fix: various bugs in observability / OTel (#1564)

backend/internal/middleware/rate_limit.go

@@ -26,6 +26,7 @@ const (
 	RateLimitOneTimeAccessEmail     = "one-time-access-email"
 	RateLimitSendEmailVerification  = "send-email-verification"
 	RateLimitVerifyEmail            = "verify-email"
+	RateLimitInternal               = "internal"
 )
 
 // RateLimitPolicy is the configuration for a single rate-limit actor
@@ -45,14 +46,15 @@ type RateLimitPolicy struct {
 // The slice is built on each call so the policies are not retained at the package level, and the actor host registers one limiter per entry
 func RateLimitPolicies() []RateLimitPolicy {
 	return []RateLimitPolicy{
-		{Name: RateLimitAPI, Rate: 1, Per: time.Second, Burst: 100},
-		{Name: RateLimitSignup, Rate: 1, Per: time.Minute, Burst: 10},
-		{Name: RateLimitWebauthnLogin, Rate: 1, Per: 10 * time.Second, Burst: 5},
+		{Name: RateLimitAPI, Rate: 100, Per: time.Second},
+		{Name: RateLimitSignup, Rate: 2, Per: time.Minute, Burst: 10},
+		{Name: RateLimitWebauthnLogin, Rate: 1, Per: 5 * time.Second, Burst: 10},
 		{Name: RateLimitWebauthnReauthenticate, Rate: 1, Per: 10 * time.Second, Burst: 5},
 		{Name: RateLimitOneTimeAccessToken, Rate: 1, Per: 10 * time.Second, Burst: 5},
-		{Name: RateLimitOneTimeAccessEmail, Rate: 1, Per: 10 * time.Minute, Burst: 3},
-		{Name: RateLimitSendEmailVerification, Rate: 1, Per: 10 * time.Minute, Burst: 3},
+		{Name: RateLimitOneTimeAccessEmail, Rate: 2, Per: 10 * time.Minute, Burst: 5},
+		{Name: RateLimitSendEmailVerification, Rate: 2, Per: 10 * time.Minute, Burst: 1},
 		{Name: RateLimitVerifyEmail, Rate: 1, Per: 10 * time.Second, Burst: 5},
+		{Name: RateLimitInternal, Rate: 20, Per: time.Second, Burst: 20},
 	}
 }