Throttling in common api (#15338)

packages/twenty-server/src/engine/api/common/common-query-runners/common-base-query-runner.service.ts

@@ -31,6 +31,8 @@ import { WorkspacePreQueryHookPayload } from 'src/engine/api/graphql/workspace-q
 import { WorkspaceQueryHookService } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.service';
 import { ApiKeyRoleService } from 'src/engine/core-modules/api-key/api-key-role.service';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { ThrottlerService } from 'src/engine/core-modules/throttler/throttler.service';
+import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
 import { type PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
 import {
   PermissionsException,
@@ -71,6 +73,10 @@ export abstract class CommonBaseQueryRunnerService<
   protected readonly workspacePermissionsCacheService: WorkspacePermissionsCacheService;
   @Inject()
   protected readonly commonResultGettersService: CommonResultGettersService;
+  @Inject()
+  protected readonly throttlerService: ThrottlerService;
+  @Inject()
+  protected readonly twentyConfigService: TwentyConfigService;
 
   protected abstract readonly operationName: CommonQueryNames;
 
@@ -109,6 +115,8 @@ export abstract class CommonBaseQueryRunnerService<
       commonQueryParser,
     );
 
+    await this.throttleQueryExecution(authContext.workspace.id);
+
     const extendedQueryRunnerContext =
       await this.prepareExtendedQueryRunnerContext(
         authContext,
@@ -322,4 +330,36 @@ export abstract class CommonBaseQueryRunnerService<
       repository,
     };
   }
+
+  private async throttleQueryExecution(workspaceId: string) {
+    const shortConfig = {
+      key: `api:throttler:${workspaceId}-short-limit`,
+      maxTokens: this.twentyConfigService.get('API_RATE_LIMITING_SHORT_LIMIT'),
+      timeWindow: this.twentyConfigService.get(
+        'API_RATE_LIMITING_SHORT_TTL_IN_MS',
+      ),
+    };
+
+    const longConfig = {
+      key: `api:throttler:${workspaceId}-long-limit`,
+      maxTokens: this.twentyConfigService.get('API_RATE_LIMITING_LONG_LIMIT'),
+      timeWindow: this.twentyConfigService.get(
+        'API_RATE_LIMITING_LONG_TTL_IN_MS',
+      ),
+    };
+
+    await this.throttlerService.tokenBucketThrottle(
+      shortConfig.key,
+      1,
+      shortConfig.maxTokens,
+      shortConfig.timeWindow,
+    );
+
+    await this.throttlerService.tokenBucketThrottle(
+      longConfig.key,
+      1,
+      longConfig.maxTokens,
+      longConfig.timeWindow,
+    );
+  }
 }

packages/twenty-server/src/engine/api/common/core-common-api.module.ts

@@ -12,6 +12,7 @@ import { WorkspaceQueryHookModule } from 'src/engine/api/graphql/workspace-query
 import { WorkspaceQueryRunnerModule } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-runner.module';
 import { ApiKeyModule } from 'src/engine/core-modules/api-key/api-key.module';
 import { FileModule } from 'src/engine/core-modules/file/file.module';
+import { ThrottlerModule } from 'src/engine/core-modules/throttler/throttler.module';
 import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 import { RoleTargetsEntity } from 'src/engine/metadata-modules/role/role-targets.entity';
 import { UserRoleModule } from 'src/engine/metadata-modules/user-role/user-role.module';
@@ -33,6 +34,7 @@ import { WorkspacePermissionsCacheModule } from 'src/engine/metadata-modules/wor
     ViewModule,
     ViewFilterModule,
     ViewFilterGroupModule,
+    ThrottlerModule,
   ],
   providers: [
     ProcessNestedRelationsHelper,