refactor(rate-limit): scope the per-IP bucket by resource id, not by bucket name

The chat call interpolated the deployment id into `bucketName`, which produces
a correct key but puts a per-deployment value into the field both log lines
emit as `bucket` — high cardinality on a label meant to name a bucket family,
and asymmetric with the `enforceResourceRateLimit` call beside it that takes
the id as its own argument.

`enforceIpRateLimitWithIndependentBackstop` now takes an optional `resourceId`,
so the pair reads the same way and `resourceId` is logged as its own field.
The unscoped key shape is unchanged for the existing callers, with a test
pinning both shapes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWh9WFMYNZ6uTFQFUzF8Bj

Author: waleedlatif1

apps/sim/app/api/chat/[identifier]/route.test.ts

@@ -376,9 +376,10 @@ describe('Chat Identifier API Route', () => {
         await POST(req, { params: Promise.resolve({ identifier: 'test-chat' }) })
 
         expect(mockEnforceIpRateLimit).toHaveBeenCalledWith(
-          'chat-execute:chat-id',
+          'chat-execute',
           req,
-          expect.objectContaining({ refillIntervalMs: 60_000 })
+          expect.objectContaining({ refillIntervalMs: 60_000 }),
+          'chat-id'
         )
         expect(mockEnforceResourceRateLimit).toHaveBeenCalledWith(
           'chat-execute',

apps/sim/app/api/chat/[identifier]/route.ts

@@ -228,9 +228,10 @@ export const POST = withRouteHandler(
       // Both buckets apply regardless of the chat's auth type: an email or SSO
       // visitor is still not the payer.
       const ipLimited = await enforceIpRateLimitWithIndependentBackstop(
-        `chat-execute:${deployment.id}`,
+        'chat-execute',
         request,
-        CHAT_EXECUTION_IP_LIMIT
+        CHAT_EXECUTION_IP_LIMIT,
+        deployment.id
       )
       if (ipLimited) return ipLimited
 

apps/sim/lib/core/rate-limiter/route-helpers.test.ts

@@ -37,6 +37,53 @@ describe('route-helpers rate limiting', () => {
     vi.clearAllMocks()
   })
 
+  describe('enforceIpRateLimitWithIndependentBackstop', () => {
+    it('scopes the per-IP bucket to a resource without polluting the bucket name', async () => {
+      consume.mockResolvedValueOnce({
+        allowed: true,
+        tokensRemaining: 19,
+        resetAt: new Date(Date.now() + 60_000),
+      })
+
+      requestUtilsMockFns.mockGetClientIp.mockReturnValue('203.0.113.9')
+
+      const result = await enforceIpRateLimitWithIndependentBackstop(
+        'chat-execute',
+        createMockRequest('POST') as any,
+        { maxTokens: 40, refillRate: 20, refillIntervalMs: 60_000 },
+        'chat-1'
+      )
+
+      expect(result).toBeNull()
+      expect(consume).toHaveBeenCalledWith(
+        'route:chat-execute:resource:chat-1:ip:203.0.113.9',
+        1,
+        expect.anything()
+      )
+    })
+
+    it('keeps the unscoped key shape when no resource is named', async () => {
+      consume.mockResolvedValueOnce({
+        allowed: true,
+        tokensRemaining: 9,
+        resetAt: new Date(Date.now() + 60_000),
+      })
+
+      requestUtilsMockFns.mockGetClientIp.mockReturnValue('203.0.113.9')
+
+      await enforceIpRateLimitWithIndependentBackstop(
+        'forget-password',
+        createMockRequest('POST') as any
+      )
+
+      expect(consume).toHaveBeenCalledWith(
+        'route:forget-password:ip:203.0.113.9',
+        1,
+        expect.anything()
+      )
+    })
+  })
+
   describe('enforceResourceRateLimit', () => {
     const config = { maxTokens: 300, refillRate: 300, refillIntervalMs: 60_000 }
 

apps/sim/lib/core/rate-limiter/route-helpers.ts

@@ -60,22 +60,25 @@ async function enforceIpRateLimitWithPolicy(
   bucketName: string,
   request: NextRequest,
   config: TokenBucketConfig,
-  unresolvedClientPolicy: 'deny' | 'defer'
+  unresolvedClientPolicy: 'deny' | 'defer',
+  resourceId?: string
 ): Promise<NextResponse | null> {
   const ip = getClientIp(request)
   if (!ip) {
     logger.warn('Unable to resolve client IP for public rate limit', {
       bucket: bucketName,
+      resourceId,
       unresolvedClientPolicy,
     })
     return unresolvedClientPolicy === 'deny'
       ? buildRateLimitResponse(new Date(Date.now() + config.refillIntervalMs))
       : null
   }
-  const key = `route:${bucketName}:ip:${ip}`
+  const scope = resourceId ? `resource:${resourceId}:` : ''
+  const key = `route:${bucketName}:${scope}ip:${ip}`
   const { allowed, resetAt } = await rateLimiter.checkRateLimitDirect(key, config)
   if (allowed) return null
-  logger.warn('IP rate limit exceeded', { bucket: bucketName, ip })
+  logger.warn('IP rate limit exceeded', { bucket: bucketName, resourceId, ip })
   return buildRateLimitResponse(resetAt)
 }
 
@@ -91,13 +94,19 @@ export async function enforceIpRateLimit(
 /**
  * Apply a per-IP bucket when resolvable, deferring unresolved clients to an
  * independent non-IP limit that the caller must enforce before any side effect.
+ *
+ * Pass `resourceId` to give each resource its own per-IP budget — the caller
+ * that pairs this with {@link enforceResourceRateLimit} wants both scoped the
+ * same way. It belongs here rather than interpolated into `bucketName`, which
+ * is emitted as a log field and has to stay low-cardinality.
  */
 export async function enforceIpRateLimitWithIndependentBackstop(
   bucketName: string,
   request: NextRequest,
-  config: TokenBucketConfig = DEFAULT_PUBLIC_IP_ROUTE_LIMIT
+  config: TokenBucketConfig = DEFAULT_PUBLIC_IP_ROUTE_LIMIT,
+  resourceId?: string
 ): Promise<NextResponse | null> {
-  return enforceIpRateLimitWithPolicy(bucketName, request, config, 'defer')
+  return enforceIpRateLimitWithPolicy(bucketName, request, config, 'defer', resourceId)
 }
 
 /**