feat: add account suspension error message for rate limiting#41254
Merged
jacquesikot merged 1 commit intoreleasefrom Sep 24, 2025
Merged
feat: add account suspension error message for rate limiting#41254jacquesikot merged 1 commit intoreleasefrom
jacquesikot merged 1 commit intoreleasefrom
Conversation
ssage for account suspension due to rate limiting
Contributor
WalkthroughIntroduces a new authentication message constant AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT and adds it to the approved static error messages list. No other logic or interfaces change. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
app/client/src/ce/constants/approvedErrorMessages.ts(2 hunks)app/client/src/ce/constants/messages.ts(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
app/client/src/ce/constants/approvedErrorMessages.ts (1)
app/client/src/ce/constants/messages.ts (1)
AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT(2682-2683)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: perform-test / rts-build / build
- GitHub Check: perform-test / server-build / server-unit-tests
- GitHub Check: perform-test / client-build / client-build
- GitHub Check: client-check-cyclic-deps / check-cyclic-dependencies
- GitHub Check: client-unit-tests / client-unit-tests
- GitHub Check: client-lint / client-lint
- GitHub Check: client-prettier / prettier-check
- GitHub Check: client-build / client-build
🔇 Additional comments (2)
app/client/src/ce/constants/approvedErrorMessages.ts (2)
12-12: Import looks goodCorrectly importing the new constant from messages.
43-43: Whitelisting added correctlyIncluding the new auth message in APPROVED_ERROR_MESSAGES.static is appropriate and keeps it consistent with existing auth errors.
Comment on lines
+2682
to
+2683
| export const AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT = () => | ||
| "Your account is suspended for 24 hours. Please reset your password to continue"; |
Contributor
There was a problem hiding this comment.
🛠️ Refactor suggestion
🧩 Analysis chain
Polish copy (punctuation) and confirm backend alignment
Add a terminal period for consistency. Also verify that advising a password reset actually lifts the 24h suspension; if not, tweak the guidance.
Apply this diff:
export const AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT = () =>
- "Your account is suspended for 24 hours. Please reset your password to continue";
+ "Your account is suspended for 24 hours. Please reset your password to continue.";Run to check for message mismatches and usage sites:
🏁 Script executed:
#!/bin/bash
# Look for occurrences of the message with/without trailing period
rg -n -S -P 'Your account is suspended for 24 hours\. Please reset your password to continue\.?' -C2
# Find all references to the constant
rg -n -S 'AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT' -C3Length of output: 3307
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "----- Show RateLimitConstants.java -----"
sed -n '1,200p' app/server/appsmith-server/src/main/java/com/appsmith/server/constants/RateLimitConstants.java || true
echo
echo "----- Find usages of RATE_LIMIT_REACHED_ACCOUNT_SUSPENDED -----"
rg -n --hidden -S 'RATE_LIMIT_REACHED_ACCOUNT_SUSPENDED' || true
echo
echo "----- Find rate-limit related classes/usages (server) -----"
rg -n --hidden -S 'RateLimit|RateLimiter|rate limit|rateLimiter|RATE_LIMIT' app/server || true
echo
echo "----- Search for login-related rate-limit handling -----"
rg -n --hidden -S 'login' app/server -g '!**/target/**' -C3 || true
echo
echo "----- Search for password reset/change endpoints/logic -----"
rg -n --hidden -S 'resetPassword|reset-password|forgotPassword|forgot-password|changePassword|change-password|reset password|forgot password' || true
echo
echo "----- Search for logic that clears rate limit on password reset -----"
rg -n --hidden -S 'clear.*rate|reset.*rate|remove.*rate|delete.*rate|clear.*bucket|reset.*bucket|delete.*bucket' app/server || trueLength of output: 123009
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "----- LoginRateLimitFilter.java -----"
sed -n '1,240p' app/server/appsmith-server/src/main/java/com/appsmith/server/filters/LoginRateLimitFilter.java || true
echo
echo "----- AuthenticationSuccessHandlerCE.java (around reset) -----"
sed -n '1,420p' app/server/appsmith-server/src/main/java/com/appsmith/server/authentication/handlers/ce/AuthenticationSuccessHandlerCE.java || true
echo
echo "----- RateLimitService interface & impls -----"
sed -n '1,240p' app/server/appsmith-server/src/main/java/com/appsmith/server/ratelimiting/RateLimitService.java || true
sed -n '1,320p' app/server/appsmith-server/src/main/java/com/appsmith/server/ratelimiting/RateLimitServiceImpl.java || true
sed -n '1,320p' app/server/appsmith-server/src/main/java/com/appsmith/server/ratelimiting/ce/RateLimitServiceCEImpl.java || true
echo
echo "----- UserServiceCEImpl.resetPasswordAfterForgotPassword -----"
sed -n '1,520p' app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java || true
echo
echo "----- Search for RateLimitService usage in UserService or password reset paths -----"
rg -n --hidden -S 'RateLimitService' app/server/appsmith-server/src/main/java/com/appsmith/server/services || true
rg -n --hidden -S 'reset.*rate|clear.*rate|remove.*rate|delete.*bucket|clear.*bucket|reset.*bucket|remove.*bucket' app/server || true
echo
echo "----- Client: Login.tsx error handling -----"
sed -n '1,520p' app/client/src/pages/UserAuth/Login.tsx || true
echo
echo "----- Client: check reading of error query param -----"
rg -n --hidden -S 'RateLimitExceeded|error=.*RateLimitExceeded|login.*error' app/client || trueLength of output: 267364
---
🏁 Script executed:
```shell
#!/bin/bash
set -euo pipefail
echo "----- app/client/src/ce/constants/approvedErrorMessages.ts -----"
sed -n '1,240p' app/client/src/ce/constants/approvedErrorMessages.ts || true
echo
echo "----- app/client/src/ee/constants/approvedErrorMessages.ts (if exists) -----"
sed -n '1,240p' app/client/src/ee/constants/approvedErrorMessages.ts || true
echo
echo "----- Search for getSafeErrorMessage definition -----"
rg -n --hidden -S "getSafeErrorMessage" -g '!**/target/**' || true
echo
echo "----- Show getSafeErrorMessage implementation (if found) -----"
sed -n '1,240p' app/client/src/ce/constants/approvedErrorMessages.ts || true
Length of output: 11074
Add trailing period and keep client/server messages identical
- Update app/client/src/ce/constants/messages.ts — AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMIT — add a terminal period.
- Update app/server/appsmith-server/src/main/java/com/appsmith/server/constants/RateLimitConstants.java — RATE_LIMIT_REACHED_ACCOUNT_SUSPENDED — add the same terminal period so the client’s approved-message check continues to match the server-sent text.
- No change to user guidance required: the password-reset flow calls rateLimitService.resetCounter(...) in app/server/.../UserServiceCEImpl.resetPasswordAfterForgotPassword, so resetting the password clears the login rate-limit.
🤖 Prompt for AI Agents
In app/client/src/ce/constants/messages.ts around lines 2682-2683 and in
app/server/appsmith-server/src/main/java/com/appsmith/server/constants/RateLimitConstants.java
(RATE_LIMIT_REACHED_ACCOUNT_SUSPENDED), the message strings lack a terminal
period and must match exactly between client and server; update both constants
to add a trailing period so the client’s approved-message check matches the
server-sent text, making no other behavioral changes.
trishaanand
approved these changes
Sep 24, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds a new error message constant
AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMITto handle cases where user accounts are suspended due to rate limiting violations.Changes
AUTH_ACCOUNT_SUSPENDED_FOR_RATE_LIMITmessage constant inmessages.tsapprovedErrorMessages.tsMessage Content
This provides clear guidance to users on both the suspension duration and the action they can take to resolve it.
Automation
/ok-to-test tags="@tag.Sanity, @tag.Authentication"
🔍 Cypress test results
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/17939195425
Commit: 5b1a651
Cypress dashboard.
Tags:
@tag.Sanity, @tag.AuthenticationSpec:
Tue, 23 Sep 2025 08:25:35 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit