snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/usage-limit/api-rate-limit.integration-spec.ts

@@ -0,0 +1,284 @@
+import { findManyOperationFactory } from 'test/integration/graphql/utils/find-many-operation-factory.util';
+import { generateApiKeyToken } from 'test/integration/graphql/utils/generate-api-key-token.util';
+import { makeGraphqlAPIRequest } from 'test/integration/graphql/utils/make-graphql-api-request.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { makeRestAPIRequest } from 'test/integration/rest/utils/make-rest-api-request.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+
+import { gql } from 'graphql-tag';
+import { createClient } from 'redis';
+import { FeatureFlagKey } from 'twenty-shared/types';
+import { type Repository } from 'typeorm';
+
+import { ApiKeyEntity } from 'src/engine/core-modules/api-key/api-key.entity';
+import { FeatureFlagEntity } from 'src/engine/core-modules/feature-flag/feature-flag.entity';
+import { UsageLimitEntity } from 'src/engine/core-modules/usage-limit/usage-limit.entity';
+import { UsageOperationType } from 'src/engine/core-modules/usage/enums/usage-operation-type.enum';
+import { UsageResourceType } from 'src/engine/core-modules/usage/enums/usage-resource-type.enum';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const WINDOW_SECONDS = 1;
+const LIMIT_VALUE = 1;
+
+describe('API rate limiting', () => {
+  let usageLimitRepository: Repository<UsageLimitEntity>;
+  let featureFlagRepository: Repository<FeatureFlagEntity>;
+  let apiKeyRepository: Repository<ApiKeyEntity>;
+  let redis: Awaited<ReturnType<typeof createClient>>;
+  let usageLimitId: string;
+  let apiKeyId: string;
+  let apiKeyToken: string;
+
+  const findCompaniesOverGraphql = () =>
+    makeGraphqlAPIRequest(
+      findManyOperationFactory({
+        objectMetadataSingularName: 'company',
+        objectMetadataPluralName: 'companies',
+        gqlFields: 'id',
+        first: 1,
+      }),
+      apiKeyToken,
+    );
+
+  const findCompaniesOverRest = () =>
+    makeRestAPIRequest({
+      method: 'get',
+      path: '/companies?limit=1',
+      bearer: apiKeyToken,
+    });
+
+  // Every test starts from a full bucket so it does not inherit whatever the
+  // previous one spent.
+  const waitForBucketRefill = () =>
+    new Promise((resolve) => setTimeout(resolve, WINDOW_SECONDS * 1000 + 200));
+
+  const invalidateWorkspaceCaches = async () => {
+    const keys = [
+      ...(await redis.keys(`*featureFlagsMap:${SEED_APPLE_WORKSPACE_ID}*`)),
+      ...(await redis.keys(`*usageLimits:${SEED_APPLE_WORKSPACE_ID}*`)),
+    ];
+
+    if (keys.length > 0) {
+      await redis.del(keys);
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 300));
+  };
+
+  // The rule targets a key created for this suite alone. A workspace-scoped one
+  // would meter every caller in the seeded workspace, and deleting it here
+  // cannot undo that: the workspace cache memoizes resolved entries in process
+  // for MEMOIZER_TTL_MS, so the next spec file would still be rate limited.
+  const createDedicatedApiKey = async () => {
+    const rolesResponse = await makeMetadataAPIRequest({
+      query: gql`
+        query GetRoles {
+          getRoles {
+            id
+            label
+          }
+        }
+      `,
+    });
+
+    const adminRoleId = rolesResponse.body.data?.getRoles?.find(
+      (role: { label: string }) => role.label === 'Admin',
+    )?.id;
+
+    jestExpectToBeDefined(adminRoleId);
+
+    const createResponse = await makeMetadataAPIRequest({
+      query: gql`
+        mutation CreateApiKey($input: CreateApiKeyInput!) {
+          createApiKey(input: $input) {
+            id
+          }
+        }
+      `,
+      variables: {
+        input: {
+          name: 'API rate limiting test key',
+          expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+          roleId: adminRoleId,
+        },
+      },
+    });
+
+    apiKeyId = createResponse.body.data?.createApiKey?.id;
+    jestExpectToBeDefined(apiKeyId);
+
+    const tokenResponse = await generateApiKeyToken({
+      apiKeyId,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+    });
+
+    apiKeyToken = tokenResponse.body.data?.generateApiKeyToken?.token;
+    jestExpectToBeDefined(apiKeyToken);
+  };
+
+  beforeAll(async () => {
+    usageLimitRepository =
+      getCoreRepository<UsageLimitEntity>(UsageLimitEntity);
+    featureFlagRepository =
+      getCoreRepository<FeatureFlagEntity>(FeatureFlagEntity);
+    apiKeyRepository = getCoreRepository<ApiKeyEntity>(ApiKeyEntity);
+    redis = await createClient({ url: process.env.REDIS_URL }).connect();
+
+    await createDedicatedApiKey();
+
+    await featureFlagRepository.delete({
+      key: FeatureFlagKey.IS_API_RATE_LIMIT_V2_ENABLED,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+    await featureFlagRepository.save({
+      key: FeatureFlagKey.IS_API_RATE_LIMIT_V2_ENABLED,
+      value: true,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+
+    const [usageLimit] = await usageLimitRepository.save([
+      {
+        workspaceId: SEED_APPLE_WORKSPACE_ID,
+        resourceType: UsageResourceType.API,
+        operationType: UsageOperationType.API_REQUEST,
+        spenderType: 'apiKey',
+        spenderId: apiKeyId,
+        limitKind: 'speed',
+        periodCount: WINDOW_SECONDS,
+        periodUnit: 'second',
+        meter: 'quantity',
+        limitValue: LIMIT_VALUE,
+        burstValue: LIMIT_VALUE,
+      },
+    ]);
+
+    usageLimitId = usageLimit.id;
+
+    await invalidateWorkspaceCaches();
+  });
+
+  afterAll(async () => {
+    await usageLimitRepository.delete({ id: usageLimitId });
+    await featureFlagRepository.delete({
+      key: FeatureFlagKey.IS_API_RATE_LIMIT_V2_ENABLED,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+    await apiKeyRepository.delete({ id: apiKeyId });
+    await invalidateWorkspaceCaches();
+    await redis.quit();
+  });
+
+  describe('over GraphQL', () => {
+    it('admits a request and rejects the one that follows it', async () => {
+      await waitForBucketRefill();
+
+      const admitted = await findCompaniesOverGraphql();
+
+      expect(admitted.body.errors).toBeUndefined();
+
+      const rejected = await findCompaniesOverGraphql();
+
+      expect(rejected.body.errors?.[0]?.extensions?.code).toBe('RATE_LIMITED');
+    });
+
+    // GraphQL keeps answering 200 and reports the denial in the extensions, so
+    // an Apollo caller reads it as a GraphQL error rather than a network one.
+    it('reports the denial in the body rather than in the HTTP status', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverGraphql();
+
+      const rejected = await findCompaniesOverGraphql();
+
+      expect(rejected.status).toBe(200);
+      expect(rejected.body.errors?.[0]?.extensions?.http).toBeUndefined();
+    });
+
+    it('names the exhausted scope and says when to retry', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverGraphql();
+
+      const { body } = await findCompaniesOverGraphql();
+      const extensions = body.errors?.[0]?.extensions;
+
+      expect(extensions).toMatchObject({
+        code: 'RATE_LIMITED',
+        limitKind: 'speed',
+        exhaustedKind: 'limit',
+        limit: LIMIT_VALUE,
+        remaining: 0,
+        periodCount: WINDOW_SECONDS,
+        periodUnit: 'second',
+        scope: { spenderType: 'apiKey', spenderId: apiKeyId },
+      });
+      expect(extensions.retryAfterMs).toBeGreaterThan(0);
+    });
+
+    it('lets the caller back in once the window refills', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverGraphql();
+      await findCompaniesOverGraphql();
+
+      await waitForBucketRefill();
+
+      expect((await findCompaniesOverGraphql()).body.errors).toBeUndefined();
+    });
+  });
+
+  describe('over REST', () => {
+    it('admits a request and rejects the one that follows it', async () => {
+      await waitForBucketRefill();
+
+      const admitted = await findCompaniesOverRest();
+
+      expect(admitted.status).toBe(200);
+
+      const rejected = await findCompaniesOverRest();
+
+      expect(rejected.status).toBe(429);
+    });
+
+    it('names the exhausted scope in the body', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverRest();
+
+      const { body } = await findCompaniesOverRest();
+
+      expect(body).toMatchObject({
+        statusCode: 429,
+        error: 'RATE_LIMITED',
+        limitKind: 'speed',
+        exhaustedKind: 'limit',
+        limit: LIMIT_VALUE,
+        remaining: 0,
+        periodCount: WINDOW_SECONDS,
+        periodUnit: 'second',
+        retryAfterSeconds: 1,
+        scope: { spenderType: 'apiKey', spenderId: apiKeyId },
+      });
+      expect(body.messages).toHaveLength(1);
+    });
+
+    it('answers with a Retry-After the caller can honour', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverRest();
+
+      const rejected = await findCompaniesOverRest();
+
+      expect(rejected.headers['retry-after']).toBe('1');
+      expect(rejected.headers['x-ratelimit-limit']).toBe(String(LIMIT_VALUE));
+      expect(rejected.headers['x-ratelimit-remaining']).toBe('0');
+      expect(Number(rejected.headers['x-ratelimit-reset'])).toBeGreaterThan(0);
+    });
+
+    it('lets the caller back in once the window refills', async () => {
+      await waitForBucketRefill();
+      await findCompaniesOverRest();
+      await findCompaniesOverRest();
+
+      await waitForBucketRefill();
+
+      expect((await findCompaniesOverRest()).status).toBe(200);
+    });
+  });
+});

packages/twenty-server/test/integration/usage-limit/usage-limit-mutations.integration-spec.ts

@@ -0,0 +1,245 @@
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+
+import { gql } from 'graphql-tag';
+import { createClient } from 'redis';
+import { type Repository } from 'typeorm';
+
+import { UsageLimitEntity } from 'src/engine/core-modules/usage-limit/usage-limit.entity';
+import { UsageOperationType } from 'src/engine/core-modules/usage/enums/usage-operation-type.enum';
+import { UsageResourceType } from 'src/engine/core-modules/usage/enums/usage-resource-type.enum';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const CREATE_USAGE_LIMIT = gql`
+  mutation CreateUsageLimit($input: CreateUsageLimitInput!) {
+    createUsageLimit(input: $input) {
+      id
+      limitValue
+      periodUnit
+    }
+  }
+`;
+
+const UPDATE_USAGE_LIMIT = gql`
+  mutation UpdateUsageLimit($input: UpdateUsageLimitInput!) {
+    updateUsageLimit(input: $input) {
+      id
+      limitValue
+      periodUnit
+    }
+  }
+`;
+
+const DELETE_USAGE_LIMIT = gql`
+  mutation DeleteUsageLimit($usageLimitId: UUID!) {
+    deleteUsageLimit(usageLimitId: $usageLimitId)
+  }
+`;
+
+const USAGE_QUOTAS_WITH_CONSUMPTION = gql`
+  query UsageQuotasWithConsumption {
+    usageQuotasWithConsumption {
+      id
+      limitValue
+      periodUnit
+      spenderType
+    }
+  }
+`;
+
+const buildPayload = (
+  overrides: Record<string, unknown> = {},
+): Record<string, unknown> => ({
+  resourceType: UsageResourceType.AI,
+  operationType: UsageOperationType.AI_CHAT_TOKEN,
+  spenderType: 'workspace',
+  spenderId: null,
+  limitKind: 'quota',
+  periodCount: 1,
+  periodUnit: 'month',
+  meter: 'creditsUsedMicro',
+  limitValue: 1_000_000,
+  burstValue: null,
+  ...overrides,
+});
+
+describe('Usage limit mutations', () => {
+  let usageLimitRepository: Repository<UsageLimitEntity>;
+  let redis: Awaited<ReturnType<typeof createClient>>;
+
+  const createUsageLimitRequest = (overrides: Record<string, unknown> = {}) =>
+    makeMetadataAPIRequest({
+      query: CREATE_USAGE_LIMIT,
+      variables: { input: buildPayload(overrides) },
+    });
+
+  const updateUsageLimit = (
+    id: string,
+    overrides: Record<string, unknown> = {},
+  ) =>
+    makeMetadataAPIRequest({
+      query: UPDATE_USAGE_LIMIT,
+      variables: { input: { id, payload: buildPayload(overrides) } },
+    });
+
+  const findQuotasWithConsumption = async () => {
+    const response = await makeMetadataAPIRequest({
+      query: USAGE_QUOTAS_WITH_CONSUMPTION,
+    });
+
+    return response.body.data?.usageQuotasWithConsumption ?? [];
+  };
+
+  const createUsageLimit = async (overrides: Record<string, unknown> = {}) => {
+    const response = await createUsageLimitRequest(overrides);
+    const usageLimitId = response.body.data?.createUsageLimit?.id;
+
+    jestExpectToBeDefined(usageLimitId);
+
+    return usageLimitId as string;
+  };
+
+  beforeAll(async () => {
+    usageLimitRepository =
+      getCoreRepository<UsageLimitEntity>(UsageLimitEntity);
+    redis = await createClient({ url: process.env.REDIS_URL }).connect();
+  });
+
+  afterEach(async () => {
+    await usageLimitRepository.delete({ workspaceId: SEED_APPLE_WORKSPACE_ID });
+
+    const keys = await redis.keys(`*usageLimits:${SEED_APPLE_WORKSPACE_ID}*`);
+
+    if (keys.length > 0) {
+      await redis.del(keys);
+    }
+  });
+
+  afterAll(async () => {
+    await redis.quit();
+  });
+
+  describe('createUsageLimit', () => {
+    it('creates a limit and lists it with its consumption', async () => {
+      const usageLimitId = await createUsageLimit();
+
+      const quotas = await findQuotasWithConsumption();
+
+      expect(quotas).toContainEqual(
+        expect.objectContaining({
+          id: usageLimitId,
+          limitValue: 1_000_000,
+          periodUnit: 'month',
+          spenderType: 'workspace',
+        }),
+      );
+    });
+
+    it('refuses a scope another limit already covers', async () => {
+      await createUsageLimit();
+
+      const response = await createUsageLimitRequest({ limitValue: 2_000_000 });
+
+      expect(response.body.errors?.[0]?.message).toBe(
+        'Another usage limit already covers this scope',
+      );
+      expect(
+        await usageLimitRepository.countBy({
+          workspaceId: SEED_APPLE_WORKSPACE_ID,
+        }),
+      ).toBe(1);
+    });
+
+    it('refuses a quota carrying a burst value', async () => {
+      const response = await createUsageLimitRequest({ burstValue: 10 });
+
+      expect(response.body.errors?.[0]?.message).toBe(
+        'A quota cannot hold a burst value',
+      );
+    });
+  });
+
+  describe('updateUsageLimit', () => {
+    it('changes the amount without moving the row', async () => {
+      const usageLimitId = await createUsageLimit();
+
+      const response = await updateUsageLimit(usageLimitId, {
+        limitValue: 5_000_000,
+      });
+
+      expect(response.body.data?.updateUsageLimit).toEqual(
+        expect.objectContaining({ id: usageLimitId, limitValue: 5_000_000 }),
+      );
+      expect(await findQuotasWithConsumption()).toHaveLength(1);
+    });
+
+    it('moves the limit to another scope, keeping its id', async () => {
+      const usageLimitId = await createUsageLimit();
+
+      const response = await updateUsageLimit(usageLimitId, {
+        periodUnit: 'week',
+      });
+
+      expect(response.body.data?.updateUsageLimit).toEqual(
+        expect.objectContaining({ id: usageLimitId, periodUnit: 'week' }),
+      );
+
+      const quotas = await findQuotasWithConsumption();
+
+      expect(quotas).toHaveLength(1);
+      expect(quotas[0]).toEqual(
+        expect.objectContaining({ id: usageLimitId, periodUnit: 'week' }),
+      );
+    });
+
+    it('refuses a scope another limit already covers', async () => {
+      await createUsageLimit();
+      const weeklyUsageLimitId = await createUsageLimit({
+        periodUnit: 'week',
+      });
+
+      const response = await updateUsageLimit(weeklyUsageLimitId, {
+        periodUnit: 'month',
+      });
+
+      expect(response.body.errors?.[0]?.message).toBe(
+        'Another usage limit already covers this scope',
+      );
+      expect(await findQuotasWithConsumption()).toHaveLength(2);
+    });
+
+    it('refuses an id that belongs to no limit of this workspace', async () => {
+      const response = await updateUsageLimit(
+        '20202020-0000-4000-8000-000000000000',
+      );
+
+      expect(response.body.errors?.[0]?.message).toBe(
+        'No usage limit 20202020-0000-4000-8000-000000000000 in this workspace',
+      );
+    });
+  });
+
+  describe('deleteUsageLimit', () => {
+    it('removes the limit from the list', async () => {
+      const usageLimitId = await createUsageLimit();
+
+      const response = await makeMetadataAPIRequest({
+        query: DELETE_USAGE_LIMIT,
+        variables: { usageLimitId },
+      });
+
+      expect(response.body.data?.deleteUsageLimit).toBe(true);
+      expect(await findQuotasWithConsumption()).toEqual([]);
+    });
+
+    it('reports nothing deleted for an unknown id', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: DELETE_USAGE_LIMIT,
+        variables: { usageLimitId: '20202020-0000-4000-8000-000000000000' },
+      });
+
+      expect(response.body.data?.deleteUsageLimit).toBe(false);
+    });
+  });
+});

packages/twenty-server/test/integration/usage-limit/webhook-rate-limit.integration-spec.ts

@@ -0,0 +1,194 @@
+import { makeGraphqlAPIRequest } from 'test/integration/graphql/utils/make-graphql-api-request.util';
+import {
+  createWebhook,
+  createWebhookReceiver,
+  deleteWebhook,
+} from 'test/integration/metadata/suites/utils/webhook-test.util';
+import { makeAdminPanelAPIRequest } from 'test/integration/twenty-config/utils/make-admin-panel-api-request.util';
+import { expectEventually } from 'test/integration/utils/expect-eventually.util';
+import { getCoreRepository } from 'test/integration/utils/get-core-repository.util';
+
+import { gql } from 'graphql-tag';
+import { createClient } from 'redis';
+import { FeatureFlagKey } from 'twenty-shared/types';
+import { type Repository } from 'typeorm';
+import { v4 as uuidv4 } from 'uuid';
+
+import { FeatureFlagEntity } from 'src/engine/core-modules/feature-flag/feature-flag.entity';
+import { UsageLimitEntity } from 'src/engine/core-modules/usage-limit/usage-limit.entity';
+import { UsageOperationType } from 'src/engine/core-modules/usage/enums/usage-operation-type.enum';
+import { UsageResourceType } from 'src/engine/core-modules/usage/enums/usage-resource-type.enum';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const WEBHOOK_RECEIVER_PORT = 4318;
+const WINDOW_SECONDS = 60;
+const LIMIT_VALUE = 2;
+const PERSON_COUNT = 5;
+
+const CREATE_CONFIG_VARIABLE_MUTATION = gql`
+  mutation CreateDatabaseConfigVariable($key: String!, $value: JSON!) {
+    createDatabaseConfigVariable(key: $key, value: $value)
+  }
+`;
+
+const DELETE_CONFIG_VARIABLE_MUTATION = gql`
+  mutation DeleteDatabaseConfigVariable($key: String!) {
+    deleteDatabaseConfigVariable(key: $key)
+  }
+`;
+
+const CREATE_PERSON_MUTATION = gql`
+  mutation CreatePerson($data: PersonCreateInput!) {
+    createPerson(data: $data) {
+      id
+    }
+  }
+`;
+
+const DESTROY_PERSON_MUTATION = gql`
+  mutation DestroyPerson($id: ID!) {
+    destroyPerson(id: $id) {
+      id
+    }
+  }
+`;
+
+describe('Webhook rate limiting', () => {
+  let usageLimitRepository: Repository<UsageLimitEntity>;
+  let featureFlagRepository: Repository<FeatureFlagEntity>;
+  let redis: Awaited<ReturnType<typeof createClient>>;
+  let usageLimitId: string;
+  let webhookId: string;
+  let receiver: Awaited<ReturnType<typeof createWebhookReceiver>>;
+
+  const createdPersonIds: string[] = [];
+
+  const invalidateWorkspaceCaches = async () => {
+    const keys = [
+      ...(await redis.keys(`*featureFlagsMap:${SEED_APPLE_WORKSPACE_ID}*`)),
+      ...(await redis.keys(`*usageLimits:${SEED_APPLE_WORKSPACE_ID}*`)),
+    ];
+
+    if (keys.length > 0) {
+      await redis.del(keys);
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 300));
+  };
+
+  const createPerson = async (lastName: string) => {
+    const response = await makeGraphqlAPIRequest({
+      query: CREATE_PERSON_MUTATION,
+      variables: { data: { name: { firstName: 'WebhookThrottle', lastName } } },
+    });
+
+    expect(response.body.errors).toBeUndefined();
+    createdPersonIds.push(response.body.data.createPerson.id);
+  };
+
+  beforeAll(async () => {
+    jest.useRealTimers();
+
+    usageLimitRepository =
+      getCoreRepository<UsageLimitEntity>(UsageLimitEntity);
+    featureFlagRepository =
+      getCoreRepository<FeatureFlagEntity>(FeatureFlagEntity);
+    redis = await createClient({ url: process.env.REDIS_URL }).connect();
+
+    await makeAdminPanelAPIRequest({
+      query: CREATE_CONFIG_VARIABLE_MUTATION,
+      variables: { key: 'OUTBOUND_HTTP_ALLOWED_INTERNAL_HOSTS', value: ['*'] },
+    });
+
+    await featureFlagRepository.delete({
+      key: FeatureFlagKey.IS_WEBHOOK_RATE_LIMIT_ENABLED,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+    await featureFlagRepository.save({
+      key: FeatureFlagKey.IS_WEBHOOK_RATE_LIMIT_ENABLED,
+      value: true,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+
+    const [usageLimit] = await usageLimitRepository.save([
+      {
+        workspaceId: SEED_APPLE_WORKSPACE_ID,
+        resourceType: UsageResourceType.WEBHOOK,
+        operationType: UsageOperationType.WEBHOOK_CALL,
+        spenderType: 'workspace',
+        spenderId: '',
+        limitKind: 'speed',
+        periodCount: WINDOW_SECONDS,
+        periodUnit: 'second',
+        meter: 'quantity',
+        limitValue: LIMIT_VALUE,
+        burstValue: LIMIT_VALUE,
+      },
+    ]);
+
+    usageLimitId = usageLimit.id;
+
+    await invalidateWorkspaceCaches();
+
+    receiver = await createWebhookReceiver(WEBHOOK_RECEIVER_PORT);
+
+    const createWebhookResponse = await createWebhook({
+      targetUrl: `http://127.0.0.1:${WEBHOOK_RECEIVER_PORT}/webhook`,
+      operations: ['person.created'],
+      description: 'Webhook rate limiting test webhook',
+      secret: 'test-secret',
+    });
+
+    expect(createWebhookResponse.body.errors).toBeUndefined();
+    webhookId = createWebhookResponse.body.data.createWebhook.id;
+  });
+
+  afterAll(async () => {
+    await receiver.close();
+    await deleteWebhook(webhookId).catch(() => {});
+
+    for (const personId of createdPersonIds) {
+      await makeGraphqlAPIRequest({
+        query: DESTROY_PERSON_MUTATION,
+        variables: { id: personId },
+      }).catch(() => {});
+    }
+
+    await usageLimitRepository.delete({ id: usageLimitId });
+    await featureFlagRepository.delete({
+      key: FeatureFlagKey.IS_WEBHOOK_RATE_LIMIT_ENABLED,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+    });
+    await makeAdminPanelAPIRequest({
+      query: DELETE_CONFIG_VARIABLE_MUTATION,
+      variables: { key: 'OUTBOUND_HTTP_ALLOWED_INTERNAL_HOSTS' },
+    }).catch(() => {});
+
+    await invalidateWorkspaceCaches();
+    await redis.quit();
+    jest.useFakeTimers();
+  });
+
+  it('delivers what the bucket admits and drops the rest of the burst', async () => {
+    const testId = uuidv4().slice(0, 8);
+
+    for (let personIndex = 0; personIndex < PERSON_COUNT; personIndex++) {
+      await createPerson(`Test-${testId}-${personIndex}`);
+    }
+
+    await expectEventually(
+      () => {
+        expect(receiver.receivedPayloads.length).toBe(LIMIT_VALUE);
+      },
+      { timeoutMs: 30_000, intervalMs: 100 },
+    );
+
+    await new Promise((resolve) => setTimeout(resolve, 2_000));
+
+    expect(receiver.receivedPayloads.length).toBe(LIMIT_VALUE);
+    expect(receiver.receivedPayloads[0]).toMatchObject({
+      targetUrl: `http://127.0.0.1:${WEBHOOK_RECEIVER_PORT}/webhook`,
+      eventName: 'person.created',
+    });
+  }, 60_000);
+});