feat(config): add rate limit configuration for emails in toml

[avallete]

Allow to configure rate limits via the config.toml

Comes with the docs PR here: supabase/supabase#33830

[linear]

DEVWF-350 Add Rate Limit Configuration for Emails in `config.toml`

[coveralls]

Pull Request Test Coverage Report for Build 13535289202

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 61 of 61 (100.0%) changed or added relevant lines in 2 files are covered.
• 5 unchanged lines in 1 file lost coverage.
• Overall coverage increased (+0.2%) to 58.408%

---

Files with Coverage Reduction	New Missed Lines	%
internal/gen/keys/keys.go	5	12.9%

Totals
Change from base Build 13513651492:	0.2%
Covered Lines:	7850
Relevant Lines:	13440

---

💛 - Coveralls

[sweatybridge]

I think it's worth moving them to a new struct so it aligns with our dashboard. For eg.

[auth.rate_limits]
# Number of emails that can be sent per hour. Requires auth.email.smtp to be enabled.
emails_sent = 2
# Number of SMS messages that can be sent per hour. Requires auth.sms to be enabled.
sms_sent = 30
# Number of sessions that can be refreshed in a 5 minute interval per IP address.
token_refreshes = 150
# Number of OTP / Magic link verifications that can be made in a 5 minute interval per IP address.
token_verifications = 30
# Number of anonymous sign-ins that can be made per hour per IP address. Requires enable_anonymous_sign_ins = true.
anonymous_users = 30
# Number of sign up and sign-in requests that can be made in a 5 minute interval per IP address (excludes anonymous users).
sign_in_sign_ups = 30

Btw it's really confusing to me why rate_limit_otp maps to number of sign-in and sign-ups https://github.com/supabase/supabase/blob/master/apps/studio/components/interfaces/Auth/RateLimits/RateLimits.tsx#L417

[avallete]

Regrouped it into the same struct, had to update a bunch of test snapshot because of it tough 😅

[sweatybridge]

Suggested change

	# email_sent = 2
	# Number of SMS messages that can be sent per hour. Requires auth.sms to be enabled.
	# sms_sent = 30
	email_sent = 2
	# Number of SMS messages that can be sent per hour. Requires auth.sms to be enabled.
	sms_sent = 30

It's a bit annoying that we can't leave these uncommented for consistency. Can update api to support configuring values < shared quota?

[avallete]

I'm not sure how much of a side effect this could have looking at those lines on API side:

https://github.com/supabase/infrastructure/blob/43c6d1a97c73eda0c171990ecd4e4ede5bafd185/api/src/common/projects/project-gotrue-config.service.ts#L359-L366

I think it might break some other behaviors.

[sweatybridge]

Any objection to make these non-pointers? We are setting default values for these fields https://github.com/supabase/cli/pull/3206/files#diff-ec116054b1a1deee8fc9bfb3c95419fcdae3c4d5a2c0b7a25c7c55ac1cfb135dR130-R142 so only the commented out EmailSent and SmsSent are nil pointers.