fix(rate-limit): enforce user group limits for API keys

[LiaoQi98]

⚠️ 提交说明 / PR Notice

Important

• 请提供人工撰写的简洁摘要，避免直接粘贴未经整理的 AI 输出。

Note

This change and PR description were AI-assisted with Codex for LiaoQi98. The PR is opened as a draft for human and maintainer review.

📝 变更描述 / Description

Model request rate-limit groups are documented and configured as user-group policies, but the middleware previously preferred the API key's routing group. A user in a restricted group could therefore create a key assigned to default (or another less-restricted usable group) and fall back to that group's or the global request limit.

This change always selects ContextKeyUserGroup when resolving ModelRequestRateLimitGroup. API key groups continue to control routing, but can no longer override the account's rate-limit policy.

The regression test configures a paid user group with a one-request limit and a default key group with a ten-request limit. It verifies that the second request is rejected with HTTP 429, proving the user-group limit remains authoritative.

🚀 变更类型 / Type of change

• 🐛 Bug 修复 (Bug fix) - 请关联对应 Issue，避免将设计取舍、理解偏差或预期不一致直接归类为 bug
• ✨ 新功能 (New feature) - 重大特性建议先通过 Issue 沟通
• ⚡ 性能优化 / 重构 (Refactor)
• 📝 文档更新 (Documentation)

🔗 关联任务 / Related Issue

• Closes Rate limits can easily be bypassed #6333

✅ 提交前检查项 / Checklist

• 人工确认: 我已亲自整理并撰写此描述，没有直接粘贴未经处理的 AI 输出。
• 非重复提交: 我已搜索现有的 Issues 与 PRs，确认不是重复提交。
• Bug fix 说明: 若此 PR 标记为 Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。
• 变更理解: 我已理解这些更改的工作原理及可能影响。
• 范围聚焦: 本 PR 未包含任何与当前任务无关的代码改动。
• 本地验证: 已在本地运行并通过测试或手动验证，维护者可以据此复核结果。
• 安全合规: 代码中无敏感凭据，且符合项目代码规范。

📸 运行证明 / Proof of Work

go test ./middleware -run 'TestModelRequestRateLimitUsesUserGroupInsteadOfTokenGroup|TestModelRedisRateLimitUsesUTCRegardlessOfLocalTimezone' -count=1
ok  github.com/QuantumNous/new-api/middleware

go test ./middleware -count=1
ok  github.com/QuantumNous/new-api/middleware

go test -race ./middleware -count=1
ok  github.com/QuantumNous/new-api/middleware

go vet ./middleware
passed

git diff --check
passed

Summary by CodeRabbit

• Bug Fixes
  • Model request rate limiting now consistently uses the user’s assigned group limits.
  • Token-specific group settings can no longer override the applicable user-group rate limits.
• Tests
  • Added coverage to verify rate limiting behaves correctly when user and token groups differ.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a4140076-b07e-49bb-8c30-cce5155b9d9b

📥 Commits

Reviewing files that changed from the base of the PR and between 2d8e50b and c06e632.

📒 Files selected for processing (2)

• middleware/model-rate-limit.go
• middleware/model_rate_limit_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The middleware now applies model rate limits from the user group only. A new integration test verifies that a token group cannot override the user group's configured limit.

Changes

User-group rate limiting

Layer / File(s)	Summary
User-group selection and validation middleware/model-rate-limit.go, middleware/model_rate_limit_test.go	The middleware uses constant.ContextKeyUserGroup to load group limits. The integration test uses different user and token groups and verifies 204 No Content followed by 429 Too Many Requests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c06e6

This change makes account-level rate-limit policies authoritative over API-key routing groups and adds regression coverage for the bypass scenario. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: calcium-ion

Poem

A rabbit guards the limit gate,
The user group decides the rate.
Token tricks now lose their way,
Two hops pass, then blocked they stay.
“Bunny-approved!” the counters say.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The code uses ContextKeyUserGroup for rate-limit lookup and adds a regression test for issue #6333.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested middleware fix and its regression test.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes enforcing rate limits based on the authenticated user's group for API keys.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}