Rate limit of Cloud Code validator has no effect if defined at server start

[mtrezza]

Issue

A rateLimit in the validator of a Cloud Code function or trigger has no effect if it is defined in the Cloud Code that Parse Server loads on start with the option cloud. The same rate limit works if it is defined after the server has started.

• Parse.Cloud.define, beforeSave, beforeDelete, beforeLogin, beforePasswordResetRequest and beforeFind register the rate limit with addRateLimit(route, Parse.applicationId, true). With an app ID, addRateLimit adds the rate limit to a copy of the config from Config.get() and puts that copy into the app cache (src/middlewares.js:683, :788). At the end of start(), Config.put(this.config) puts the server config back into the app cache (src/ParseServer.ts:211), and that config doesn't contain the rate limit.

• Setting the Parse Server option rateLimit doesn't change this, because its rate limits are only added when the Express app is created after start().

• The specs in spec/RateLimit.spec.js define rate-limited Cloud Code only after the server has started, so they don't cover this.

• Reproduced on alpha at 9.10.2-alpha.5 and at bbf7737 with this Cloud Code in the option cloud. Calling the function 3 times returns HTTP 200, 200, 200. The same function defined after start() returns 200, 429, 429.

  Parse.Cloud.define('limited', () => 'ok', {
    rateLimit: { requestTimeWindow: 60000, requestCount: 1, includeInternalRequests: true },
  });

  includeInternalRequests is only set because the test requests come from localhost.

• Workaround: set the rate limit with the Parse Server option rateLimit instead, for example with requestPath: '/functions/limited'. It is enforced (200, 429, 429).

[parse-github-assistant]

🚀 Thanks for opening this issue!