fix: forgot password email DDP method doesn't have strict rate limits

[julio-rocketchat]

Proposed changes (including videos or screenshots)

The sendForgotPasswordEmail Meteor method (callable unauthenticated over DDP and method.callAnon) had no dedicated rate limit, relying only on the generic per-connection DDP limiter. This could be sidestepped by opening multiple connections or varying the anonymous connection ID, allowing password-reset emails to be triggered far faster than the REST users.forgotPassword endpoint permits.

Adds a DDPRateLimiter rule of 10 requests per 60 seconds per clientAddress, matching the REST endpoint's allowance. The limiter is keyed on clientAddress (rather than the always-null anonymous userId) so the limit is enforced per client instead of as a single global bucket.

Issue(s)

https://rocketchat.atlassian.net/browse/VLN-549

Steps to test or reproduce

Further comments

Summary by CodeRabbit

• Bug Fixes
  • Added per-client rate limiting to the “forgot password” email request, helping reduce abuse and improve service stability.
  • The password recovery flow now follows the same request limits as the related REST endpoint.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

🦋 Changeset detected

Latest commit: 7ee777d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 90909cc2-3e64-418d-baaf-af878415cb7a

📥 Commits

Reviewing files that changed from the base of the PR and between 692be5e and 7ee777d.

📒 Files selected for processing (2)

• .changeset/fuzzy-ends-refuse.md
• apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: cubic · AI code reviewer
• GitHub Check: Hacktron Security Check
• GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (4/5)
• GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (1/5)
• GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (3/5)
• GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (5/5)
• GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (2/5)
• GitHub Check: 🔨 Test UI (CE) / MongoDB 8.0 (4/4)
• GitHub Check: 🔨 Test UI (CE) / MongoDB 8.0 (1/4)
• GitHub Check: 🔨 Test UI (CE) / MongoDB 8.0 (2/4)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

• apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

🧠 Learnings (4)

📚 Learning: 2026-03-16T21:50:37.589Z

Learnt from: amitb0ra
Repo: RocketChat/Rocket.Chat PR: 39676
File: .changeset/migrate-users-register-openapi.md:3-3
Timestamp: 2026-03-16T21:50:37.589Z
Learning: For changes related to OpenAPI migrations in Rocket.Chat/OpenAPI, when removing endpoint types and validators from rocket.chat/rest-typings (e.g., UserRegisterParamsPOST, /v1/users.register) document this as a minor changeset (not breaking) per RocketChat/Rocket.Chat-Open-API#150 Rule 7. Note that the endpoint type is re-exposed via a module augmentation .d.ts in the consuming package (e.g., packages/web-ui-registration/src/users-register.d.ts). In reviews, ensure the changeset clearly states: this is a non-breaking change, the major version should not be bumped, and the changeset reflects a minor version bump. Do not treat this as a breaking change during OpenAPI migrations.

Applied to files:

• .changeset/fuzzy-ends-refuse.md

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

• apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

• apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

📚 Learning: 2026-05-06T12:21:44.083Z

Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.

Applied to files:

• apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

🔇 Additional comments (2)

apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts (1)

5-5: LGTM!

Also applies to: 48-59

.changeset/fuzzy-ends-refuse.md (1)

1-5: LGTM!

---

Walkthrough

The unauthenticated sendForgotPasswordEmail method now limits each client address to 10 requests per 60 seconds. A patch changeset documents the update.

Changes

Forgot Password Rate Limiting

Layer / File(s)	Summary
Apply password-reset rate limiting apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts, .changeset/fuzzy-ends-refuse.md	The method uses DDPRateLimiter to limit requests by client address. The changeset documents the patch.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: type: bug

Suggested reviewers: sampaiodiego, kevl ehman

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the stricter rate limiting added to the unauthenticated forgot-password email method.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

• VLN-549: Request failed with status code 401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.62%. Comparing base (a9296f1) to head (7ee777d).
⚠️ Report is 2 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41699      +/-   ##
===========================================
- Coverage    68.64%   68.62%   -0.02%     
===========================================
  Files         4162     4164       +2     
  Lines       158824   158959     +135     
  Branches     28107    28229     +122     
===========================================
+ Hits        109023   109093      +70     
- Misses       44628    44693      +65     
  Partials      5173     5173              

Flag	Coverage Δ
e2e	58.89% <ø> (+0.04%)	⬆️
e2e-api	45.75% <50.00%> (-0.24%)	⬇️
unit	70.54% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[julio-rocketchat]

/patch

[dionisio-bot]

Pull request #41818 added to Project: "Patch 8.7.1"

[julio-rocketchat]

/backport 8.6.2

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.6.2-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.6.2 again

[julio-rocketchat]

/backport 8.6.2

[dionisio-bot]

Pull request #41832 added to Project: "Patch 8.6.2"

[julio-rocketchat]

/backport 8.5.3

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.5.3-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.5.3 again

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.4.6-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.4.6 again

[julio-rocketchat]

/backport 8.4.6

[dionisio-bot]

Pull request #41854 added to Project: "Patch 8.4.6"

[julio-rocketchat]

/backport 8.3.8

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.3.8-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.3.8 again

[julio-rocketchat]

/backport 8.3.8

[dionisio-bot]

Pull request #41855 added to Project: "Patch 8.3.8"

[julio-rocketchat]

/backport 8.2.8

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.2.8-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.2.8 again

[julio-rocketchat]

/backport 8.2.8

[dionisio-bot]

Pull request #41856 added to Project: "Patch 8.2.8"

[julio-rocketchat]

/backport 8.1.8

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.1.8-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 8.1.8 again

[julio-rocketchat]

/backport 8.1.8

[dionisio-bot]

Pull request #41857 added to Project: "Patch 8.1.8"

[julio-rocketchat]

/backport 7.10.15

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.10.15-41699
git cherry-pick 3a61c3afed2df5d1555282e496e9f854c9e69916
// solve the conflict
git push

after that just run /backport 7.10.15 again

[julio-rocketchat]

/backport 7.10.15

[dionisio-bot]

Pull request #41858 added to Project: "Patch 7.10.15"