feat(webapp): bucket root API keys per environment too

Author: carderne

.server-changes/additional-api-key-rate-limit-bucket.md

@@ -3,4 +3,4 @@ area: webapp
 type: fix
 ---
 
-Additional environment API keys now share a single rate limit bucket per environment instead of each key getting its own, so minting more keys — including scope-restricted keys — no longer multiplies an environment's effective API rate limit. Root and legacy keys are unaffected. The bucket is keyed on the stable environment id (resolved scope-agnostically for bucketing only, never as an auth decision), and the result is cached per key so no extra per-request lookup is added.
+API rate limiting is now bucketed per environment instead of per API key. Previously each key (root or additional) got its own bucket, so minting more keys multiplied an environment's effective rate limit. Now all of an environment's keys — root and additional, including scope-restricted keys — share one bucket, so the ceiling is exactly the configured limit. The bucket is keyed on the stable environment id (resolved scope-agnostically for bucketing only, never as an auth decision), and the result is cached per key so no extra per-request lookup is added. Public JWTs keep per-token bucketing.

apps/webapp/app/services/apiRateLimit.server.ts

@@ -78,10 +78,14 @@ export const apiRateLimiter = authorizationRateLimitMiddleware({
       };
     }
 
-    // Root/legacy keys keep per-key (hashed header) bucketing: they already map
-    // 1:1 to an environment.
+    // Root/legacy keys also bucket per environment, so an environment's ceiling
+    // is exactly its configured limit regardless of key mix (root + additional
+    // keys share one bucket). The environment is already resolved above, so this
+    // adds no lookup. JWTs intentionally stay on per-token bucketing (handled
+    // above).
     return {
       config: authenticatedEnv.environment.organization.apiRateLimiterConfig,
+      identifier: authenticatedEnv.environment.id,
     };
   },
   pathMatchers: [/^\/api/],