fix search feature

apps/api/src/middleware/rateLimiter.test.ts

@@ -31,6 +31,8 @@ describe('rateLimiter middleware configuration', () => {
 
     expect(authLimiter.max).toBe(20)
     expect(authLimiter.windowMs).toBe(15 * 60 * 1000)
+    expect(authLimiter.skip({ method: 'OPTIONS' } as any)).toBe(true)
+    expect(authLimiter.skip({ method: 'POST' } as any)).toBe(false)
     expect(authLimiter.skipSuccessfulRequests).toBe(true)
     expect(authLimiter.message).toMatchObject({ error: 'too_many_requests', statusCode: 429 })
     expect(rateLimit).toHaveBeenCalled()
@@ -63,7 +65,18 @@ describe('rateLimiter middleware configuration', () => {
 
     expect(publicLimiter.max).toBe(60)
     expect(publicLimiter.message.message).toBe('Rate limit exceeded')
+    expect(publicLimiter.skip({ method: 'OPTIONS' } as any)).toBe(true)
     expect(adminLimiter.max).toBe(100)
     expect(adminLimiter.message.message).toBe('Too many admin requests')
+    expect(adminLimiter.skip({ method: 'OPTIONS' } as any)).toBe(true)
+  })
+
+  it('uses a higher API cap and skips preflight requests before authenticated actor limits', async () => {
+    const { apiLimiter, actorLimiter } = await import('./rateLimiter')
+
+    expect(apiLimiter.max).toBe(300)
+    expect(apiLimiter.skip({ method: 'OPTIONS' } as any)).toBe(true)
+    expect(apiLimiter.skip({ method: 'GET' } as any)).toBe(false)
+    expect(actorLimiter.skip({ method: 'OPTIONS' } as any)).toBe(true)
   })
 })