From 5fef45fb68dc52a2e87fa569596fa13b1efee7d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Sun, 24 May 2026 11:57:01 +0200
Subject: [PATCH] fix: bypass rate limiter when E2E=true

E2E suite drives registrations from one IP at parallel volume;
production limits trip and flake tests. Same opt-out pattern as the
fail-loud secret/DB-URL guards.
---
 apps/journal/app/lib/rate-limit.server.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/apps/journal/app/lib/rate-limit.server.ts b/apps/journal/app/lib/rate-limit.server.ts
index 08b6fcd..b818fe5 100644
--- a/apps/journal/app/lib/rate-limit.server.ts
+++ b/apps/journal/app/lib/rate-limit.server.ts
@@ -52,6 +52,12 @@ export interface RateLimitOptions {
  * one endpoint doesn't lock out the others.
  */
 export function consumeRateLimit(opts: RateLimitOptions): RateLimitResult {
+  // E2E suite drives auth flows from one IP at high volume; production
+  // limits would trip and flake tests. Same opt-out pattern as
+  // requireSecret() / getDatabaseUrl().
+  if (process.env.E2E === "true") {
+    return { allowed: true, remaining: opts.limit, resetMs: opts.windowMs };
+  }
   ensureSweeper();
   const now = Date.now();
   const id = `${opts.scope}:${opts.key}`;