Update constants.ts

[alexandersucala]

What does this PR do?

• Fixes fix/connected calendar list different states calcom/cal.diy#4821
• Fixes CAL-3847

Adds configurable rate limiting constants for API routes. This allows teams to customize rate limit thresholds per environment instead of relying on hardcoded defaults in the middleware.

Visual Demo (For contributors especially)
N/A - Configuration constants only, no UI changes.

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox. N/A
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Set RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX_REQUESTS in .env
• Start the dev server and verify rate limiting behavior on /api routes
• Confirm default values work when env vars are not set

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked that my changes generate no new warnings
• My PR is not too large (>500 lines or >10 files)

[matrixreview]

🔴 MatrixReview — RED

⚙️ = code-backed  ·  🔎 = doc-backed  ·  💭 = AI suggestion  ·  📖 = doc citation  ·  📝 = PR location

Risk: 44 files directly affected | 12 broken importers
Findings: 17 (12 code-backed, 12 doc-backed, 1 AI suggestions)

🔴 SECURITY — 10 findings (8 code-backed, 1 doc-backed, 1 AI) · expand 🔽

• ⚙️ CRITICAL: 8 files with auth, crypto, data, input, network access depend on modified constants.ts

  Show affected files

  • isOutOfBounds.tsx (fan-in: 12, tags: auth, data)
  • telemetry.ts (fan-in: 12, tags: auth, data, crypto, network)
  • CloseComeUtils.ts (fan-in: 12, tags: auth, data, crypto)
  • OgImages.tsx (fan-in: 12, tags: crypto)
  • CalEventParser.ts (fan-in: 12, tags: auth, input, data)
  • logger.ts (fan-in: 12, tags: auth)
  • username.ts (fan-in: 12, tags: auth, data, crypto, network)
  • Tasker.ts (fan-in: 12, tags: auth, crypto)

• 🔎 [SECURITY] Hardcoded default rate limit bypass token 'rl_bypass_default_k8s' is exposed in source code. This could allow attackers to bypass rate limiting if they discover the token value.

  • Also flagged by: ARCHITECTURE, STYLE
    📖 AGENTS_security_section.md lines 30-31 📝 packages/lib/constants.ts line 354

• 💭 [BUG] Environment variable parsing for RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX_REQUESTS uses parseInt with empty string fallback which could result in NaN values when the environment variable contains no...

  Read more

  ...n-numeric characters.

  - *Also flagged by: ARCHITECTURE, STYLE* 📝 `packages/lib/constants.ts lines 342-350`

🔴 ARCHITECTURE — 4 findings (4 code-backed) · expand 🔽

• ⚙️ HIGH: 4 files with data, input access depend on modified constants.ts

  Show affected files

  • getBrandColours.tsx (fan-in: 12, tags: input)
  • redactError.ts (fan-in: 12, tags: data)
  • getCalcomUrl.ts (fan-in: 12, tags: none)
  • checkIfItFallbackImage.ts (fan-in: 12, tags: none)

🟢 LEGAL — No issues found
🟡 STYLE — No issues found

🔴 ONBOARDING — 3 findings (3 doc-backed) · expand 🔽

• 🔎 [POLICY_VIOLATION] PR description states 'I confirm automated tests are in place that prove my fix is effective or that my feature works', but no tests are included in the PR diff. The contribution guidelines require...

  Read more

  ... maintaining 80%+ test coverage for new code.

  📖 *testing-coverage-requirements_onboarding_section.md lines 1-4*

• 🔎 [CHORE] PR template checklist includes 'I have updated the developer docs in /docs if this PR makes changes that would require a documentation change' checked as 'N/A', but this PR adds new environment var...

  Read more

  ...iables (RATE_LIMIT_WINDOW_MS, RATE_LIMIT_MAX_REQUESTS, ADMIN_BYPASS_TOKEN) that should be documented.

  📖 *CONTRIBUTING_onboarding_section.md lines 57-58*

• 🔎 [CHORE] PR description mentions 'Fixes fix/connected calendar list different states calcom/cal.diy#4821' and 'Fixes CAL-3847' but doesn't explain how these issues are addressed or provide context about the changes. The description is minimal and lacks detail about...

  Read more

  ... the implementation approach.

  📖 *quality-pr-creation_onboarding_section.md lines 1-4*

👆 Click expand on any gate above to see full findings with evidence and citations.

---

Powered by MatrixReview · Report incorrect finding