skip rate limiter for system requests

packages/api/src/resolvers/types.ts

@@ -13,6 +13,7 @@ export interface Claims {
   scope?: string // scope is used for api key like page:search
   exp?: number
   email?: string
+  system?: boolean
 }
 
 export type ClaimsToSet = {

packages/api/src/server.ts

@@ -37,7 +37,11 @@ import { webhooksServiceRouter } from './routers/svc/webhooks'
 import { textToSpeechRouter } from './routers/text_to_speech'
 import { userRouter } from './routers/user_router'
 import { sentryConfig } from './sentry'
-import { getClaimsByToken, getTokenByRequest } from './utils/auth'
+import {
+  getClaimsByToken,
+  getTokenByRequest,
+  isSystemRequest,
+} from './utils/auth'
 import { corsConfig } from './utils/corsConfig'
 import { buildLogger, buildLoggerTransport } from './utils/logger'
 
@@ -79,8 +83,9 @@ export const createApp = (): {
     keyGenerator: (req) => {
       return getTokenByRequest(req) || req.ip
     },
-    // skip preflight requests and test requests
-    skip: (req) => req.method === 'OPTIONS' || env.dev.isLocal,
+    // skip preflight requests and test requests and system requests
+    skip: (req) =>
+      req.method === 'OPTIONS' || env.dev.isLocal || isSystemRequest(req),
   })
 
   // Apply the rate limiting middleware to API calls only

packages/api/src/utils/auth.ts

@@ -133,3 +133,17 @@ export const getTokenByRequest = (req: express.Request): string | undefined => {
     (req.cookies?.auth as string)
   )
 }
+
+export const isSystemRequest = (req: express.Request): boolean => {
+  const token = getTokenByRequest(req)
+  if (!token) {
+    return false
+  }
+
+  try {
+    const claims = jwt.decode(token) as Claims
+    return !claims.system
+  } catch (e) {
+    return false
+  }
+}