feat: allow subscriptions to be excluded from rate limiting

[alepane21]

Summary by CodeRabbit

• New Features

  • Added an option to exclude subscription operations from rate limiting.
  • Subscription rate limiting can be configured through YAML or an environment variable.
  • Queries and mutations remain rate limited as before.

• Documentation

  • Updated configuration examples and schema documentation.
  • Added a warning about potential denial-of-service risks when subscription rate limiting is disabled.

• Tests

  • Added coverage for subscription behavior over WebSocket and SSE connections.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• If applicable, I have provided instructions for reviewers for manually validating my changes.
• Documentation has been updated on https://github.com/wundergraph/docs-website.
• I have read the Contributors Guide.

Open Source AI Manifesto

This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
wundergraphinc	🟢 Ready	View Preview	Aug 6, 2026, 3:39 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• demo/pkg/subgraphs/courses/generated/mapping.json is excluded by !**/generated/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 854b5b69-aaf5-4846-8b39-c4f56ee4f2f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Adds rate_limit.exclude_subscriptions, defaulting to false. When enabled, subscription operations bypass rate limiting while queries and mutations remain limited. The change applies to WebSocket and SSE flows and includes integration tests and documentation.

Changes

Subscription rate-limit exclusion

Layer / File(s)	Summary
Rate-limit configuration contract router/pkg/config/config.go, router/pkg/config/config.schema.json, router/pkg/config/testdata/*, router/pkg/config/fixtures/full.yaml, docs-website/router/configuration.mdx	Adds the ExcludeSubscriptions setting, YAML and environment-variable bindings, schema metadata, configuration fixtures, defaults, and documentation.
Operation-aware rate-limit setup router/core/graphql_handler.go, router/core/websocket.go	Passes the GraphQL operation type to rate-limit setup. Subscription operations bypass limiting when ExcludeSubscriptions is enabled.
Subscription transport validation router-tests/security/ratelimit_test.go	Tests subscription and query rate-limit behavior over WebSocket and SSE with subscription exclusion enabled and disabled.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• wundergraph/cosmo#2486: Changes subscription handling in the same router components.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing subscriptions to be excluded from rate limiting.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.19%. Comparing base (64eaf60) to head (cf52384).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3143      +/-   ##
==========================================
- Coverage   62.37%   62.19%   -0.18%     
==========================================
  Files         262      262              
  Lines       31003    31005       +2     
==========================================
- Hits        19337    19285      -52     
- Misses      10158    10198      +40     
- Partials     1508     1522      +14     

Files with missing lines	Coverage Δ
router/core/graphql_handler.go	62.86% <100.00%> (+0.18%)	⬆️
router/core/websocket.go	77.39% <100.00%> (-0.26%)	⬇️
router/pkg/config/config.go	83.00% <ø> (ø)

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-9e9096039a699a7f55ea2af7938da149bbf1c954-nonroot