From b29852466396d6e59188aca1649b7d114a3458fc Mon Sep 17 00:00:00 2001
From: Nicolas Meienberger <github@thisprops.com>
Date: Fri, 13 Mar 2026 23:03:19 +0100
Subject: [PATCH] test: disable rate limiting in testing

---
 app/server/app.ts         | 22 ++++++++++------------
 app/server/core/config.ts |  2 +-
 app/server/lib/auth.ts    |  6 ++++++
 3 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/app/server/app.ts b/app/server/app.ts
index 4431e9fe..fca8126f 100644
--- a/app/server/app.ts
+++ b/app/server/app.ts
@@ -52,18 +52,16 @@ export const createApp = () => {
 		app.use(honoLogger());
 	}
 
-	if (!config.disableRateLimiting) {
-		app.use(
-			rateLimiter({
-				windowMs: 60 * 5 * 1000,
-				limit: 1000,
-				keyGenerator: (c) => c.req.header("x-forwarded-for") ?? "",
-				skip: () => {
-					return config.__prod__ === false;
-				},
-			}),
-		);
-	}
+	app.use(
+		rateLimiter({
+			windowMs: 60 * 5 * 1000,
+			limit: 1000,
+			keyGenerator: (c) => c.req.header("x-forwarded-for") ?? "",
+			skip: () => {
+				return config.disableRateLimiting;
+			},
+		}),
+	);
 
 	app.use(
 		bodyLimit({
diff --git a/app/server/core/config.ts b/app/server/core/config.ts
index 9f4247d6..9c9b9407 100644
--- a/app/server/core/config.ts
+++ b/app/server/core/config.ts
@@ -55,7 +55,7 @@ const envSchema = z
 			.filter(Boolean)
 			.concat(s.BASE_URL) ?? [s.BASE_URL],
 		trustProxy: s.TRUST_PROXY === "true",
-		disableRateLimiting: s.DISABLE_RATE_LIMITING === "true",
+		disableRateLimiting: s.DISABLE_RATE_LIMITING === "true" || s.NODE_ENV === "test",
 		appSecret: s.APP_SECRET,
 		baseUrl: s.BASE_URL,
 		isSecure: s.BASE_URL?.startsWith("https://") ?? false,
diff --git a/app/server/lib/auth.ts b/app/server/lib/auth.ts
index 0e8549d4..d91da47e 100644
--- a/app/server/lib/auth.ts
+++ b/app/server/lib/auth.ts
@@ -38,9 +38,15 @@ export const auth = betterAuth({
 		protocol: "auto",
 	},
 	trustedOrigins: config.trustedOrigins,
+	rateLimit: {
+		enabled: !config.disableRateLimiting,
+	},
 	advanced: {
 		cookiePrefix: "zerobyte",
 		useSecureCookies: config.isSecure,
+		ipAddress: {
+			disableIpTracking: config.disableRateLimiting,
+		},
 	},
 	onAPIError: {
 		throw: true,