feat: custom rate limit for self hosters

backend/src/server/app.ts

@@ -69,7 +69,7 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => {
 
     // Rate limiters and security headers
     if (appCfg.isProductionMode) {
-      await server.register<FastifyRateLimitOptions>(ratelimiter, globalRateLimiterCfg());
+      await server.register<FastifyRateLimitOptions>(ratelimiter, await globalRateLimiterCfg(db));
     }
     await server.register(helmet, { contentSecurityPolicy: false });
 

backend/src/server/config/rateLimiter.ts

@@ -1,22 +1,10 @@
 import type { RateLimitOptions, RateLimitPluginOptions } from "@fastify/rate-limit";
 import { Redis } from "ioredis";
+import { Knex } from "knex";
 
 import { getConfig } from "@app/lib/config/env";
-
-export const globalRateLimiterCfg = (): RateLimitPluginOptions => {
-  const appCfg = getConfig();
-  const redis = appCfg.isRedisConfigured
-    ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 })
-    : null;
-
-  return {
-    timeWindow: 60 * 1000,
-    max: 600,
-    redis,
-    allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status",
-    keyGenerator: (req) => req.realIp
-  };
-};
+import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal";
+import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service";
 
 // GET endpoints
 export const readLimit: RateLimitOptions = {
@@ -74,3 +62,38 @@ export const publicEndpointLimit: RateLimitOptions = {
   max: 30,
   keyGenerator: (req) => req.realIp
 };
+
+async function fetchRateLimitsFromDb(db: Knex) {
+  try {
+    const rateLimitDAL = rateLimitDALFactory(db);
+    const rateLimits = await rateLimitServiceFactory({ rateLimitDAL }).getRateLimits();
+
+    readLimit.max = rateLimits.readRateLimit;
+    publicEndpointLimit.max = rateLimits.publicEndpointLimit;
+    writeLimit.max = rateLimits.writeRateLimit;
+    secretsLimit.max = rateLimits.secretsRateLimit;
+    authRateLimit.max = rateLimits.authRateLimit;
+    inviteUserRateLimit.max = rateLimits.inviteUserRateLimit;
+    mfaRateLimit.max = rateLimits.mfaRateLimit;
+    creationLimit.max = rateLimits.creationLimit;
+  } catch (error) {
+    console.error("Error fetching rate limits:", error);
+  }
+}
+
+export const globalRateLimiterCfg = async (db: Knex): Promise<RateLimitPluginOptions> => {
+  const appCfg = getConfig();
+  const redis = appCfg.isRedisConfigured
+    ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 })
+    : null;
+
+  await fetchRateLimitsFromDb(db);
+
+  return {
+    timeWindow: 60 * 1000,
+    max: 600,
+    redis,
+    allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status",
+    keyGenerator: (req) => req.realIp
+  };
+};

backend/src/server/routes/index.ts

@@ -121,6 +121,8 @@ import { projectMembershipServiceFactory } from "@app/services/project-membershi
 import { projectUserMembershipRoleDALFactory } from "@app/services/project-membership/project-user-membership-role-dal";
 import { projectRoleDALFactory } from "@app/services/project-role/project-role-dal";
 import { projectRoleServiceFactory } from "@app/services/project-role/project-role-service";
+import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal";
+import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service";
 import { dailyResourceCleanUpQueueServiceFactory } from "@app/services/resource-cleanup/resource-cleanup-queue";
 import { secretDALFactory } from "@app/services/secret/secret-dal";
 import { secretQueueFactory } from "@app/services/secret/secret-queue";
@@ -185,6 +187,7 @@ export const registerRoutes = async (
   const incidentContactDAL = incidentContactDALFactory(db);
   const orgRoleDAL = orgRoleDALFactory(db);
   const superAdminDAL = superAdminDALFactory(db);
+  const rateLimitDAL = rateLimitDALFactory(db);
   const apiKeyDAL = apiKeyDALFactory(db);
 
   const projectDAL = projectDALFactory(db);
@@ -444,6 +447,9 @@ export const registerRoutes = async (
     orgService,
     keyStore
   });
+  const rateLimitService = rateLimitServiceFactory({
+    rateLimitDAL
+  });
   const apiKeyService = apiKeyServiceFactory({ apiKeyDAL, userDAL });
 
   const secretScanningQueue = secretScanningQueueFactory({
@@ -859,6 +865,7 @@ export const registerRoutes = async (
     secret: secretService,
     secretReplication: secretReplicationService,
     secretTag: secretTagService,
+    rateLimit: rateLimitService,
     folder: folderService,
     secretImport: secretImportService,
     projectBot: projectBotService,

backend/src/server/routes/v1/index.ts

@@ -17,6 +17,7 @@ import { registerProjectEnvRouter } from "./project-env-router";
 import { registerProjectKeyRouter } from "./project-key-router";
 import { registerProjectMembershipRouter } from "./project-membership-router";
 import { registerProjectRouter } from "./project-router";
+import { registerRateLimitRouter } from "./rate-limit-router";
 import { registerSecretFolderRouter } from "./secret-folder-router";
 import { registerSecretImportRouter } from "./secret-import-router";
 import { registerSecretSharingRouter } from "./secret-sharing-router";
@@ -43,6 +44,7 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(registerPasswordRouter, { prefix: "/password" });
   await server.register(registerOrgRouter, { prefix: "/organization" });
   await server.register(registerAdminRouter, { prefix: "/admin" });
+  await server.register(registerRateLimitRouter, { prefix: "/rate-limit" });
   await server.register(registerUserRouter, { prefix: "/user" });
   await server.register(registerInviteOrgRouter, { prefix: "/invite-org" });
   await server.register(registerUserActionRouter, { prefix: "/user-action" });

backend/src/server/routes/v1/rate-limit-router.ts

@@ -0,0 +1,58 @@
+import { z } from "zod";
+
+import { RateLimitSchema } from "@app/db/schemas";
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerRateLimitRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      response: {
+        200: z.object({
+          rateLimit: RateLimitSchema
+        })
+      }
+    },
+    handler: async () => {
+      const rateLimit = await server.services.rateLimit.getRateLimits();
+      return { rateLimit };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: (req, res, done) => {
+      verifyAuth([AuthMode.JWT, AuthMode.API_KEY])(req, res, () => {
+        verifySuperAdmin(req, res, done);
+      });
+    },
+
+    schema: {
+      body: RateLimitSchema.omit({
+        id: true,
+        createdAt: true,
+        updatedAt: true
+      }),
+      response: {
+        200: z.object({
+          rateLimit: RateLimitSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const rateLimit = await server.services.rateLimit.updateRateLimit(req.body);
+      return { rateLimit };
+    }
+  });
+};