remove comments

Author: carderne

apps/webapp/app/services/apiRateLimit.server.ts

@@ -50,15 +50,7 @@ export const apiRateLimiter = authorizationRateLimitMiddleware({
     }
 
     // Additional API keys (`tr_*_sk_*`) share their environment's rate limit
-    // bucket rather than each getting their own. Keying on the stable
-    // environment id (not the secret key, which can rotate) keeps a single
-    // bucket per environment no matter how many additional keys exist.
-    // Root/legacy keys fall through to the default per-key (hashed header)
-    // bucketing: they already map 1:1 to an environment.
-    //
-    // This reuses the already-authenticated environment above; the whole
-    // override result is cached per key by the middleware's SWR cache, so no
-    // separate lookup or Redis mapping is needed for the identifier.
+    // bucket rather than each getting their own.
     const apiKey = authenticatedEnv.apiKey;
     const identifier =
       apiKey && isAdditionalApiKey(apiKey) ? authenticatedEnv.environment.id : undefined;

apps/webapp/app/services/authorizationRateLimitMiddleware.server.ts

@@ -52,16 +52,6 @@ export const RateLimiterConfig = z.discriminatedUnion("type", [
 
 export type RateLimiterConfig = z.infer<typeof RateLimiterConfig>;
 
-/**
- * Result of an override lookup for a given Authorization header.
- *
- * - `config`: the rate limiter configuration to apply (bucket size). When
- *   absent, the default limiter is used.
- * - `identifier`: the value to key the rate limit bucket on. When absent, the
- *   hashed Authorization header is used (the legacy per-key behavior). Supply a
- *   stable value (e.g. an environment id) so multiple credentials that should
- *   share a bucket collapse onto one. Never a secret: it lands in Redis keys.
- */
 type RateLimitOverride = {
   config?: unknown;
   identifier?: string;
@@ -136,8 +126,6 @@ async function resolveRateLimit(
       return { config: defaultLimiter } satisfies ResolvedRateLimit;
     }
 
-    // The identifier (if any) is trusted through even when the config falls back
-    // to the default: bucketing and bucket size are independent concerns.
     const identifier = override.identifier;
 
     if (!override.config) {
@@ -309,9 +297,6 @@ export function authorizationRateLimitMiddleware({
       limiterConfigOverride
     );
 
-    // Bucket key: an override-supplied identifier (e.g. environment id, so all
-    // additional API keys for an environment share one bucket) or, by default,
-    // the hashed Authorization header (legacy per-key behavior).
     const rateLimitIdentifier = identifier ?? hashedAuthorizationValue;
 
     const limiter = createLimiterFromConfig(limiterConfig);