refactor(BA-7364): drop the rate limit from the auth response

The limit is a resource policy value, not part of who authenticated, and a
session snapshot of it goes stale: the manager reads the policy per request
while a web server session would hold the login-time value for up to a week.
The web server will read it from the shared rate limit Redis DB instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jopemachine

changes/13777.feature.md

@@ -1 +1 @@
-Return the login user's id and rate limit from the authorization API, and keep both in the web server session.
+Return the login user's id from the authorization API and keep it in the web server session.

src/ai/backend/common/dto/manager/auth/types.py

@@ -58,7 +58,6 @@ class AuthSuccessResponse(AuthResponse):
     status: str
     session_token: str
     user_id: UserID
-    rate_limit: int | None
     type: AuthTokenType = AuthTokenType.KEYPAIR
 
     def to_dict(self) -> dict[str, Any]:

src/ai/backend/manager/api/rest/auth/handler.py

@@ -169,7 +169,6 @@ async def authorize(
             status=auth_result.status,
             session_token=auth_result.session_token,
             user_id=auth_result.user_id,
-            rate_limit=auth_result.rate_limit,
         )
         resp = AuthorizeResponse(data=data)
         return APIResponse.build(HTTPStatus.OK, resp)

src/ai/backend/manager/data/auth/types.py

@@ -29,7 +29,6 @@ class AuthorizationResult:
     role: UserRole
     status: str
     session_token: str
-    rate_limit: int | None
 
 
 @dataclass

src/ai/backend/manager/services/auth/service.py

@@ -416,8 +416,6 @@ async def _create_login_session(
                 role=UserRole(user.role),
                 status=user.status,
                 session_token=session_result.session_token,
-                # TODO: take this from the user resource policy instead of the keypair.
-                rate_limit=keypair_row.rate_limit,
             ),
         )
 

src/ai/backend/web/server.py

@@ -507,7 +507,6 @@ async def _set_login_history(last_login_attempt: float, login_fail_count: float
                     "role": token.role,
                     "status": token.status,
                     "user_id": str(token.user_id),
-                    "rate_limit": token.rate_limit,
                 }
                 public_return = {
                     "access_key": token.access_key,
@@ -770,7 +769,6 @@ async def token_login_handler(request: web.Request) -> web.Response:
             "role": token.role,
             "status": token.status,
             "user_id": str(token.user_id),
-            "rate_limit": token.rate_limit,
         }
         public_return = {
             "access_key": token.access_key,

tests/unit/client_v2/test_auth_client.py

@@ -82,7 +82,6 @@ async def test_authorize(self, sample_client_type_id: UUID) -> None:
                     "status": "active",
                     "session_token": "test_session_token",
                     "user_id": "12345678-1234-5678-1234-567812345678",
-                    "rate_limit": None,
                     "type": AuthTokenType.KEYPAIR,
                 },
             }

tests/unit/common/dto/manager/auth/test_auth_response.py

@@ -34,7 +34,6 @@ def test_authorize_response() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
-        rate_limit=None,
         type=AuthTokenType.KEYPAIR,
     )
     resp = AuthorizeResponse(data=data)

tests/unit/common/dto/manager/auth/test_auth_types.py

@@ -45,7 +45,6 @@ def test_auth_success_response_creation() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
-        rate_limit=None,
     )
     assert resp.access_key == "AKTEST"
     assert resp.secret_key == "SKTEST"
@@ -63,7 +62,6 @@ def test_auth_success_response_to_dict() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
-        rate_limit=None,
         type=AuthTokenType.JWT,
     )
     d = resp.to_dict()
@@ -125,7 +123,6 @@ def test_parse_auth_response_success() -> None:
         "status": "active",
         "session_token": "test_token",
         "user_id": "12345678-1234-5678-1234-567812345678",
-        "rate_limit": None,
     }
     result = parse_auth_response(data)
     assert isinstance(result, AuthSuccessResponse)
@@ -162,7 +159,6 @@ def test_parse_auth_response_explicit_success() -> None:
         "status": "active",
         "session_token": "test_token",
         "user_id": "12345678-1234-5678-1234-567812345678",
-        "rate_limit": None,
     }
     result = parse_auth_response(data)
     assert isinstance(result, AuthSuccessResponse)

tests/unit/manager/api/auth/test_handlers.py

@@ -248,7 +248,6 @@ def authorize_result(self) -> AuthorizeActionResult:
                 role=UserRole.USER,
                 status=UserStatus.ACTIVE,
                 session_token="test_session_token",
-                rate_limit=30000,
             ),
         )