feat(evault): per-platform rate limits with a control panel page

[coodos]

What

evault-core's rate limits were one env-configured value for every platform and every IP, changeable only by a restart. They are now rules managed from a new Rate Limits page in the control panel, applied immediately.

• Per-platform limits, with a default for unlisted platforms
• Per-IP or CIDR limits (raise or lower), IPv4 and IPv6, most specific range wins
• Block or exempt an IP, range or platform
• Live usage per platform and IP for the current window

How

• Rules live in a new evault_rate_limit_rule table. evault-core keeps them in an in-memory snapshot, reloaded on every admin write and every 30s, so the request path never touches the database. If the database is unavailable the limiter keeps the last rules, or the env defaults; it never fails closed.
• RATE_LIMIT_PER_PLATFORM / RATE_LIMIT_PER_IP remain as the defaults until a default is set in the dashboard. With an empty table behaviour is unchanged apart from the points below.
• The limiter now verifies the token signature (it previously trusted an unverified platform claim). The JWKS verifier is extracted from VaultAccessGuard and shared.
• The admin API is on the Express port (3001), which is not rate limited, so a block rule cannot lock admins out. It is guarded by a new RATE_LIMIT_ADMIN_SECRET and disabled while that is unset.
• New EVAULT_TRUST_PROXY (default off) for deployments behind a reverse proxy.

Behaviour changes to know about

• The IP limit is checked first and is the ceiling: the Registry signs any platform name, so a platform rule or exemption never lifts a caller above its IP limit. To give a platform headroom, raise its server IPs too. A platform block is advisory for the same reason.
• An invalid or unverifiable token is counted per IP only.
• OPTIONS preflights are no longer counted.
• 429 bodies gain a scope field (ip or platform); blocked callers get 403.
• Counters are still per process.

Deploy

1. pnpm --filter evault-core build && pnpm --filter evault-core migration:run
2. Set RATE_LIMIT_ADMIN_SECRET to the same value for evault-core and the control panel.

Testing

• 63 new unit tests in evault-core (limiter resolution order, CIDR matching, token verification and Registry outage, config fallback, admin API auth and validation).
• Run end to end against throwaway Postgres and Neo4j: platform limit hit and lifted without restart, IP limit, IP block with the admin API still reachable, defaults via the dashboard.
• Dashboard exercised in headless Chromium: live counters, prefilled block form, type-to-confirm dialog, saving a default.

Not in this PR

passphrase-rate-limiter reads a client-supplied X-Forwarded-For, so its brute-force guard can be bypassed when evault-core is directly exposed. Separate follow-up.

[coodos]

@codex review

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c4066f94-97a4-417e-afae-67fc67cb7427

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T07:07:45.487009Z	b81eef4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89e59ff826

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coodos]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: b81eef48c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".