feat(webapp): share rate limit bucket across additional API keys per environment

[carderne]

What

Rate-limit the API by environment rather than per API key.

Previously the limiter keyed its bucket on the hash of the full Authorization header — one bucket per key. With additional environment API keys (tr_*_sk_*), an environment can mint many keys and each got its own full bucket, so more keys = higher effective rate limit. This collapses all of an environment's keys onto a single shared per-environment bucket, so the ceiling is exactly the configured limit regardless of key mix.

How

• authorizationRateLimitMiddleware now lets the override return { config?, identifier? }. identifier, when present, is the rate limit bucket key; otherwise it falls back to the hashed Authorization header (unchanged legacy behavior, still used by engineRateLimiter and any unauthenticated fallthrough).
• apiRateLimiter's override resolves the environment id and uses it as the identifier:
  • Additional keys (isAdditionalApiKey) resolve via a new resolveAdditionalApiKeyRateLimitScope() — a scope-agnostic keyHash → (environmentId, org limiter config) lookup. It is deliberately permissive (restricted keys resolve too) because it's used only for bucketing, never as an auth decision — request auth still goes through the RBAC bearer controller, which enforces scopes. Revoked/expired keys are excluded so they can't hold a bucket warm.
  • Root/legacy keys reuse the environment already resolved by authenticateAuthorizationHeader and key on environment.id too.
• The identifier is always the stable environment id, never the secret key (which can rotate and would split the bucket).
• The whole override result is cached per key by the existing SWR cache, so no extra per-request lookup and no separate Redis mapping is added.

Behavior notes

• Root + additional keys of the same environment now share one bucket (ceiling = configured limit, not a multiple of it). Restricted additional keys are included — they were the biggest gap, since they authenticate via the RBAC controller and previously fell back to per-key buckets.
• Public JWTs keep their existing fixed-window, per-token bucketing.
• One-time bucket reset on deploy (bucket keys change); harmless.

Tests

• New: two tokens resolving to the same identifier share one bucket.
• New: with no identifier, bucketing stays per-key (legacy behavior preserved).
• Updated existing override tests to the new { config } return shape.

Base: feat/multi-keys-surface. Closes TRI-12888.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5a6a191

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5647e820-5ca2-468c-abe4-381d0704f58e

📥 Commits

Reviewing files that changed from the base of the PR and between ee84c89 and 5a6a191.

📒 Files selected for processing (2)

• apps/webapp/app/models/api-key.server.ts
• apps/webapp/app/services/apiRateLimit.server.ts

💤 Files with no reviewable changes (2)

• apps/webapp/app/models/api-key.server.ts
• apps/webapp/app/services/apiRateLimit.server.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (18)

• GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 12)
• GitHub Check: typecheck / typecheck
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp
• GitHub Check: runops-guard / runops-guard
• GitHub Check: report
• GitHub Check: code-quality / code-quality
• GitHub Check: Analyze (javascript-typescript)

---

Walkthrough

API rate limits now use environment-scoped buckets. A new resolver maps valid private API keys to an environment and limiter configuration. Rate-limit middleware carries optional identifiers through override resolution, caching, validation, and bucket checks. JWT limits retain fixed-window behavior. Limits presenter lookups now use environment identifiers instead of hashed API keys. Tests cover shared buckets, isolated token buckets, preview environments, and deleted projects.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: sharing API rate-limit buckets across additional API keys within an environment.
Description check	✅ Passed	The description clearly explains the problem, implementation, behavior changes, and tests, but omits the template checklist and screenshots section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/tri-12888-add-redis-cache-for-additional-api-key-environment-lookup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@ee84c89

trigger.dev

npm i https://pkg.pr.new/trigger.dev@ee84c89

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@ee84c89

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@ee84c89

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@ee84c89

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@ee84c89

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@ee84c89

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@ee84c89

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@ee84c89

commit: ee84c89