refactor(middleware): migrate RateLimitMiddleware to ASGIMiddleware

[Kumzy]

Part of #4009 (Stacked PR to avoid conflicts in the changelog and whats-new-3 docs)

Moving RateLimitMiddleware from AbstractMiddleware to ASGIMiddleware.

The constructor takes keyword arguments now instead of an app and a RateLimitConfig object, with each argument defaulting to the matching config field. RateLimitConfig itself is unchanged and stays the way to configure this: its middleware property now returns a configured RateLimitMiddleware instance instead of a DefineMiddleware, so middleware=[config.middleware] keeps working as before.

Same breaking change as the other PRs in the series: exclude patterns now match the handler's path template at startup instead of the request path (documented in the changelog and whats-new-3).

One subtlety: scopes now filters by handler type at startup, and rate limiting must keep applying to mounted ASGI apps (that's what the ::mount cache key bucket is for). So the middleware declares scopes = (HTTP, ASGI) with a runtime scope-type guard, meaning mounts stay rate limited while websocket connections through them pass through, like before.

Added some tests, each verified to fail when its kwarg is dropped from the middleware property:

• One that checks set_rate_limit_headers=False really disables the headers. It was not covered before.
• One that checks the four custom header key settings are applied. Dropping them was undetected before.
• One that checks mounted ASGI apps are really rate limited (429 on the second request). The existing mount test couldn't tell "own bucket" apart from "not wrapped at all".
• One that checks excluding a route works with the route pattern like /user/{user_id:int}, not the full URL like /user/1. It was failing before.
• Extended the custom identity test so a different identity gets its own quota, without this, dropping identifier_for_request from the property was undetected.

Also updated the test_stores example test that reached into app.middleware[0].kwargs["config"], which no longer exists now that the property returns an instance.

---

📚 Documentation preview 📚: https://litestar-org.github.io/litestar-docs-preview/5005

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.19%. Comparing base (0f1910c) to head (84420b9).

Files with missing lines	Patch %	Lines
litestar/middleware/rate_limit.py	88.88%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@                 Coverage Diff                  @@
##           mw/allowed-hosts    #5005      +/-   ##
====================================================
- Coverage             67.19%   67.19%   -0.01%     
====================================================
  Files                   293      293              
  Lines                 15392    15404      +12     
  Branches               1749     1750       +1     
====================================================
+ Hits                  10342    10350       +8     
- Misses                 4896     4900       +4     
  Partials                154      154              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Kumzy]

Also implemented the from_config to reflect the changes done in CSRFMiddleware

[provinzkraut]

I don't think that's the right migration path.

middleware=[rate_limit_config.middleware]

should become middleware=[RateLimitMiddleware(...)]

[provinzkraut]

Don't really think we need this here?

[Kumzy]

Yes I did not look enough and tried to apply the same thing without looking at the same use

[provinzkraut]

Since this is one of the cases where the config becomes obsolete, we should deprecate the config.middleware property

[Kumzy]

Since this is one of the cases where the config becomes obsolete, we should deprecate the config.middleware property

I create a deprecation in v2 branch, or is it now for 4.X ? like handlers/base.py @provinzkraut