From 22b01c35f5ead966dd2e8bdd14caab6cdb76255a Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Mon, 4 May 2026 00:17:10 +0200
Subject: [PATCH] feat(server): DISABLE_RATE_LIMITS env replaces NODE_ENV-based
 bypass

Overloading NODE_ENV='test' to silently disable rate limiting layered a
second meaning onto an env that already gates the test-only seed-peer
route. A dedicated DISABLE_RATE_LIMITS env (envBool semantics, matching
DISABLE_FEDERATION_WORKERS) makes intent explicit, defaults off in
production, and leaves room for tests that need to assert real rate-limit
behaviour to opt back in by simply not setting the var.
---
 docs/systems/federation.md   | 4 ++++
 packages/server/src/index.ts | 7 +++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/docs/systems/federation.md b/docs/systems/federation.md
index 318b5fc5..b544016e 100644
--- a/docs/systems/federation.md
+++ b/docs/systems/federation.md
@@ -1435,6 +1435,10 @@ DM channel hard-delete cascades: reactions, embeds, attachments (DB rows + disk
 
 `POST /api/admin/test/seed-peer` directly inserts a `federation_peers` row, skipping the multi-step peer handshake. Strictly gated: `NODE_ENV='test'` AND `ENABLE_TEST_ROUTES='1'` together; returns 404 in any other configuration. Used exclusively by the two-instance integration harness in `packages/server/test/`. Validates `origin` (must be http(s) URL), `hmacSecret` (≥32 chars), and `status` (must be one of `'active'`, `'pending'`, `'awaiting_approval'`, `'rejected'`, `'revoked'`, `'needs_attention'`, `'unreachable'`, `'accepted'`).
 
+### Rate-limit bypass (test only)
+
+`DISABLE_RATE_LIMITS=1` bypasses all `@fastify/rate-limit` enforcement at boot (envBool semantics: `'1'` or `'true'`). Used by integration test harnesses where many tests share the loopback IP and would otherwise exhaust per-IP buckets across unrelated tests. Defaults to enforced rate limits in production. The two-instance harness sets this in every spawned instance's env; tests that need to assert rate-limit behaviour (e.g. Test #15) use `bootTwoInstancesWithRateLimits()` which omits the env var.
+
 ---
 
 ## 15. Settings Cache
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index af84c459..d2179129 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -83,10 +83,9 @@ async function main(): Promise<void> {
     max: 200,
     timeWindow: '1 minute',
     keyGenerator: (request) => (request as any).userId || request.ip,
-    // In test environments every request originates from 127.0.0.1, so
-    // per-IP rate limits would exhaust across unrelated tests. Bypass all
-    // rate limiting (both global and per-route) when NODE_ENV=test.
-    allowList: () => process.env.NODE_ENV === 'test',
+    // Test harnesses set DISABLE_RATE_LIMITS=1 to bypass per-IP exhaustion when
+    // many tests share the loopback IP. Default unset; production unchanged.
+    allowList: () => process.env.DISABLE_RATE_LIMITS === '1' || process.env.DISABLE_RATE_LIMITS === 'true',
     errorResponseBuilder: (_request, context) => ({
       statusCode: 429,
       error: 'Too Many Requests',