[lilyshen0722]

Written by Flint, a Commonly agent — https://commonly.me/v2/pods/6a692a1be833c668acdb84cf

TASK-480

Tier 0, test-only. Existing main already tests two CF clients independently. Add the missing mixed-path witness: all requests share Supertest's loopback req.ip, one CF client exhausts its budget, the header-free client gets its own 200 then 429, and a second CF client still gets its own 200 then 429.

Proof: focused suite 13/13. Mutation replacing the production key generator with req.ip fails three cases, including the new test; production restored. No production change. This proves application keying, not edge-header trust or live ingress configuration.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: main
• File: .coderabbit.yaml
• Commit: b17a288
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 10ca7f3d-0dee-447b-8459-ff1540e885f2

Commits

Reviewing files that changed from the base of the PR and between b17a288 and 03743bd.

Files selected for processing: 1

• backend/__tests__/unit/middleware/platformRateLimit.test.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

Walkthrough

The change adds a unit test that verifies Cloudflare-address requests and header-free requests use independent rate-limit buckets. Each bucket allows one request and returns 429 for the next.

Changes: Rate-limit bucket isolation

Layer / File(s)	Summary
Verify independent rate-limit buckets backend/__tests__/unit/middleware/platformRateLimit.test.js	The test checks that requests from two Cloudflare addresses and the header-free fallback each succeed once, then receive 429.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• Team-Commonly/commonly#2383: Tests Cloudflare-aware rate-limit bucket isolation across mounted limiters, including distinct client IPs and the req.ip fallback.

Merge Risk: Minimal · up to 03743

This test-only change is mergeable with no outstanding production risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the main change: a test that proves req.ip fallback bucket isolation for rate limiting. It is a test-only change and matches the raw summary and objectives. It uses a conventional 'tes…
Description check		The description states the purpose (a mixed-path test for rate limiting), the test-only scope, and the verification steps (focused suite 13/13 and a mutation test that replaces the key generator with …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: a test that proves req.ip fallback bucket isolation for rate limiting. It is a test-only change and matches the raw summary and objectives. It uses a conventional 'test:' prefix and includes the ticket ID, which is acceptable.

Full details: Description check

Explanation

The description states the purpose (a mixed-path test for rate limiting), the test-only scope, and the verification steps (focused suite 13/13 and a mutation test that replaces the key generator with req.ip). It matches the changeset and the PR objectives, so it is not off-topic.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lilyshen0722]

TIER 0 PRESS CHECK at 03743bd.

Test-only PR: one file, backend/tests/unit/middleware/platformRateLimit.test.js (TASK-480). It pins #2325's keying: two different CF-Connecting-IP values get separate buckets, and a request with only req.ip set is still limited. Every CodeRabbit thread is answered (cr-unanswered: 0), and CI at this head is green.

GATE: PASS