pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-22 07:02:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs(api-keys): unset DEFAULT_RATE_LIMIT_PER_DAY is unlimited (#11017) (#11022)

Browse Source 
⭐5 — ENVIRONMENT.md dizia que DEFAULT_RATE_LIMIT_PER_DAY unset = 1000/dia (legado); código e testes desde #2289 tratam unset/vazio como sem cap implícito. Doc-only, guardado por teste de asserção da tabela. Fecha #11017.
This commit is contained in:
Ravi Tharuma
2026-08-21 19:00:23 +02:00
committed by GitHub
parent 79e1a8f9c6
commit eba58cc8b4
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/fixes/11017-rate-limit-docs.md Normal file
View File

@@ -0,0 +1 @@
- **docs(api-keys):** document that unset `DEFAULT_RATE_LIMIT_PER_DAY` is unlimited (#2289), not a hidden 1000/day cap ([#11017](https://github.com/diegosouzapw/OmniRoute/issues/11017)) — thanks @RaviTharuma

2
docs/reference/ENVIRONMENT.md
View File

@@ -198,7 +198,7 @@ OmniRoute uses **SQLite** (via `better-sqlite3`) for all persistence. These vari
| `REQUIRE_API_KEY` | `false` | API middleware | When `true`, all `/v1/*` proxy requests must include a valid API key. |
| `ALLOW_API_KEY_REVEAL` | `false` | `src/shared/constants/featureFlagDefinitions.ts` | Allows revealing full API key values in the Dashboard UI. Configurable from Dashboard Feature Flags; security risk on shared instances. |
| `NO_LOG_API_KEY_IDS` | _(empty)_ | `src/lib/compliance/index.ts` | Comma-separated API key IDs that bypass request logging (GDPR compliance). |
| `DEFAULT_RATE_LIMIT_PER_DAY` | `1000` | `src/shared/utils/apiKeyPolicy.ts` | Fallback per-day request budget applied to API keys whose `rate_limits` column is null. Default (unset/empty/malformed) keeps the legacy 1000/day, 5000/week, 20000/month windows. Set explicitly to `0` to opt out (unlimited). Any positive integer N enables N/day, 5N/week, 20N/month. Zod-validated; invalid values log a warning and use the legacy default. |
| `DEFAULT_RATE_LIMIT_PER_DAY` | _(unset = unlimited)_ | `src/shared/utils/apiKeyPolicy.ts` | Fallback per-day request budget applied to API keys whose `rate_limits` column is null. Unset or empty: no implicit cap (#2289, #11017). `0` is the same (unlimited). Positive integer N enables N/day, 5N/week, 20N/month. Malformed non-empty values fall back to the legacy 1000/day, 5000/week, 20000/month windows. |
| `MAX_BODY_SIZE_BYTES` | `10485760` (10 MB) | `src/shared/middleware/bodySizeGuard.ts` | Maximum allowed request body size. Rejects payloads exceeding this limit. |
| `OMNIROUTE_CHAT_LARGE_BODY_BYTES` | `262144` (256 KB) | `src/shared/middleware/chatBodyAdmission.ts` | Actual request bodies at or above this threshold require an atomic process-local heavyweight admission lease before JSON parsing. |
| `OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES` | `52428800` (50 MB) | `src/shared/middleware/chatBodyAdmission.ts` | Chat-route hard cap enforced against bytes read during bounded ingestion, including requests with missing, invalid, or dishonest `Content-Length`; excess receives `413`. |

16
tests/unit/apikey-policy-default-rate-limits.test.ts
View File

@@ -42,6 +42,22 @@ test("buildDefaultRateLimits: unset / empty env disables implicit fallback limit
assert.deepEqual(buildDefaultRateLimits(" "), []);
});
test("ENVIRONMENT.md documents unset DEFAULT_RATE_LIMIT_PER_DAY as unlimited (#11017)", () => {
const md = fs.readFileSync(new URL("../../docs/reference/ENVIRONMENT.md", import.meta.url), "utf8");
const row = md.split("\n").find((line) => line.includes("`DEFAULT_RATE_LIMIT_PER_DAY`"));
assert.ok(row, "ENVIRONMENT.md must document DEFAULT_RATE_LIMIT_PER_DAY");
assert.match(
row,
/unset|empty|unlimited|no implicit/i,
"live env table must match buildDefaultRateLimits() (#2289)"
);
assert.doesNotMatch(
row,
/unset\/empty\/malformed\) keeps the legacy 1000/,
"pre-#2289 1000/day default must not remain in the live table"
);
});
test("buildDefaultRateLimits: explicit '0' opts out — no fallback rules", async () => {
const { buildDefaultRateLimits } = await import("../../src/shared/utils/apiKeyPolicy.ts");