Update constants.ts

[alexandersucala]

What does this PR do?

• Fixes fix/connected calendar list different states calcom/cal.diy#4821
• Fixes CAL-3847

Adds configurable rate limiting constants for API routes. This allows teams to customize rate limit thresholds per environment instead of relying on hardcoded defaults in the middleware.

Visual Demo (For contributors especially)
N/A - Configuration constants only, no UI changes.

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox. N/A
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

• Set RATE_LIMIT_WINDOW_MS and RATE_LIMIT_MAX_REQUESTS in .env
• Start the dev server and verify rate limiting behavior on /api routes
• Confirm default values work when env vars are not set

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked that my changes generate no new warnings
• My PR is not too large (>500 lines or >10 files)

[matrixreview]

🔴 MatrixReview — RED

⚙️ = code-backed  ·  🔎 = doc-backed  ·  💭 = AI suggestion  ·  📖 = doc citation  ·  📝 = PR location

Risk: 44 files directly affected | 12 broken importers
Findings: 17 (12 code-backed, 13 doc-backed, 1 AI suggestions)

🔴 SECURITY

• ⚙️ CRITICAL: 8 files with auth, crypto, data, input, network access depend on modified constants.ts

  Show affected files

  • isOutOfBounds.tsx (fan-in: 12, tags: auth, data)
  • telemetry.ts (fan-in: 12, tags: auth, data, crypto, network)
  • CloseComeUtils.ts (fan-in: 12, tags: auth, data, crypto)
  • OgImages.tsx (fan-in: 12, tags: crypto)
  • CalEventParser.ts (fan-in: 12, tags: auth, input, data)
  • logger.ts (fan-in: 12, tags: auth)
  • username.ts (fan-in: 12, tags: auth, data, crypto, network)
  • Tasker.ts (fan-in: 12, tags: auth, crypto)

• 🔎 [SECURITY] Hardcoded default admin bypass token 'rl_bypass_default_k8s' is exposed in source code. This could allow attackers to bypass rate limiting if they discover the token, especially since it's a static...

  Read more

  ... value that doesn't change between deployments.

  - *Also flagged by: ARCHITECTURE, STYLE* 📖 *AGENTS_security_section.md lines 30-31* 📝 `packages/lib/constants.ts line 354`

🔴 ARCHITECTURE

• ⚙️ HIGH: 4 files with data, input access depend on modified constants.ts

  Show affected files

  • getBrandColours.tsx (fan-in: 12, tags: input)
  • redactError.ts (fan-in: 12, tags: data)
  • getCalcomUrl.ts (fan-in: 12, tags: none)
  • checkIfItFallbackImage.ts (fan-in: 12, tags: none)

• 🔎 [ARCHITECTURE] Rate limiting constants are being added to packages/lib/constants.ts which violates the architectural principle of keeping packages/lib as a low-level package with no feature dependencies. Rate...

  Read more

  ... limiting is a cross-cutting concern that should be organized by domain or placed in a more appropriate location.

  - *Also flagged by: STYLE, ONBOARDING* 📖 *architecture-circular-dependencies.md lines 1-20* 📝 `packages/lib/constants.ts lines 341-355`

🟢 LEGAL

✔ No issues found

🟡 STYLE

• 🔎 [STYLE] Magic number used as default fallback value. The style guide promotes clarity; magic numbers should be named constants.
  📖 quality-simplicity.md lines 1-30 📝 packages/lib/constants.ts line 347

🔴 ONBOARDING

• 🔎 [CHORE] PR description contains placeholder text 'N/A' for documentation updates instead of confirming if documentation was updated or not required
  📖 CONTRIBUTING_onboarding_section.md lines 57-60
• 🔎 [CHORE] PR checklist claims 'My PR is not too large (>500 lines or >10 files)' but this is a configuration-only change. While technically correct, the checklist item is misleading for this type of PR.
  📖 quality-pr-creation_onboarding_section.md lines 20-23

---

Powered by MatrixReview · Report incorrect finding