fix(e2e): override auth endpoint rate limits

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/e2e/settings/smoke/authenticated.spec.ts

@@ -43,7 +43,18 @@ test('billing-enabled signup, login, and settings use real Sim boundaries', asyn
 
   await page.getByLabel('Email').fill(email)
   await page.getByRole('textbox', { name: 'Password' }).fill(password)
-  await page.getByRole('button', { name: 'Sign in' }).click()
+  const [signInResponse] = await Promise.all([
+    page.waitForResponse((response) => {
+      const url = new URL(response.url())
+      return (
+        response.request().method() === 'POST' &&
+        url.origin === new URL(page.url()).origin &&
+        url.pathname === '/api/auth/sign-in/email'
+      )
+    }),
+    page.getByRole('button', { name: 'Sign in', exact: true }).click(),
+  ])
+  expect(signInResponse.status(), signInResponse.statusText()).toBe(200)
   await expect(page).toHaveURL(/\/workspace(?:\/|$)/)
 
   await page.context().storageState({ path: storageStatePath })

apps/sim/lib/auth/auth.ts

@@ -211,7 +211,19 @@ export const auth = betterAuth({
   disabledPaths: [...SSO_DISABLED_PATHS],
   // Full browser contracts intentionally exercise many isolated sessions from loopback.
   // Keep Better Auth's limiter enabled while raising only the hermetic profile's ceiling.
-  ...(usesGuardedE2eAuthRateLimit ? { rateLimit: { max: 10_000 } } : {}),
+  // Better Auth's built-in sign-in/sign-up rules override the base maximum, so they
+  // require explicit custom rules for the shared loopback IP used by Playwright.
+  ...(usesGuardedE2eAuthRateLimit
+    ? {
+        rateLimit: {
+          max: 10_000,
+          customRules: {
+            '/sign-in/*': { window: 10, max: 10_000 },
+            '/sign-up/*': { window: 10, max: 10_000 },
+          },
+        },
+      }
+    : {}),
   trustedOrigins: [
     getBaseUrl(),
     ...(env.NEXT_PUBLIC_SOCKET_URL ? [env.NEXT_PUBLIC_SOCKET_URL] : []),