Partition pre-authentication rate limits by API-key public ID

[Lucenx9]

Motivation

• The previous implementation used a single process-wide token bucket for pre-authentication attempts, allowing unauthenticated actors to generate syntactically valid tokens and exhaust capacity for all legitimate keys.
• The intent of this change is to preserve pre-auth throttling for repeated attempts while preventing attacker-controlled unknown public IDs from denying service to other public IDs or real keys.

Description

• Replace the single global TokenBucket in AuthenticationRateLimiter with a Map<string, TokenBucket> keyed by the parsed API-key publicId, and change consume() to consume(publicId: string).
• Update rateLimitAuthentication to parse the bearer token first and call limiter.consume(parsed.publicId) only when parsing succeeds (so buckets are partitioned per public id).
• Update unit and security regression tests to reflect the per-public-id behavior, including a unit test that verifies independent refill/limits per public id and a security test that ensures unknown public ids cannot exhaust another key’s limit.

Testing

• Ran static checks: npm run typecheck and npm run lint, both succeeded.
• Ran formatting check: npm run format:check for the modified files, which succeeded.
• Ran unit tests: npm run test:unit -- --run tests/unit/authentication/api-key.test.ts, and the targeted unit tests passed.
• Attempted to run the full security test (tests/security/authentication/bearer-authentication.test.ts) but the suite that requires a PostgreSQL Testcontainer could not start because no container runtime was available in the environment; as a result the security suite failed to execute in CI but the added regression test logic is present and exercised by unit coverage where applicable.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4bc4a9f035

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve an aggregate cap on authentication attempts

An unauthenticated client can generate a fresh syntactically valid 16-character public ID for every request, so every call receives a full new bucket and proceeds through bearerAuthentication to the database-backed findActiveByPublicId query. Consequently, authenticationRequestsPerMinute no longer limits aggregate pre-authentication database work at all; retain an aggregate or non-attacker-controlled limit in addition to the per-ID bucket.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Bound or evict attacker-created rate-limit buckets

When clients rotate valid-format public IDs, each unauthenticated request permanently inserts another entry into this process-wide map. Entries are never removed after their tokens refill or IDs become inactive, allowing remote traffic to grow the heap without bound until the process restarts; add expiry/eviction or a hard capacity rather than retaining every observed ID indefinitely.

Useful? React with 👍 / 👎.