loginLimiter: widen to 100/15min in non-prod (CI flakiness fix)

58309cd6d198502a56763ab71366cb8f0ff6af99 · 2026-05-10 20:42:23 -0700 · SteveStudio2

Production stays at 10/15min/IP. NODE_ENV !== 'production' gets 100,
because the chained npm run test:e2e runs several login-requiring
suites back-to-back and the 10-cap was tripping the limiter
mid-suite, masking real-vs-flaky test results.

Files touched

M server.js

Diff

commit 58309cd6d198502a56763ab71366cb8f0ff6af99
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sun May 10 20:42:23 2026 -0700

    loginLimiter: widen to 100/15min in non-prod (CI flakiness fix)
    
    Production stays at 10/15min/IP. NODE_ENV !== 'production' gets 100,
    because the chained npm run test:e2e runs several login-requiring
    suites back-to-back and the 10-cap was tripping the limiter
    mid-suite, masking real-vs-flaky test results.
---
 server.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 1f54071..a4f6e88 100644
--- a/server.js
+++ b/server.js
@@ -151,8 +151,14 @@ app.use(csrfMiddleware);
 app.use(attachInstaller);
 
 // Rate limiters — applied to specific high-abuse routes.
+// Production: 10 logins per 15 min per IP. Non-prod (dev / CI / e2e): 100,
+// because the chained `npm run test:e2e` runs several login-requiring suites
+// back-to-back (claim-flow, template-chooser, coi-request, paper-comments)
+// and would otherwise trip the limiter mid-run. The widening is gated on
+// NODE_ENV so prod never sees it.
 const loginLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, max: 10,
+  windowMs: 15 * 60 * 1000,
+  max: process.env.NODE_ENV === 'production' ? 10 : 100,
   standardHeaders: true, legacyHeaders: false,
   message: { error: 'too_many_requests' }
 });

← 5918434 yolo tick 5: expand /papers seed library 5→17 + helpful-vote · back to NationalPaperHangers · /map → address-driven near-me view + service_counties/towns/ b3b4e14 →