Set per-tool rate limits in Settings → Roles and log refused calls - #1556

Summary

#1544 added per-tool rate limits for MCP roles, but only through the API. An admin could not see or set them in the dashboard, and a call refused by a limit left no trace in the logs. This adds the dashboard part, logs refused calls, and documents the CLI path.

Changes

Dashboard: Settings → Roles → Manage tools (settings/roles/page.tsx)

• Each ticked tool gets two optional fields, per minute and per hour. Empty means unlimited, and the saved values are loaded.
• The connector header shows how many of its tools are limited ("2 limited").
• A note explains the rules:
  • the limit counts per user and tool, across all API keys and sessions;
  • admins are never limited;
  • refused calls show up under Logs.
• Saving validates every value first: a whole number of 1 or more, or empty. Nothing is saved on an invalid value. Then it saves the tool list (PUT /api/roles/:id/tools) and only the limits that changed (PUT .../rate-limit). New grants start unlimited, as the API does.
• System roles show no limit fields, since the API refuses changes to them.
• Texts in en, de and it.

Backend: logging (dynamic-mcp-tools.ts)

• A refused call is logged like a failed call: status ERROR, error Rate limit reached: ..., input and output. It shows up in /logs and in GET /api/audit/invocations.
• It is logged without connectorId. Connector health (MCP server view), the connector failure alerts in AuditService.logInvocation and the support desk's connector_issues all group errors by connector. A refusal we made ourselves says nothing about the connector.
• If writing the log fails, a warning is logged and the call is still refused.

CLI README: a recipe for setting and clearing limits with amcp api, and for finding refused calls in the audit log.

Cloud and self-hosted: same behaviour in both. No migration and no new endpoint; it uses the endpoints from #1544.

Type

• New feature (UI for an existing API)

Testing

• Added/updated unit tests
• Added an e2e test

In packages/backend:

• npx jest src/mcp-server: 700 passed, 5 skipped. New tests:
  • a refused call is logged with status ERROR and without the connector;
  • a failing log write still refuses.
• npx tsc --noEmit and npx eslint on the changed files: clean.

In packages/frontend:

• npx playwright test tests/e2e/role-tool-rate-limits.spec.ts tests/e2e/i18n.spec.ts: 57 passed. The new spec covers:
  • the saved limit is shown;
  • ticking a tool and setting an hourly limit;
  • clearing a limit, with the exact PUT bodies;
  • a 0 is refused and nothing is saved.
• npx tsc --noEmit: clean.
• npx eslint on the changed files: no errors. The 2 warnings are the existing loadData effect on this page, unchanged.

Root: node scripts/generate-llms-txt.mjs --check: up to date.

Checklist

• My code follows the existing code style
• I have tested my changes locally