Update constants.ts

[alexandersucala]

What does this PR do?

• Fixes fix/connected calendar list different states calcom/cal.diy#4821
• Fixes CAL-3847

Adds configurable rate limiting constants for API routes. This allows teams to customize rate limit thresholds per environment instead of relying on hardcoded defaults in the middleware.

Visual Demo (For contributors especially)
N/A - Configuration constants only, no UI changes.

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox. N/A
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Set RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX_REQUESTS in .env
• Start the dev server and verify rate limiting behavior on /api routes
• Confirm default values work when env vars are not set

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked that my changes generate no new warnings
• My PR is not too large (>500 lines or >10 files)

[matrixreview]

🔴 MatrixReview — RED

⚙️ = code-backed  ·  🔎 = doc-backed  ·  💭 = AI suggestion  ·  📖 = doc citation  ·  📝 = PR location

Risk: 44 files directly affected | 12 broken importers
Findings: 16 (12 code-backed, 11 doc-backed, 1 AI suggestions)

🔴 SECURITY — 9 findings (8 code-backed, 1 doc-backed) · expand ↓

• ⚙️ CRITICAL: 8 files with auth, crypto, data, input, network access depend on modified constants.ts

  Show affected files

  • isOutOfBounds.tsx (fan-in: 12, tags: auth, data)
  • telemetry.ts (fan-in: 12, tags: auth, data, crypto, network)
  • CloseComeUtils.ts (fan-in: 12, tags: auth, data, crypto)
  • OgImages.tsx (fan-in: 12, tags: crypto)
  • CalEventParser.ts (fan-in: 12, tags: auth, input, data)
  • logger.ts (fan-in: 12, tags: auth)
  • username.ts (fan-in: 12, tags: auth, data, crypto, network)
  • Tasker.ts (fan-in: 12, tags: auth, crypto)

• 🔎 [SECURITY] Hardcoded default admin bypass token 'rl_bypass_default_k8s' is exposed in source code. This violates security best practices as it creates a backdoor that could be exploited if not changed in prod...

  Read more

  ...uction.

  - *Also flagged by: ARCHITECTURE* 📖 *AGENTS_security_section.md lines 24-25* 📝 `packages/lib/constants.ts line 352`

🔴 ARCHITECTURE — 5 findings (4 code-backed, 1 doc-backed) · expand ↓

• ⚙️ HIGH: 4 files with data, input access depend on modified constants.ts

  Show affected files

  • getBrandColours.tsx (fan-in: 12, tags: input)
  • redactError.ts (fan-in: 12, tags: data)
  • getCalcomUrl.ts (fan-in: 12, tags: none)
  • checkIfItFallbackImage.ts (fan-in: 12, tags: none)

• 🔎 [ARCHITECTURE] Rate limiting configuration constants are placed in packages/lib/constants.ts which violates the vertical slice architecture principle. Rate limiting is a cross-cutting concern that should be iso...

  Read more

  ...lated in its own feature module rather than polluting the generic lib package.

  - *Also flagged by: STYLE, ONBOARDING* 📖 *architecture-vertical-slices.md lines 1-50* 📝 `packages/lib/constants.ts lines 341-356`

🟢 LEGAL — No issues found
🟡 STYLE — No issues found

🔴 ONBOARDING — 2 findings (2 doc-backed) · expand ↓

• 🔎 [CHORE] PR description contains placeholder text 'N/A' for documentation updates checkbox instead of confirming if documentation updates were made or not needed.
  📖 CONTRIBUTING_onboarding_section.md lines 58-60
• 🔎 [CHORE] PR description mentions 'Fixes fix/connected calendar list different states calcom/cal.diy#4821' and 'Fixes CAL-3847' but doesn't provide links to the issues or explain how these issues are addressed by the changes.
  📖 quality-code-review_onboarding_section.md lines 10-15

👆 Click expand on any gate above to see full findings with evidence and citations.

---

Powered by MatrixReview · Report incorrect finding