteUserRateLimit,
-      creationLimit: rateLimits?.creationLimit ?? instanceRateLimiterConfig.creationLimit
+      mfaRateLimit: instanceRateLimiterConfig.mfaRateLimit
     };
   });
 });

backend/src/server/routes/v1/identity-router.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { IDENTITIES } from "@app/lib/api-docs";
-import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -16,7 +16,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
     method: "POST",
     url: "/",
     config: {
-      rateLimit: creationLimit
+      rateLimit: writeLimit
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {

backend/src/server/routes/v2/organization-router.ts

@@ -9,7 +9,7 @@ import {
   UsersSchema
 } from "@app/db/schemas";
 import { ORGANIZATIONS } from "@app/lib/api-docs";
-import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
@@ -307,7 +307,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     method: "POST",
     url: "/",
     config: {
-      rateLimit: creationLimit
+      rateLimit: writeLimit
     },
     schema: {
       body: z.object({

backend/src/server/routes/v2/project-router.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { PROJECTS } from "@app/lib/api-docs";
-import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -142,7 +142,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
     method: "POST",
     url: "/",
     config: {
-      rateLimit: creationLimit
+      rateLimit: writeLimit
     },
     schema: {
       description: "Create a new project",