Add per-IP rate limit to OTP

[pepeladeira]

Summary by CodeRabbit

Bug Fixes

• OTP requests now use a dual-tier rate-limiting strategy, combining a tighter per-identifier limit with an additional IP-based limit to better curb abuse without disrupting legitimate traffic.
• Client IP detection has been improved using more reliable request header resolution, with clearer provenance handling and safer fallback behavior when an IP can’t be determined.
• When OTP limits are exceeded, the user-facing “Too many requests. Please try again later.” message is returned consistently.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Ready	Preview	Jul 24, 2026 4:32pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 04e2b319-e7db-4f2e-9aea-a9a5ffcb4979

📥 Commits

Reviewing files that changed from the base of the PR and between d4a5940 and 276eaa6.

📒 Files selected for processing (3)

• apps/web/lib/actions/safe-action.ts
• apps/web/lib/actions/send-otp.ts
• apps/web/lib/api/utils/get-ip.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• apps/web/lib/actions/send-otp.ts

---

📝 Walkthrough

Walkthrough

sendOtpAction now resolves IP provenance, logs fallback addresses, and applies concurrent email and IP rate limits. Shared IP utilities expose source information while preserving getIP(), and server-action error logging is flushed through a deferred callback.

Changes

OTP request protection

Layer / File(s)	Summary
IP provenance resolution apps/web/lib/api/utils/get-ip.ts	IP resolution now returns an address with either x-real-ip or fallback provenance, while getIP() returns only the address.
Dual-layer OTP rate limiting apps/web/lib/actions/send-otp.ts	OTP requests use concurrent 2/minute email and 15/hour IP limits, skip the IP limit for fallback addresses, log limit and fallback events, and select only the existing user ID.
Deferred server-error logging apps/web/lib/actions/safe-action.ts	Server-action error handling schedules logger.flush() through a deferred callback.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant sendOtpAction
  participant getIPWithSource
  participant ratelimit
  sendOtpAction->>getIPWithSource: resolve IP and source
  getIPWithSource-->>sendOtpAction: return ip and source
  sendOtpAction->>ratelimit: check email and applicable IP limits concurrently
  ratelimit-->>sendOtpAction: return limit results

Loading

Suggested reviewers: devkiran

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a per-IP rate limit to OTP sending.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch otp-send-ip-ratelimit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[general-adhoc]

Overall I think this is a great system protection to add (esp. against bots / AI), however would recommend adding a little better logging/observability so we can understand how often we're using FALLBACK_IP_ADDRESS and denying OTP requests.

Also, it would be good to setup some sort of alarming on OTP throttling so we can understand if we are getting attacked vs. many new signups for a new corp client etc. Maybe >10 blocks in 10m to start

[pepeladeira]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/web/lib/actions/send-otp.ts`:
- Around line 43-50: Update the email-based limiter in the Promise.all block to
use only the email address in its send-otp key, restoring the
`send-otp:${email}` format. Keep the separate IP limiter keyed by
`send-otp:${ip}` and preserve the existing fallback behavior for unknown IPs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a403687-cc4c-40ba-96a1-e80f78d16b2f

📥 Commits

Reviewing files that changed from the base of the PR and between 5ee94ea and d4a5940.

📒 Files selected for processing (2)

• apps/web/lib/actions/send-otp.ts
• apps/web/lib/api/utils/get-ip.ts