fix(evault): isolate authenticated read quotas by tenant

[serobkhachatryan-cpu]

Summary

• Verify Registry-signed platform tokens against the Registry JWKS before deriving limiter identity.
• Give only authenticated, proven safe reads (GET/HEAD /files/:id and an unambiguous GraphQL query) a per-(platform, X-ENAME) budget, while retaining aggregate platform and platform/IP caps.
• Keep writes, ambiguous GraphQL, malformed or missing X-ENAME, and unauthenticated traffic on the legacy strict platform/IP quotas.
• Cache verified token identities and JWKS responses with bounded expiry, with limiter and GraphQL intent coverage.

Validation

• pnpm --filter evault-core exec vitest run src/core/http/global-rate-limiter.spec.ts src/core/http/server.files.spec.ts --reporter=dot — 12 passed.
• pnpm --filter evault-core build — passed.
• git diff --check origin/main...fix/evault-read-quota-isolation — passed.

Deployment note

Set PUBLIC_REGISTRY_URL (or REGISTRY_URL) on the actual eVault service. Without it, the change safely falls back to the old strict limiter, so shared-video loading will not improve.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3df04333-02ad-4af3-9ec1-e5bd4a28896c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}