NoMongo: Apply rate limiting to API endpoints

[im-vedant]

Overview
We created a hosted Test Website for us to evaluate the application's develop-postgres branch.
The implementation of this site exposed many shortcomings which are documented in our Talawa Security Improvements - 2025 document.
This is one of the action plan issues in that document.

This issue requires someone with very good knowledge of the code base
This includes:

1. Many merged PRs
2. Meaningful updates to the repository
3. Active participation in our slack channels and design document creation

Describe the bug

Currently, Talawa API does not have API rate limiting.

Expected behavior

1. The design must comply with the Talawa Security Improvements document
   https://docs.google.com/document/d/16fJEZQHzji_RuarBn-33UvFYUh78ERZPKRFyTnvxyxc/edit?tab=t.0

Additional details

You will need to submit multiple PRs to get this done:

1. This will reduce the risk of merge conflicts
2. It will make reviews faster

[im-vedant]

@palisadoes assign

[Cioppolo14]

Our policy is to assign no more than two issues to each contributor across all repositories. This way everyone gets a chance to participate in the projects. We sometimes give exceptions for more urgent cases and sometimes we lose track, but the policy stands. You have reached your limit, please wait until your existing issues are closed before requesting more issues. You could unassign yourself from one of the other issues too. @im-vedant

[prayanshchh]

would like to work on this one, I have asked to unassign from two issues assigned to me

1. Error when clicking on Manage button in talawa-admin as Admin in develop branch talawa-admin#3598
2. NoMongo: Several Post Bugs #2839

@Cioppolo14

[VanshikaSabharwal]

Please Assign

[iamanishx]

@im-vedant what are the approaches to implement the web-server rate limiting ?

[im-vedant]

@iamanishx https://docs.google.com/document/d/152l1rGiwLyLHjJwj0PQLzv2RLdS19ufE_3r3SrjZ8wg/edit?usp=drivesdk

[iamanishx]

@im-vedant i have got that but are you applying in talawa-api?
Using fastify rate limit ?

[im-vedant]

@iamanishx Yes, I am applying rate limiting to talawa api. I am not using fast rate limit.

[iamanishx]

@iamanishx Yes, I am applying rate limiting to talawa api. I am not using fast rate limit.

@im-vedant Can you confirm what you have planned to use .
This thing can be implemented in the BFF server which will be more better!

[palisadoes]

@im-vedant What is your proposed approach?

[palisadoes]

I just saw the document.

@iamanishx

1. What is the BFF approach?
2. I remember seeing the document. Please post the link here.
3. Is there an issue related to it? We'll need to update the security document

[iamanishx]

I just saw the document. @iamanishx What is the BFF approach? I remember seeing the document. Please post the link here.

https://docs.google.com/document/d/1465DpM1G1eNqJKjBjIvyvMjbnL3LcfiYPZw9fgait_Q/edit?tab=t.0

here it is

[im-vedant]

@im-vedant What is your proposed approach?

https://docs.google.com/document/d/152l1rGiwLyLHjJwj0PQLzv2RLdS19ufE_3r3SrjZ8wg/edit?tab=t.0

[iamanishx]

PalisadoesFoundation/talawa-admin#3755
this was the opened issue .

this the issue opend for this and we are working on this . a minimal fastify bff server has been made and we are able make api calls from localhost admin to make api calls to test.talawa.io/graphql without any cors issue .

for making proper authorized calls in between bff server and api we will use mTLS approach .

the rate-limiting can be done properly within the BFF server .

[im-vedant]

@iamanishx We need to consider mobile version too. For that need to implement API rate limiting in talawa api.

[iamanishx]

@iamanishx We need to consider mobile version too. For that need to implement API rate limiting in talawa api.

yes good point as there is no issue of cors in between mobile and api it would be better not to include the BFF server between them .

[github-actions]

This issue did not get any activity in the past 10 days and will be closed in 180 days if no update occurs. Please check if the develop branch has fixed it and report again or close the issue.

[palisadoes]

Unassigned. Inactivity

[im-vedant]

@palisadoes I am working on it. Last week my exams were going on. I have made significant progress. Will raise a pr in 2-3 days.