fix cicd issues

apps/api/src/middleware/rateLimiter.ts

@@ -2,7 +2,7 @@ import rateLimit, { ipKeyGenerator } from 'express-rate-limit'
 import type { Request } from 'express'
 import { verifyAnyActorToken } from '../security/tokens'
 import { getSessionCookieName } from '../security/sessionCookies'
-import { sharedRateLimitStore } from './redisRateLimitStore'
+import { RedisRateLimitStore } from './redisRateLimitStore'
 
 const SESSION_COOKIE_NAMES = [
   getSessionCookieName('admin'),
@@ -53,14 +53,15 @@ function getAuthenticatedActorKey(req: Request): string | null {
 const getClientIpKey = (req: Request) => ipKeyGenerator(req.ip ?? '')
 const skipPreflightRequest = (req: Request) => req.method === 'OPTIONS'
 
-function withStore(options: Parameters<typeof rateLimit>[0]) {
+/** express-rate-limit forbids reusing one Store across limiters — unique prefix per limiter. */
+function withStore(prefix: string, options: Parameters<typeof rateLimit>[0]) {
   return rateLimit({
     ...options,
-    store: sharedRateLimitStore,
+    store: new RedisRateLimitStore(prefix),
   })
 }
 
-export const authLimiter = withStore({
+export const authLimiter = withStore('rl:auth:', {
   windowMs: 15 * 60 * 1000,
   max: 20,
   standardHeaders: 'draft-7',
@@ -71,7 +72,7 @@ export const authLimiter = withStore({
   message: { error: 'too_many_requests', message: 'Too many attempts, please try again later', statusCode: 429 },
 })
 
-export const apiLimiter = withStore({
+export const apiLimiter = withStore('rl:api:', {
   windowMs: 60 * 1000,
   max: 300,
   standardHeaders: 'draft-7',
@@ -87,7 +88,7 @@ export const apiLimiter = withStore({
   message: { error: 'too_many_requests', message: 'Rate limit exceeded', statusCode: 429 },
 })
 
-export const publicLimiter = withStore({
+export const publicLimiter = withStore('rl:public:', {
   windowMs: 60 * 1000,
   max: 60,
   standardHeaders: 'draft-7',
@@ -97,7 +98,7 @@ export const publicLimiter = withStore({
   message: { error: 'too_many_requests', message: 'Rate limit exceeded', statusCode: 429 },
 })
 
-export const webhookLimiter = withStore({
+export const webhookLimiter = withStore('rl:webhook:', {
   windowMs: 60 * 1000,
   max: 30,
   standardHeaders: 'draft-7',
@@ -107,7 +108,7 @@ export const webhookLimiter = withStore({
   message: { error: 'too_many_requests', message: 'Webhook rate limit exceeded', statusCode: 429 },
 })
 
-export const adminLimiter = withStore({
+export const adminLimiter = withStore('rl:admin:', {
   windowMs: 15 * 60 * 1000,
   max: 100,
   standardHeaders: 'draft-7',
@@ -120,7 +121,7 @@ export const adminLimiter = withStore({
   message: { error: 'too_many_requests', message: 'Too many admin requests', statusCode: 429 },
 })
 
-export const actorLimiter = withStore({
+export const actorLimiter = withStore('rl:actor:', {
   windowMs: 60 * 1000,
   max: 240,
   standardHeaders: 'draft-7',

apps/api/src/middleware/redisRateLimitStore.ts

@@ -76,5 +76,3 @@ export class RedisRateLimitStore implements Store {
     await redis.del(`${this.prefix}${key}`)
   }
 }
-
-export const sharedRateLimitStore = new RedisRateLimitStore('rl:api:')