Throttling in common api (#15338)

packages/twenty-server/src/engine/api/common/common-query-runners/common-base-query-runner.service.ts

@@ -31,6 +31,8 @@ import { WorkspacePreQueryHookPayload } from 'src/engine/api/graphql/workspace-q
 import { WorkspaceQueryHookService } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.service';
 import { ApiKeyRoleService } from 'src/engine/core-modules/api-key/api-key-role.service';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { ThrottlerService } from 'src/engine/core-modules/throttler/throttler.service';
+import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
 import { type PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
 import {
   PermissionsException,
@@ -71,6 +73,10 @@ export abstract class CommonBaseQueryRunnerService<
   protected readonly workspacePermissionsCacheService: WorkspacePermissionsCacheService;
   @Inject()
   protected readonly commonResultGettersService: CommonResultGettersService;
+  @Inject()
+  protected readonly throttlerService: ThrottlerService;
+  @Inject()
+  protected readonly twentyConfigService: TwentyConfigService;
 
   protected abstract readonly operationName: CommonQueryNames;
 
@@ -109,6 +115,8 @@ export abstract class CommonBaseQueryRunnerService<
       commonQueryParser,
     );
 
+    await this.throttleQueryExecution(authContext.workspace.id);
+
     const extendedQueryRunnerContext =
       await this.prepareExtendedQueryRunnerContext(
         authContext,
@@ -322,4 +330,36 @@ export abstract class CommonBaseQueryRunnerService<
       repository,
     };
   }
+
+  private async throttleQueryExecution(workspaceId: string) {
+    const shortConfig = {
+      key: `api:throttler:${workspaceId}-short-limit`,
+      maxTokens: this.twentyConfigService.get('API_RATE_LIMITING_SHORT_LIMIT'),
+      timeWindow: this.twentyConfigService.get(
+        'API_RATE_LIMITING_SHORT_TTL_IN_MS',
+      ),
+    };
+
+    const longConfig = {
+      key: `api:throttler:${workspaceId}-long-limit`,
+      maxTokens: this.twentyConfigService.get('API_RATE_LIMITING_LONG_LIMIT'),
+      timeWindow: this.twentyConfigService.get(
+        'API_RATE_LIMITING_LONG_TTL_IN_MS',
+      ),
+    };
+
+    await this.throttlerService.tokenBucketThrottle(
+      shortConfig.key,
+      1,
+      shortConfig.maxTokens,
+      shortConfig.timeWindow,
+    );
+
+    await this.throttlerService.tokenBucketThrottle(
+      longConfig.key,
+      1,
+      longConfig.maxTokens,
+      longConfig.timeWindow,
+    );
+  }
 }

packages/twenty-server/src/engine/api/common/core-common-api.module.ts

@@ -12,6 +12,7 @@ import { WorkspaceQueryHookModule } from 'src/engine/api/graphql/workspace-query
 import { WorkspaceQueryRunnerModule } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-runner.module';
 import { ApiKeyModule } from 'src/engine/core-modules/api-key/api-key.module';
 import { FileModule } from 'src/engine/core-modules/file/file.module';
+import { ThrottlerModule } from 'src/engine/core-modules/throttler/throttler.module';
 import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 import { RoleTargetsEntity } from 'src/engine/metadata-modules/role/role-targets.entity';
 import { UserRoleModule } from 'src/engine/metadata-modules/user-role/user-role.module';
@@ -33,6 +34,7 @@ import { WorkspacePermissionsCacheModule } from 'src/engine/metadata-modules/wor
     ViewModule,
     ViewFilterModule,
     ViewFilterGroupModule,
+    ThrottlerModule,
   ],
   providers: [
     ProcessNestedRelationsHelper,

packages/twenty-server/src/engine/api/graphql/graphql-config/graphql-config.service.ts

@@ -17,7 +17,6 @@ import { JsonWebTokenError, TokenExpiredError } from 'jsonwebtoken';
 
 import { NodeEnvironment } from 'src/engine/core-modules/twenty-config/interfaces/node-environment.interface';
 
-import { useThrottler } from 'src/engine/api/graphql/graphql-config/hooks/use-throttler';
 import { WorkspaceSchemaFactory } from 'src/engine/api/graphql/workspace-schema.factory';
 import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
 import { CoreEngineModule } from 'src/engine/core-modules/core-engine.module';
@@ -55,13 +54,6 @@ export class GraphQLConfigService
     const isDebugMode =
       this.twentyConfigService.get('NODE_ENV') === NodeEnvironment.DEVELOPMENT;
     const plugins = [
-      useThrottler({
-        ttl: this.twentyConfigService.get('API_RATE_LIMITING_TTL'),
-        limit: this.twentyConfigService.get('API_RATE_LIMITING_LIMIT'),
-        identifyFn: (context) => {
-          return context.req.user?.id ?? context.req.ip ?? 'anonymous';
-        },
-      }),
       useGraphQLErrorHandlerHook({
         metricsService: this.metricsService,
         exceptionHandlerService: this.exceptionHandlerService,

packages/twenty-server/src/engine/api/graphql/metadata.module-factory.ts

@@ -32,8 +32,8 @@ export const metadataModuleFactory = async (
     resolvers: { JSON: GraphQLJSON },
     plugins: [
       useThrottler({
-        ttl: twentyConfigService.get('API_RATE_LIMITING_TTL'),
-        limit: twentyConfigService.get('API_RATE_LIMITING_LIMIT'),
+        ttl: twentyConfigService.get('API_RATE_LIMITING_LONG_TTL_IN_MS') / 1000,
+        limit: twentyConfigService.get('API_RATE_LIMITING_LONG_LIMIT'),
         identifyFn: (context) => {
           return context.req.user?.id ?? context.req.ip ?? 'anonymous';
         },

packages/twenty-server/src/engine/api/graphql/workspace-query-runner/utils/workspace-query-runner-graphql-api-exception-handler.util.ts

@@ -12,6 +12,8 @@ import { AuthException } from 'src/engine/core-modules/auth/auth.exception';
 import { authGraphqlApiExceptionHandler } from 'src/engine/core-modules/auth/utils/auth-graphql-api-exception-handler.util';
 import { RecordTransformerException } from 'src/engine/core-modules/record-transformer/record-transformer.exception';
 import { recordTransformerGraphqlApiExceptionHandler } from 'src/engine/core-modules/record-transformer/utils/record-transformer-graphql-api-exception-handler.util';
+import { ThrottlerException } from 'src/engine/core-modules/throttler/throttler.exception';
+import { throttlerToGraphqlApiExceptionHandler } from 'src/engine/core-modules/throttler/utils/throttler-to-graphql-api-exception-handler.util';
 import { PermissionsException } from 'src/engine/metadata-modules/permissions/permissions.exception';
 import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
 import { TwentyORMException } from 'src/engine/twenty-orm/exceptions/twenty-orm.exception';
@@ -42,6 +44,8 @@ export const workspaceQueryRunnerGraphqlApiExceptionHandler = (
       return authGraphqlApiExceptionHandler(error);
     case error instanceof ApiKeyException:
       return apiKeyGraphqlApiExceptionHandler(error);
+    case error instanceof ThrottlerException:
+      return throttlerToGraphqlApiExceptionHandler(error);
     default:
       throw error;
   }

packages/twenty-server/src/engine/api/rest/utils/workspace-query-runner-rest-api-exception-handler.util.ts

@@ -5,6 +5,8 @@ import { type QueryFailedError } from 'typeorm';
 import { CommonQueryRunnerException } from 'src/engine/api/common/common-query-runners/errors/common-query-runner.exception';
 import { commonQueryRunnerToRestApiExceptionHandler } from 'src/engine/api/common/common-query-runners/utils/common-query-runner-to-rest-api-exception-handler.util';
 import { RestInputRequestParserException } from 'src/engine/api/rest/input-request-parsers/rest-input-request-parser.exception';
+import { ThrottlerException } from 'src/engine/core-modules/throttler/throttler.exception';
+import { throttlerToRestApiExceptionHandler } from 'src/engine/core-modules/throttler/utils/throttler-to-rest-api-exception-handler.util';
 
 interface QueryFailedErrorWithCode extends QueryFailedError {
   code: string;
@@ -18,6 +20,8 @@ export const workspaceQueryRunnerRestApiExceptionHandler = (
       return commonQueryRunnerToRestApiExceptionHandler(error);
     case error instanceof RestInputRequestParserException:
       throw new BadRequestException(error.message);
+    case error instanceof ThrottlerException:
+      return throttlerToRestApiExceptionHandler(error);
     default:
       throw error;
   }