fix: upgrade express-rate-limit and retryAfter math

TheLastCicada · TheLastCicada · commit 8ec3e31afb8e · 2026-05-08T12:35:13.000-07:00
Use the latest express-rate-limit release so the patched ip-address
version is resolved without a local override. Also correct the custom
429 retryAfter payload to report seconds remaining instead of an epoch
timestamp, and add focused coverage for the helper.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -75,7 +75,7 @@
     "dotenv": "^17.2.3",
     "express": "^5.2.1",
     "express-joi-validation": "^6.1.0",
-    "express-rate-limit": "^8.2.1",
+    "express-rate-limit": "^8.5.1",
     "joi": "^17.13.3",
     "js-yaml": "^4.1.1",
     "lodash": "^4.18.1",
@@ -123,7 +123,6 @@
   "overrides": {
     "diff": "8.0.3",
     "esbuild": "0.27.3",
-    "ip-address": "10.1.1",
     "tar": "7.5.13",
     "mocha": {
       "serialize-javascript": "7.0.5"
diff --git a/src/middleware.js b/src/middleware.js
@@ -20,6 +20,7 @@ import { Organization } from './models';
 import { OrganizationsV2 } from './models/v2/index.js';
 import { logger } from './config/logger.js';
 import { sendReadOnlyError } from './utils/read-only-response.js';
+import { getRateLimitRetryAfterSeconds } from './utils/rate-limit.js';
 
 const { USE_SIMULATOR } = getConfig().APP;
 
@@ -68,7 +69,7 @@ const generalLimiter = rateLimit({
       message: 'Too many requests. Please slow down and try again later.',
       error: 'RATE_LIMIT_EXCEEDED',
       success: false,
-      retryAfter: Math.ceil(req.rateLimit.resetTime / 1000), // seconds until reset
+      retryAfter: getRateLimitRetryAfterSeconds(req.rateLimit?.resetTime),
     });
   },
 });
diff --git a/src/utils/rate-limit.js b/src/utils/rate-limit.js
@@ -0,0 +1,12 @@
+export const getRateLimitRetryAfterSeconds = (resetTime, now = Date.now()) => {
+  if (!(resetTime instanceof Date)) {
+    return 0;
+  }
+
+  const resetTimestamp = resetTime.getTime();
+  if (Number.isNaN(resetTimestamp)) {
+    return 0;
+  }
+
+  return Math.max(0, Math.ceil((resetTimestamp - now) / 1000));
+};
diff --git a/tests/resources/rate-limit.spec.js b/tests/resources/rate-limit.spec.js
@@ -0,0 +1,23 @@
+import { expect } from 'chai';
+import { getRateLimitRetryAfterSeconds } from '../../src/utils/rate-limit.js';
+
+describe('Rate limit utilities', function () {
+  it('returns seconds remaining until reset', function () {
+    const now = 1_700_000_000_000;
+    const resetTime = new Date(now + 4_500);
+
+    expect(getRateLimitRetryAfterSeconds(resetTime, now)).to.equal(5);
+  });
+
+  it('returns zero when the reset time has already passed', function () {
+    const now = 1_700_000_000_000;
+    const resetTime = new Date(now - 1_000);
+
+    expect(getRateLimitRetryAfterSeconds(resetTime, now)).to.equal(0);
+  });
+
+  it('returns zero when reset time is missing or invalid', function () {
+    expect(getRateLimitRetryAfterSeconds()).to.equal(0);
+    expect(getRateLimitRetryAfterSeconds(new Date('invalid date'))).to.equal(0);
+  });
+});
