chore: remove rate limiter for functions by ggazzo · Pull Request #38354 · RocketChat/Rocket.Chat

ggazzo · 2026-01-26T21:11:29Z

code extracted from #38017

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Summary by CodeRabbit

New Features
- Added per-route rate limits: profile updates limited to 1 request/60s; status updates limited to 5 requests/60s.
Refactor
- Streamlined rate-limiting and simplified email, display-name, and status update paths for clearer behavior and maintenance.
- Removed legacy helper that previously wrapped rate-limited calls.
Tests
- Updated unit tests to align with the refactored implementations.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

…rate limiter for setEmail function

…Text function

dionisio-bot · 2026-01-26T21:11:34Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is targeting the wrong base branch. It should target 8.2.0, but it targets 8.1.0

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

changeset-bot · 2026-01-26T21:11:35Z

⚠️ No Changeset found

Latest commit: d2e37a1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-01-26T21:11:43Z

Walkthrough

Added per-route rateLimiterOptions to two user API endpoints; removed function-level RateLimiter wrappers and exported setter functions directly (setRealName, setEmail, setStatusText); updated call sites and tests to use the new exports; removed limitFunction from the RateLimiter implementation.

Changes

Cohort / File(s)	Summary
API Route Rate Limiting `apps/meteor/app/api/server/v1/users.ts`	Added `rateLimiterOptions` to `users.updateOwnBasicInfo` (1 req / 60000 ms) and `users.setStatus` (5 req / 60000 ms).
Function Export Refactoring `apps/meteor/app/lib/server/functions/setRealName.ts`, `apps/meteor/app/lib/server/functions/setEmail.ts`, `apps/meteor/app/lib/server/functions/setStatusText.ts`	Renamed/internal `_setX` → exported `setX`; removed RateLimiter wrappers and permission-based gating; simplified imports.
Call Site Updates `apps/meteor/app/crowd/server/crowd.ts`, `apps/meteor/app/lib/server/functions/saveUserIdentity.ts`, `apps/meteor/server/lib/cas/loginHandler.ts`	Updated imports and call sites from `_setRealName` to `setRealName`.
RateLimiter Core Changes `apps/meteor/app/lib/server/lib/RateLimiter.js`	Removed `limitFunction` (function-level wrapper); kept and simplified `limitMethod` and DDPRateLimiter registration.
Method / Small Logic Update `apps/meteor/app/lib/server/methods/setRealName.ts`	Cache `Meteor.userId()` locally to avoid multiple calls; behavior unchanged.
Tests Adjusted `apps/meteor/tests/unit/app/lib/server/functions/setUsername.spec.ts`, `apps/meteor/tests/unit/server/users/saveUserIdentity.spec.ts`	Removed RateLimiter stubs/mocking and a failing-path test for name-setting; updated proxyquire mocks accordingly.

Sequence Diagram(s)

(omitted)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~30 minutes

Possibly related PRs

test: Add e2e test for change password in account security page #37765 — touches /users.updateOwnBasicInfo, closely related to the added per-route rate limiting.
fix: Custom status empty value not updating immediately #37443 — overlaps changes to user status handling (users.setStatus / setStatusText).

Suggested labels

stat: ready to merge, stat: QA assured

Suggested reviewers

KevLehman
aleksandernsilva

Poem

🐇 I hopped through code with a twitch and a grin,
I shed old wraps and let plain setters in.
Routes pace their steps, functions stand free,
A carrot of clarity for you and for me.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the changeset: removing rate limiters from several function modules while refactoring the rate limiting architecture.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch refactor/rate-limit-functions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-01-26T21:31:07Z

Codecov Report

❌ Patch coverage is 33.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.73%. Comparing base (aa37226) to head (d2e37a1).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #38354      +/-   ##
===========================================
- Coverage    70.78%   70.73%   -0.05%     
===========================================
  Files         3159     3159              
  Lines       109364   109364              
  Branches     19671    19704      +33     
===========================================
- Hits         77415    77362      -53     
- Misses       29920    29965      +45     
- Partials      2029     2037       +8

Flag	Coverage Δ
unit	`71.90% <50.00%> (-0.05%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cubic-dev-ai

No issues found across 9 files

coderabbitai

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

apps/meteor/app/lib/server/functions/setEmail.ts (1)
44-79: Update error message function references.

The function has been renamed from _setEmail to setEmail, but the error objects still reference '_setEmail' in the function field (lines 54, 58, 65, 76). Update these for consistency and accurate error tracking.
Proposed fix
-	throw new Meteor.Error('error-invalid-user', 'Invalid user', { function: '_setEmail' });
+	throw new Meteor.Error('error-invalid-user', 'Invalid user', { function: 'setEmail' });
Apply similar changes to lines 58, 65, and 76-77.

🧹 Nitpick comments (1)

apps/meteor/app/lib/server/functions/setStatusText.ts (1)
26-26: Consider replacing deprecated substr with substring.

String.prototype.substr() is deprecated. While functionally equivalent here, using substring(0, 120) or slice(0, 120) is preferred.
Proposed fix
-	statusText = statusText.trim().substr(0, 120);
+	statusText = statusText.trim().substring(0, 120);

… logic

….js and update tests accordingly

github-actions · 2026-01-26T21:59:40Z

📦 Docker Image Size Report

➡️ Changes

Service	Current	Baseline	Change
sum of all images	0B	0B	0B
account-service	0B	0B	0B
authorization-service	0B	0B	0B
ddp-streamer-service	0B	0B	0B
omnichannel-transcript-service	0B	0B	0B
presence-service	0B	0B	0B
queue-worker-service	0B	0B	0B
rocketchat	0B	0B	0B

📊 Historical Trend

---
config:
  theme: "dark"
  xyChart:
    width: 900
    height: 400
---
xychart
  title "Image Size Evolution by Service (Last 30 Days + This PR)"
  x-axis ["11/18 22:53", "11/19 23:02", "11/21 16:49", "11/24 17:34", "11/27 22:32", "11/28 19:05", "12/01 23:01", "12/02 21:57", "12/03 21:00", "12/04 18:17", "12/05 21:56", "12/08 20:15", "12/09 22:17", "12/10 23:26", "12/11 21:56", "12/12 22:45", "12/13 01:34", "12/15 22:31", "12/16 22:18", "12/17 21:04", "12/18 23:12", "12/19 23:27", "12/20 21:03", "12/22 18:54", "12/23 16:16", "12/24 19:38", "12/25 17:51", "12/26 13:18", "12/29 19:01", "12/30 20:52", "01/27 01:50 (PR)"]
  y-axis "Size (GB)" 0 --> 0.5
  line "account-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.00]
  line "authorization-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.00]
  line "ddp-streamer-service" [0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.00]
  line "omnichannel-transcript-service" [0.14, 0.14, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.00]
  line "presence-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.00]
  line "queue-worker-service" [0.14, 0.14, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.13, 0.00]
  line "rocketchat" [0.35, 0.35, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.34, 0.00]

Statistics (last 30 days):

📊 Average: 1.5GiB
⬇️ Minimum: 1.4GiB
⬆️ Maximum: 1.6GiB
🎯 Current PR: 0B

ℹ️ About this report

This report compares Docker image sizes from this build against the develop baseline.

Tag: pr-38354
Baseline: develop
Timestamp: 2026-01-27 01:50:59 UTC
Historical data points: 30

Updated: Tue, 27 Jan 2026 01:51:00 GMT

ggazzo added 2 commits January 26, 2026 18:07

feat: add rate limiting to users.updateOwnBasicInfo route and remove …

954538d

…rate limiter for setEmail function

feat: add rate limiting to users.setStatus route and export setStatus…

1d64e60

…Text function

ggazzo added this to the 8.2.0 milestone Jan 26, 2026

ggazzo force-pushed the refactor/rate-limit-functions branch from c27cda4 to 846055a Compare January 26, 2026 21:16

ggazzo force-pushed the refactor/rate-limit-functions branch from 846055a to 2a2334b Compare January 26, 2026 21:33

ggazzo marked this pull request as ready for review January 26, 2026 21:36

ggazzo requested a review from a team as a code owner January 26, 2026 21:36

cubic-dev-ai Bot reviewed Jan 26, 2026

View reviewed changes

coderabbitai Bot reviewed Jan 26, 2026

View reviewed changes

sampaiodiego requested changes Jan 26, 2026

View reviewed changes

Comment thread apps/meteor/app/api/server/v1/users.ts Outdated

ggazzo force-pushed the refactor/rate-limit-functions branch from 2a2334b to ab65fef Compare January 26, 2026 21:43

ggazzo added 2 commits January 26, 2026 18:46

refactor: rename _setRealName to setRealName and remove rate limiting…

99f9fb5

… logic

refactor: remove RateLimiter class and related logic from RateLimiter…

37e5399

….js and update tests accordingly

ggazzo force-pushed the refactor/rate-limit-functions branch from ab65fef to 37e5399 Compare January 26, 2026 21:46

test: add stubs for setRealName in saveUserIdentity tests

6b9b1e7

ggazzo force-pushed the refactor/rate-limit-functions branch from 33bba73 to 6b9b1e7 Compare January 27, 2026 01:32

ggazzo commented Jan 27, 2026

View reviewed changes

Comment thread apps/meteor/app/api/server/v1/users.ts Outdated

Apply suggestion from @ggazzo

d2e37a1

sampaiodiego approved these changes Jan 27, 2026

View reviewed changes

ggazzo added the stat: QA assured Means it has been tested and approved by a company insider label Jan 27, 2026

dionisio-bot Bot added the stat: ready to merge PR tested and approved waiting for merge label Jan 27, 2026

ggazzo merged commit c4eff65 into develop Jan 27, 2026
12 of 13 checks passed

ggazzo deleted the refactor/rate-limit-functions branch January 27, 2026 13:23

This was referenced Jan 27, 2026

chore: replace ids with objects as parameters #38367

Merged

refactor: clean up meteor-run-as-user package #38373

Merged

Rohit3523 pushed a commit that referenced this pull request Feb 4, 2026

chore: remove rate limiter for functions (#38354)

226fe05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: remove rate limiter for functions#38354

chore: remove rate limiter for functions#38354
ggazzo merged 6 commits into
developfrom
refactor/rate-limit-functions

ggazzo commented Jan 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

dionisio-bot Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ggazzo commented Jan 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Summary by CodeRabbit

Uh oh!

dionisio-bot Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

codecov Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Docker Image Size Report

➡️ Changes

📊 Historical Trend

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ggazzo commented Jan 26, 2026 •

edited by coderabbitai Bot

Loading

dionisio-bot Bot commented Jan 26, 2026 •

edited

Loading

changeset-bot Bot commented Jan 26, 2026 •

edited

Loading

coderabbitai Bot commented Jan 26, 2026 •

edited

Loading

codecov Bot commented Jan 26, 2026 •

edited

Loading

github-actions Bot commented Jan 26, 2026 •

edited

Loading