feat(rate-limit): add correlation-id propagation on /api/rate-limit #877

[TINEROW]

Overview

This PR adds X-Correlation-Id generation and propagation through the /api/rate-limit route group, ensuring every response includes a correlation header and downstream handlers have access to req.correlationId for structured logging and outbound call correlation.

Related Issue

Closes #877

Changes

• [ADD] src/routes/rate-limit.ts — Main rate-limit router that applies correlationMiddleware (from src/middleware/correlation.ts) to all sub-routes before delegating to the health probe
• [MODIFY] src/app.ts — Updated to mount createRateLimitRouter instead of the bare health router; preserves the same /api/rate-limit/health endpoint path
• [ADD] src/routes/rate-limit/correlation.test.ts — 7 tests covering: response header presence, client-supplied ID echoing, UUID generation fallback, sanitation of oversized IDs, health endpoint compatibility, and header presence in degraded states

Verification Results

npx jest --forceExit src/routes/rate-limit/health.test.ts src/routes/rate-limit/correlation.test.ts src/routes/rate-limit/health.openapi.test.ts src/routes/rate-limit/openapi-yaml.test.ts
✅ 23/23 passed (7 new + 16 existing rate-limit tests)

Acceptance Criteria	Status
X-Correlation-Id set on all rate-limit responses	✅ correlationMiddleware applied at router level
Client-supplied correlation-id echoed back	✅ Resolved via resolveCorrelationId()
Missing correlation-id generates UUID v4	✅ Falls back to req.id then fresh UUID
Health endpoint continues to work	✅ Backward compatible — all health tests pass

Timeline

• TINEROW committed

[drips-wave]

@TINEROW Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Green ✅ merging. Thanks for the contribution!